Checks

IAM groups are assessed for the AWS-managed AdministratorAccess policy attachment.

The finding reports any group that has this policy among its attached permissions.

IAM inline policies are evaluated for permission combinations that enable privilege escalation, such as sts:AssumeRole, iam:PassRole, attaching/editing policies, or broad wildcards. The result highlights inline policies that allow a principal to obtain higher effective access.

IAM inline policies on identities are evaluated for statements allowing Action:"*" on Resource:"*", which indicates unrestricted administrative access.

IAM inline policies are evaluated for statements that grant full CloudTrail permissions (cloudtrail:*) to all resources.

The finding flags identity policies that provide unrestricted control over CloudTrail operations.

IAM inline policies are analyzed to identify statements that grant unrestricted AWS KMS access via the wildcard action kms:*.

IAM inline policies are analyzed to identify statements that grant aws-marketplace:Subscribe on all resources (*). This action controls the ability to subscribe to AWS Marketplace products, including Amazon Bedrock foundation models, and should be scoped to specific product ARNs to enforce least privilege.

Custom IAM policies with Allow statements that grant sts:AssumeRole (or sts:*/*) to a wildcard Resource.

IAM server certificates stored in AWS IAM are evaluated for expiration by comparing their validity period to the current time. Certificates with a NotAfter date in the past are identified as expired.

AWS root user is evaluated for active access keys. It identifies whether the root identity has one or two programmatic credentials and notes when organization-level root credential management is present.

Google Cloud IAM policies are inspected for project-level grants of roles/iam.serviceAccountUser and roles/iam.serviceAccountTokenCreator to principals. The focus is on bindings that enable attaching or impersonating service accounts at the project scope rather than on individual service accounts.

Google Cloud organization has Essential Contacts defined at the organization level for categories such as SECURITY, BILLING, LEGAL, SUSPENSION, TECHNICAL, or PRODUCT_UPDATES.

Evaluates whether at least one contact is configured.

Huawei Cloud IAM password policies can enforce character complexity by requiring multiple character types (uppercase, lowercase, digits, special characters). It is recommended that at least 3 character types be required to increase password strength.

Huawei Cloud IAM password policies can enforce password expiration. It is recommended that the password validity period be set to a non-zero value so that passwords must be rotated periodically, reducing the window of opportunity for compromised credentials.

IAM account password policy sets a password expiration period for IAM user console logins; configuration is aligned when rotation is enabled and set to <= 90 days.

IAM password policy requires at least one lowercase character in user passwords via the Require lowercase setting

Huawei Cloud IAM password policies can enforce a minimum password age, preventing users from changing passwords too frequently. This works in conjunction with password reuse prevention to ensure users cannot cycle through disallowed passwords to reuse an old one.

IAM password policy is assessed for the minimum password length setting, confirming it meets >= 14 characters for IAM console users.

IAM account password policy requires at least one numeric character (0-9) in IAM user passwords

IAM account password policy uses password reuse prevention set to 24 remembered passwords (maximum history) for IAM users

Huawei Cloud IAM password policies can prevent users from reusing recent passwords. It is recommended that the policy disallow reuse of at least the last 3 passwords to ensure users choose new passwords upon rotation.

IAM account password policy includes the Require at least one non-alphanumeric character rule for IAM user passwords

IAM account password policy enforces the presence of at least one uppercase letter (A-Z) in IAM user passwords.

This evaluates whether the uppercase complexity rule is enabled for console passwords.

Customer-managed IAM policies are evaluated for permissions that enable privilege escalation, including creating or updating policies, altering role trust, attaching higher-privilege policies, or using iam:PassRole to obtain broader access.

IAM users have identity-based policies attached directly (managed or inline) instead of inheriting permissions via groups or roles.