Checks

Redis clusters should have a snapshot retention time to ensure that they are backed up and can be restored if required.

Traffic flowing between Elasticache replication nodes should be encrypted to ensure sensitive data is kept private.

Passing unknown or invalid headers through to the target poses a potential risk of compromise. By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth. You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.

IAM account password policies should prevent the reuse of passwords.

The account password policy should be set to prevent using any of the last five used passwords.

IAM account password policies should ensure that passwords content including at least one lowercase character.

IAM account password policies should ensure that passwords content including at least one number.

IAM account password policies should ensure that passwords content including a symbol.

,

IAM account password policies should ensure that passwords content including at least one uppercase character.

IAM account password policies should have a maximum age specified.

The account password policy should be set to expire passwords after 90 days or less.

IAM account password policies should ensure that passwords have a minimum length.

The account password policy should be set to enforce minimum password length of at least 14 characters.

Kinesis streams should be encrypted to ensure sensitive data is kept private. Additionally, non-default KMS keys should be used so granularity of access control can be ensured.

You should configure your KMS keys to auto rotate to maintain security and defend against compromise.

X-Ray tracing enables end-to-end debugging and analysis of all function activity. This will allow for identifying bottlenecks, slow downs and timeouts.

When the principal is an AWS service, the ARN of the specific resource within that service to grant permission to. Without this, any resource from principal will be granted permission – even if that resource is from another account. For S3, this should be the ARN of the S3 Bucket. For CloudWatch Events, this should be the ARN of the CloudWatch Events Rule. For API Gateway, this should be the ARN of the API

Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation

Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation

Public access of the MQ broker should be disabled and only allow routes to applications that require access.

Encryption should be forced for Kafka clusters, including for communication between nodes. This ensure sensitive data is kept private.

Managed streaming for Kafka can log to Cloud Watch, Kinesis Firehose and S3, at least one of these locations should be logged to

Neptune does not have auditing by default. To ensure that you are able to accurately audit the usage of your Neptune instance you should enable export logs.

Encryption of Neptune storage ensures that if their is compromise of the disks, the data is still protected.

RDS backup retention for clusters defaults to 1 day, this may not be enough to identify and respond to an issue. Backup retention periods should be set to a period that is a balance on cost and limiting risk.