Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
eks_cluster_kms_cmk_encryption_in_secrets_enabled
Amazon EKS clusters configure AWS KMS envelope encryption so Kubernetes Secrets are stored in etcd as ciphertext at rest.
eks_cluster_network_policy_enabled
Amazon EKS clusters are evaluated for pod-level network isolation via Kubernetes NetworkPolicy, indicating whether traffic between pods and namespaces is restricted according to defined rules.
eks_cluster_not_publicly_accessible
Amazon EKS cluster API server endpoint is evaluated for unrestricted Internet access, specifically when the public endpoint permits connections from 0.0.0.0/0 instead of private access or limited CIDR ranges.
eks_cluster_private_nodes_enabled
Amazon EKS cluster has private endpoint access enabled for the Kubernetes API server, allowing control plane traffic to use a VPC-resolved private endpoint.
The check evaluates the cluster's endpointPrivateAccess setting.
eks_cluster_uses_a_supported_version
Amazon EKS clusters use a supported Kubernetes version at or above the defined baseline (e.g., 1.28+). The evaluation compares each cluster's Kubernetes minor version to the minimum supported level and highlights clusters running below that baseline.
eks_cluster_vpc_cni_network_policy_enforced
Amazon EKS clusters are evaluated for whether the Amazon VPC CNI managed add-on sets enableNetworkPolicy to true, which is what makes the CNI enforce Kubernetes NetworkPolicy resources. The policy objects themselves live in the cluster and are not exposed by the EKS API, so only this enforcement precondition is verified.
eks_control_plane_logging_all_types_enabled
Amazon EKS clusters are evaluated for control plane logging coverage of required types: api, audit, authenticator, controllerManager, scheduler.
The finding identifies clusters where any of these log types are not configured.
elasticache_cluster_uses_public_subnet
ElastiCache resources (Redis nodes and Memcached clusters) are assessed for placement in public subnets.
The finding identifies cache subnet groups that include subnets configured with Internet routing instead of private-only subnets.
elasticache_redis_cluster_automatic_failover_enabled
Amazon ElastiCache (Redis OSS) replication groups have automatic failover set to enabled, allowing a replica to be promoted when the primary becomes unavailable
elasticache_redis_cluster_auto_minor_version_upgrades
ElastiCache for Redis replication groups are configured to apply automatic minor engine upgrades using AutoMinorVersionUpgrade
elasticache_redis_cluster_backup_enabled
Amazon ElastiCache Redis replication groups have automated snapshot backups enabled with a retention period of at least 7 days.
The evaluation focuses on whether backups are enabled and the configured retention meets the minimum threshold.
elasticache_redis_cluster_in_transit_encryption_enabled
ElastiCache for Redis replication groups have in-transit encryption (TLS) enabled for client and inter-node traffic (TransitEncryptionEnabled=true).
elasticache_redis_cluster_multi_az_enabled
ElastiCache for Redis replication groups have Multi-AZ automatic failover enabled, distributing primary and replicas across distinct Availability Zones
elasticache_redis_cluster_rest_encryption_enabled
ElastiCache for Redis replication groups are evaluated for encryption at rest of on-disk cache data and backups. The finding pinpoints groups where this protection is not enabled.
elasticache_redis_replication_group_auth_enabled
Amazon ElastiCache Redis replication groups running versions prior to 6.0 are evaluated for the use of AUTH tokens. For 6.0+, the finding indicates ACL/RBAC configuration should be reviewed instead of token-based AUTH.
elasticbeanstalk_environment_cloudwatch_logging_enabled
Elastic Beanstalk environments are configured to stream instance and proxy logs to Amazon CloudWatch Logs via the StreamLogs setting
elasticbeanstalk_environment_enhanced_health_reporting
Elastic Beanstalk environments have health reporting set to enhanced instead of basic.
elasticbeanstalk_environment_managed_updates_enabled
Elastic Beanstalk environments with managed platform updates enabled (ManagedActionsEnabled: true) automatically apply platform patch/minor updates during a scheduled maintenance window.
elasticbeanstalk_environment_no_secrets_in_configuration
AWS Elastic Beanstalk environments are inspected for hardcoded secrets in configuration option settings. Secrets such as API keys, passwords, access tokens, or credentials should not be stored in environment configuration.
elb_connection_draining_enabled
Classic Load Balancer has connection draining enabled, so deregistering or unhealthy instances stop receiving new requests while existing connections are allowed to complete within the configured drain window.
elb_cross_zone_load_balancing_enabled
Classic Load Balancer with cross-zone load balancing distributes requests across registered targets in all enabled Availability Zones.
This evaluates whether that setting is enabled, instead of restricting distribution to targets within only the same zone.
elb_desync_mitigation_mode
Classic Load Balancer desync_mitigation_mode is evaluated to determine whether it is configured as defensive or strictest. Any other mode (such as monitor) is identified for attention.
Elastic Load Balancer HTTPS listeners are assessed for use of a strong TLS policy. Listeners associated with ELBSecurityPolicy-TLS-1-2-2017-01 are considered to negotiate only modern protocols and ciphers, avoiding legacy SSL/TLS and weak suites.
elb_internet_facing
Elastic Load Balancers are evaluated for the scheme to determine whether they are internet-facing or internal, indicating if the endpoint is publicly reachable via a public DNS name.