Checks

Etcd requires peer client certificate authentication for inter-member traffic via --peer-client-cert-auth=true set in the etcd container command

Etcd peer communication is treated as secure when TLS is configured with a peer certificate and key (e.g., --peer-cert-file and --peer-key-file). The assessment inspects etcd containers for these options to determine whether server-to-server traffic is encrypted and authenticated.

Etcd pods are assessed for TLS-enabled client communication, indicated by --cert-file and --key-file in container arguments, showing that Kubernetes API state traffic is encrypted in transit.

Etcd configuration is assessed to ensure it trusts a unique Certificate Authority via --trusted-ca-file, distinct from the API server's --client-ca-file. If the same CA file is used, etcd shares the cluster CA; differing files imply separation, though CA content should still be verified.

EventBridge event bus has a resource policy that grants cross-account event delivery to principals outside the account, including broad or public access.

Focus is on buses whose policies permit external accounts to send events.

EventBridge event bus resource policy is evaluated for public access, such as a Principal: "*" or overly broad conditions that allow any AWS account to publish events or manage rules on the bus.

EventBridge global endpoints are configured with event replication ENABLED (not DISABLED) so custom events are replicated to both the primary and secondary Regions.

EventBridge schema registry resource policies are assessed for cross-account access. It identifies statements that grant external or public principals (e.g., Principal: * or other accounts) permissions to interact with the registry and its schemas.

OCI Notifications is evaluated for the existence of at least one topic that has one or more subscriptions.

The focus is on whether subscribed endpoints are present to receive Events and monitoring alerts.

OCI Events rules subscribe to Cloud Guard problem lifecycle events-com.oraclecloud.cloudguard.problemdetected, com.oraclecloud.cloudguard.problemdismissed, and com.oraclecloud.cloudguard.problemremediated-and include notification actions. When Cloud Guard sets a reporting region, rules are expected in that region.

OCI Events rules monitor IAM group lifecycle events (creategroup, updategroup, deletegroup) and include notification actions to generate alerts when these changes occur.

OCI Events rules configured to capture IAM policy create, update, and delete events (com.oraclecloud.identitycontrolplane.createpolicy, com.oraclecloud.identitycontrolplane.updatepolicy, com.oraclecloud.identitycontrolplane.deletepolicy) and include a notification action.

OCI Events rules monitor IAM identity provider creation, update, and deletion and include a notification action. The evaluation identifies rules that filter these events and route matching activity to a notification destination.

OCI Events rules monitor IdP group mapping changes with notification actions for com.oraclecloud.identitycontrolplane.addidpgroupmapping, com.oraclecloud.identitycontrolplane.removeidpgroupmapping, and com.oraclecloud.identitycontrolplane.updateidpgroupmapping.

OCI Events rules targeting com.oraclecloud.identitysignon.interactivelogin are assessed for configured notification actions to monitor local user interactive sign-ins. Rules are compartment-scoped and can cover child compartments.

OCI Events rules monitor network gateway lifecycle and attachment changes (DRG, Internet, NAT, Service, and Local Peering gateways) and include notification actions so changes generate alerts.

The evaluation looks for rules filtered to these events and confirms they trigger notifications.

OCI Events rules targeting Network Security Group (NSG) changes are evaluated for notification actions. Monitored events: createnetworksecuritygroup, updatenetworksecuritygroup, deletenetworksecuritygroup, and changenetworksecuritygroupcompartment under com.oraclecloud.virtualnetwork.

OCI Events rules for VCN route tables monitor lifecycle and compartment changes and include notification actions.

The evaluation looks for rules that capture create, update, delete, and changeCompartment events for route tables and send notifications.

OCI Events rules for VCN security lists monitor lifecycle changes-create, update, delete, and compartment moves-and include notification actions. The evaluation looks for rules that filter these events and confirms a configured notification target.

OCI Events rules targeting IAM user changes (e.g., com.oraclecloud.identitycontrolplane.createuser and related update/delete/state events) are assessed for attached notification actions.

The finding indicates which rules listen for these events and whether they are configured to emit alerts.

OCI Events rules exist to capture VCN lifecycle changes (create, update, delete) via event types com.oraclecloud.virtualnetwork.createvcn, com.oraclecloud.virtualnetwork.updatevcn, com.oraclecloud.virtualnetwork.deletevcn, and include notification actions.

Ensure that all Huawei Cloud Elastic Volume Service (EVS) disks are encrypted to protect data at rest.

Microsoft 365 Exchange Online applications with mailbox access permissions should be restricted using Application Access Policies.

This check evaluates whether applications granted Exchange-related Microsoft Graph application permissions are scoped using Exchange Online ApplicationAccessPolicy objects.

Microsoft 365 Exchange Online uses native external sender identification so supported Outlook clients display an External tag on messages originating outside the organization.