Checks

CloudTrail logs in CloudWatch Logs are inspected for a metric filter and alarm that track AWS Config configuration changes, specifically StopConfigurationRecorder, DeleteDeliveryChannel, PutDeliveryChannel, and PutConfigurationRecorder events from config.amazonaws.com.

CloudTrail logs include a metric filter for trail configuration events (CreateTrail, UpdateTrail, DeleteTrail, StartLogging, StopLogging) with an associated CloudWatch alarm to alert on matches.

Evaluates the presence of this filter-and-alarm monitoring.

CloudWatch Logs metric filter and alarm for AWS Management Console authentication failures, sourced from CloudTrail (eventName=ConsoleLogin, errorMessage="Failed authentication").

Identifies whether these failures are converted into a metric and actively monitored by an alarm.

CloudWatch Logs metric filters and alarms monitor AWS Organizations change events recorded by CloudTrail, including actions like CreateAccount, AttachPolicy, MoveAccount, and UpdateOrganizationalUnit.

The evaluation looks for a filter on the trail log group matching organizations.amazonaws.com events and an alarm linked to that metric.

CloudTrail events delivered to CloudWatch are evaluated for a metric filter and alarm that monitor KMS CMK state changes, specifically DisableKey and ScheduleKeyDeletion from kms.amazonaws.com.

CloudTrail logs are assessed for a CloudWatch metric filter matching S3 bucket configuration changes (ACL, policy, CORS, lifecycle, replication; e.g., PutBucketPolicy, DeleteBucketPolicy) and for an associated CloudWatch alarm.

CloudWatch uses a metric filter and alarm to track IAM policy changes recorded by CloudTrail (e.g., CreatePolicy, DeletePolicy, version changes, inline policy edits, policy attach/detach). This finding reflects whether that filter and an associated alarm are present on the trail's log group.

CloudTrail logs in CloudWatch include a metric filter for root account activity ({ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }) and a linked CloudWatch alarm that triggers when the filter matches.

CloudTrail events for security group configuration changes are monitored using a CloudWatch Logs metric filter with an associated alarm. The filter targets actions like AuthorizeSecurityGroupIngress/Egress, RevokeSecurityGroupIngress/Egress, CreateSecurityGroup, and DeleteSecurityGroup to surface any security group modifications.

CloudTrail logs in CloudWatch are assessed for a metric filter and alarm that detect console logins where $.eventName = ConsoleLogin and $.additionalEventData.MFAUsed != \"Yes\".

This reflects whether alerting exists for sign-ins that occur without MFA.

CloudWatch Logs for CloudTrail include a metric filter that matches unauthorized API errors ($.errorCode="*UnauthorizedOperation" or $.errorCode="AccessDenied*") and a linked alarm that triggers when events match the filter.

AWS CodeArtifact packages with an internal or unknown origin are evaluated for their package origin controls. The check identifies packages where the upstream setting allows ingesting versions from external or upstream repositories.

CodeBuild projects are assessed for logging configuration to Amazon CloudWatch Logs or S3, identifying when at least one destination is enabled for build logs and events.

AWS CodeBuild projects are inspected for plaintext environment variables (PLAINTEXT) that resemble secrets (keys, tokens, passwords).

Such values indicate sensitive data is stored directly in environment variables instead of being sourced securely.

AWS CodeBuild project visibility is assessed to identify projects exposed to the public. Projects with project_visibility set to PUBLIC_READ (or not PRIVATE) allow anyone to access build results, logs, and artifacts.

AWS CodeBuild projects are assessed for recent activity using the last build invocation timestamp. Projects not invoked within 90 days or never built are treated as inactive.

CodeBuild projects with S3 log delivery are evaluated for encryption at rest on their S3 log objects. Only projects that write logs to S3 are in scope.

AWS CodeBuild projects with Bitbucket sources are assessed to confirm repository URLs do not embed credentials (for example, x-token-auth:<token>@ or user:password@). The assessment includes both the primary source and all secondary sources.

AWS CodeBuild projects are evaluated for use of a user-controlled buildspec, identified when the project references a repository file like *.yml or *.yaml. Projects using non file-based build instructions are treated as centrally managed.

CodeBuild projects sourcing from GitHub/GitHub Enterprise with a service role that trusts CodeBuild are evaluated by deriving the repository's organization from its URL and comparing it to an allowed organizations list.

AWS CodeBuild webhook filters using ACTOR_ACCOUNT_ID, HEAD_REF, or BASE_REF have regex patterns anchored with ^ (start) and $ (end) to enforce exact matching and prevent substring bypass attacks.

CodeBuild report groups with export type S3 are evaluated to confirm their exported test results are encrypted at rest with a KMS key.

Report groups configured with NO_EXPORT are out of scope.

AWS CodeCommit repositories are scanned for hardcoded secrets such as API keys, tokens, and passwords in every file tracked at the tip of the default branch. CodeCommit repositories, including their branches and commit history, are a top source of leaked credentials, and secrets can persist in history even after being removed from HEAD.

CodePipeline pipeline should configure its source stage to use a private repository with authenticated connection rather than a public GitHub or GitLab repository. This ensures deployment configurations, build artifacts, and CI/CD logic remain protected from unauthorized access.