Checks

Google Cloud service accounts are evaluated for recent usage within a configurable window (default 180 days) using usage telemetry.

It highlights which accounts show activity versus those with no observed use in that period.

Azure custom roles are analyzed for wildcard permissions. Roles that allow * in actions within their assignable scopes are treated as owner-equivalent, granting unrestricted control over subscription resources.

Presence of an IAM role that has the AWS managed AWSSupportAccess policy attached, designating a support role for interacting with AWS Support Center and related tooling.

IAM users are evaluated for active access keys whose last-used timestamp exceeds max_unused_access_keys_days (default 45). Users without access keys, or whose keys were used within this window, are reported separately.

IAM users granted Bedrock permissions are evaluated for recent service usage.

Users whose last Bedrock access exceeds the configured threshold (default 60 days) or that have never accessed Bedrock are flagged, indicating stale permissions that should be reviewed.

IAM users granted SageMaker permissions are evaluated for recent service usage.

Users whose last SageMaker access exceeds the configured threshold (default 90 days) or that have never accessed SageMaker are flagged, indicating stale permissions that should be reviewed.

IAM users are evaluated for a direct attachment of the AWS managed policy AdministratorAccess. The finding identifies identities where this policy appears among the user's attached policies.

IAM users with console access are evaluated by password_last_used. Inactivity beyond max_console_access_days (default 45) marks stale console access.

Users without console access are excluded.

Disabled IAM user accounts that are no longer needed should be removed to reduce the attack surface. Stale disabled accounts may still have associated resources, permissions, or access keys that could be exploited if re-enabled.

IAM users are evaluated for hardware MFA enrollment, identifying physical tokens or security keys and distinguishing them from virtual or SMS MFA, as well as users without any MFA.

Huawei Cloud IAM users should have MFA enabled. MFA adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to the Huawei Cloud console, they are prompted for their username and password as well as for an authentication code from their MFA device.

IAM users that have a console password are expected to have multi-factor authentication enabled. The evaluation identifies users who can sign in to the AWS Management Console but do not have an active MFA device associated.

IAM users with a console password and active access keys that have last_used as N/A are identified.

This highlights accounts where programmatic credentials exist but have never been exercised.

IAM users are evaluated for having two Active access keys simultaneously.

The check identifies users whose two access key slots are enabled at the same time.

IAM users are assessed for activity using long-lived access keys. Use of static credentials to access services other than IAM or STS indicates reliance on permanent keys instead of temporary role-based credentials.

Workload Identity Federation providers define an attributeCondition (CEL) restricting which external identities may impersonate Google Cloud principals. When a provider trusts a multi-tenant issuer (GitHub Actions, GitLab.com and other shared issuers), omitting the condition trusts every identity that issuer can mint. Providers trusting a dedicated single-tenant issuer are not flagged.

OCI IAM policies granting manage/use on groups or users in the tenancy are evaluated for a condition that excludes the Administrators group, such as target.group.name != 'Administrators'.

Policies missing this restriction are identified.

OCI dynamic groups configured for instance principal access to workloads like Compute instances, Functions, and Autonomous Databases. The evaluation looks for matching rules that target these resources (e.g., instance, fnfunc, autonomousdatabase) to confirm workload identity usage.

OCI tenancy includes at least one active non-root compartment. Only compartments below the root level are considered, indicating that resources are organized outside the root scope.

OCI root compartment is evaluated for the presence of user resources. The finding highlights any assets created at the tenancy root and provides a count per resource_type.

OCI Identity Domain password policies are evaluated to confirm password expiration is configured and set to <= 365 days (password_expires_after). System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded.

Legacy IAM lacks password expiration; tenancies without Identity Domains require manual assessment.

OCI IAM password policies are evaluated to confirm a minimum password length of >= 14 characters is enforced. The assessment considers policies defined in Identity Domains and the legacy tenancy policy, and also detects when no password policy exists. System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded.

OCI Identity Domains password policies are evaluated for password reuse prevention via password history (num_passwords_in_history >= 24). System-managed policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded. Legacy IAM lacks password history.

OCI IAM policies are reviewed for overly broad entitlements, specifically statements granting manage all-resources without scoping to particular services or compartments. Only active policies are considered; the default tenant admin policy is excluded.