Checks

Google Workspace domain has between 2 and 4 super administrators.

Having too few super admins creates a single point of failure and administrative access issues if the only admin is unavailable. Having too many super admins increases the attack surface and the risk of unauthorized access to critical administrative functions.

Super admin accounts do not also hold additional admin roles such as Groups Admin, User Management Admin, etc. Each super administrator has a separate, non-admin account for daily activities, following the principle of least privilege.

EBS snapshots are expected to be governed by Data Lifecycle Manager (DLM) policies in each Region where snapshots exist.

The evaluation looks for lifecycle policies that automate snapshot creation, retention, and cleanup for those snapshots.

AWS DMS MongoDB endpoints use an authentication mechanism. Configuration expects AuthType not no (e.g., password) with an authMechanism such as scram_sha_1 or mongodb_cr.

DMS Neptune endpoints have IAM authorization enabled via the endpoint setting IamAuthEnabled.

DMS Redis OSS endpoints are assessed for the presence of TLS in their endpoint settings, such as ssl-encryption, indicating encrypted connections between the DMS replication instance and Redis.

AWS DMS endpoints have their SSL/TLS mode inspected; any value other than none denotes encrypted connections between the replication instance and databases.

Supported modes include require, verify-ca, and verify-full.

AWS DMS replication instances are evaluated for the auto_minor_version_upgrade setting to confirm automatic minor engine updates are enabled during the maintenance window.

AWS DMS replication instances are evaluated for Multi-AZ configuration. Instances with multi_az enabled are treated as having a cross-AZ standby; those without it are identified as single-AZ.

AWS DMS replication instances are evaluated for public exposure. Exposure is identified when PubliclyAccessible is enabled and an attached security group allows inbound traffic from any address. Private or allowlisted instances are not considered exposed.

AWS DMS replication tasks have logging enabled and configure SOURCE_CAPTURE and SOURCE_UNLOAD with severity at least LOGGER_SEVERITY_DEFAULT (or higher: LOGGER_SEVERITY_DEBUG, LOGGER_SEVERITY_DETAILED_DEBUG).

AWS DMS replication tasks have target logging enabled, including TARGET_APPLY and TARGET_LOAD, each set to at least LOGGER_SEVERITY_DEFAULT.

Cloud DNS managed zones are assessed for DNSSEC status. Zones with DNSSEC sign zone data and publish DNSKEY/RRSIG; zones without it remain unsigned and unauthenticated.

Cloudflare DNS records (CNAME, MX, NS, SRV) that point to hostnames are assessed for dangling record vulnerabilities by checking if the target domain resolves to a valid address, preventing subdomain takeover, mail interception, and service hijacking attacks.

Cloudflare DNS records are assessed for internal IP exposure by checking if A or AAAA records point to private, loopback, or reserved IP addresses which could leak internal network structure.

Cloudflare DNS records are assessed for wildcard usage by checking if A, AAAA, CNAME, MX, or SRV records use wildcard entries (*.example.com) which can increase attack surface, expose unintended services, or allow mail interception.

Cloudflare DNS records are assessed for proxy configuration by checking if A, AAAA, and CNAME records are proxied through Cloudflare to benefit from DDoS protection, WAF, and caching capabilities.

Cloud DNS zones are assessed for DNSSEC Key-Signing Key (KSK) algorithms, specifically detecting use of rsasha1. Zones with KSKs on modern algorithms are distinguished from those still using rsasha1.

Cloud DNS DNSSEC settings are inspected for the zone-signing key algorithm. Zones that use rsasha1 for zone signing are identified.

Amazon DocumentDB clusters are evaluated for automated backups and an adequate backup retention period. Clusters should have backup_retention_period set to at least the configured minimum (default 7 days). Values of 0 indicate backups are disabled; values below the threshold are considered insufficient.

Amazon DocumentDB clusters are evaluated for exporting audit and profiler logs to CloudWatch Logs. Clusters missing one or both log types are identified as lacking complete log export configuration.

Amazon DocumentDB clusters are evaluated for the deletion_protection setting on the cluster configuration.

The finding highlights clusters where this protection is not enabled.

Amazon DocumentDB clusters with Multi-AZ (multi_az) indicate deployment of a primary and one or more replicas across Availability Zones.

Amazon DocumentDB manual cluster snapshot visibility is evaluated to detect snapshots marked as public instead of limited to specified AWS accounts.