Checks

EC2 security groups are evaluated for inbound rules that expose Postgres on TCP 5432 to the Internet. Rules permitting 0.0.0.0/0 or ::/0 to this port, or policies that open all ports publicly, are identified.

EC2 security groups permitting Internet sources (0.0.0.0/0 or ::/0) to TCP 6379 are identified, indicating Redis is reachable from public networks

EC2 security groups with inbound rules that allow Internet sources (0.0.0.0/0, ::/0) to reach Microsoft SQL Server on TCP 1433 or TCP 1434

EC2 security groups are evaluated for rules that allow inbound Telnet on TCP 23 from the Internet (0.0.0.0/0 or ::/0).

EC2 security groups with rules that permit non-RFC1918 IPv4 ranges wider than /24 are identified across both ingress and egress.

The focus is on public CIDRs (/1-/23) that broadly expose sources or destinations, not on private networks.

Default VPC security group should have no inbound or outbound rules. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.

EC2 security groups whose names include launch-wizard are identified as created by the EC2 Launch Wizard, distinguishing auto-generated groups from curated, baseline-controlled groups.

EC2 security groups, except default, are assessed for unused status: zero attached network interfaces, no AWS Lambda associations, no AWS Batch compute environment associations, and no references from other security groups.

EC2 security groups are evaluated for excessive rule counts, flagging groups where ingress or egress entries exceed the configured threshold (default 50). This targets groups with unusually large rule sets that complicate access control.

EC2 Transit Gateways with AutoAcceptSharedAttachments=enable automatically approve cross-account VPC attachments.

The evaluation identifies transit gateways configured to auto-accept shared attachments.

Amazon ECR registries with repositories are evaluated for enhanced scanning, the Amazon Inspector-powered scan type that covers operating system and programming language packages and can rescan images continuously as new CVEs are published. A registry left on basic scanning is reported as failing.

Amazon ECR registries with repositories are evaluated for automated image scanning at the registry level -- scan on push or continuous scanning -- with scan rules that cover all repositories (no restrictive filters), for either basic or enhanced scanning. A registry whose rules specify only MANUAL scanning does not scan pushed images.

Amazon ECR repositories have a lifecycle policy configured to automatically expire container images based on age, count, or tags.

Amazon ECR repositories are evaluated for public exposure via repository policies that allow anonymous principals (e.g., Principal: "*") to access the repo, including image listing, pulling, or modification.

[DEPRECATED] Amazon ECR repositories are evaluated for image scanning on push; when configured, new image uploads automatically trigger a vulnerability scan (scan_on_push).

Amazon ECR repositories are assessed on the most recent pushed image to confirm a vulnerability scan exists, completed successfully, and that no results meet or exceed the configured minimum severity (e.g., CRITICAL, HIGH, MEDIUM).

Amazon ECR repositories are assessed for image tag immutability. Repositories permitting tag updates (MUTABLE) are identified; those enforcing immutable tags (such as IMMUTABLE) are recognized.

The latest image pushed to each Amazon ECR repository is analyzed for embedded secrets: environment variables and build history (Dockerfile instructions) recorded in the image configuration, plus the file contents of every filesystem layer. Findings reference the variable, build step, or file, never the secret value.

Alibaba Cloud ECS disk encryption protects data at rest by automatically encrypting data transferred to disks and decrypting when read. Ensuring all attached disks are encrypted prevents unauthorized access to stored data. This check verifies disk encryption is enabled on all ECS disks attached to instances, using KMS for key management.

ECS clusters have CloudWatch Container Insights configured via the containerInsights setting, accepting enabled or enhanced values to emit cluster, service, task, and container telemetry.

Alibaba Cloud Security Center provides endpoint protection for ECS instances with real-time detection and removal of malicious software. This check verifies the Security Center agent is installed and active on all ECS instances, ensuring alerts notify administrators when malicious software attempts to install or execute.

Ensure that Elastic Cloud Server (ECS) instances use SSH key pairs instead of password-based authentication for secure access.

Alibaba Cloud Security Center checks for the latest updates in Linux and Windows systems running on ECS instances. Keeping virtual machines updated with the latest OS patches addresses specific bugs, improves general stability, and fixes security vulnerabilities. This check verifies that all known vulnerabilities detected by Security Center have been patched on each ECS instance.

Ensure that Elastic Cloud Server (ECS) instances do not use the default security group, which may have overly permissive rules.