Checks

Setup TLS connection on the Kubelets.

Setup TLS connection on the Kubelets.

Enable kubelet client certificate rotation.

Enable kubelet server certificate rotation.

Ensure that the Kubelet is configured to only use strong cryptographic ciphers.

Check for insecure annotations in ingress-nginx configurations.

Azure Key Vaults configured with private endpoints have public network access set to Disabled, so connectivity occurs only over the private link.

Each enabled key in an Azure Key Vault using access policies (non-RBAC) is assessed to confirm it has an expiration (exp) attribute defined.

Each Azure Key Vault key is assessed for a rotation policy that includes a Rotate lifetime action scheduling automatic key version creation.

Azure Key Vault diagnostic settings capture audit logs (AuditEvent) when the AuditEvent category is enabled, or when category groups audit and allLogs are enabled, and routed to a supported destination. Logged events include management and data-plane operations on vaults, keys, secrets, and certificates.

Each enabled secret in an Azure Key Vault (non-RBAC) is assessed to confirm it has an explicit expiration date (expires attribute) defined.

Azure Key Vault has private endpoint connections to serve secret and key operations over a private IP within your virtual network via Azure Private Link.

Azure Key Vault uses the Azure RBAC permission model for data-plane access to keys, secrets, and certificates, rather than legacy access policies.

Evaluates whether data access is managed through role assignments at the vault.

Each enabled key in an Azure Key Vault with RBAC-enabled access control is assessed to confirm it has an expiration (exp) attribute defined.

Each enabled secret in an Azure Key Vault (RBAC) is assessed to confirm it has an exp (expiration) date configured.

Azure Key Vault recoverability requires both enable_soft_delete and enable_purge_protection. With these enabled, vault objects remain recoverable after deletion and cannot be permanently purged during the retention period.

Kinesis Data Streams retention window is evaluated to confirm records are kept for at least the configured minimum duration (default 168 hours).

Amazon Kinesis Data Streams with server-side encryption use AWS KMS to protect records at rest. The evaluation determines whether a stream has SSE-KMS configured with a KMS key; streams lacking KMS-based at rest encryption are identified.

Customer-managed KMS keys are assessed by key state. Keys in Enabled are considered in use. Keys not Enabled and not PendingDeletion are identified as unused, while those in PendingDeletion are recognized as scheduled for removal.

Customer-managed KMS keys are evaluated for the PendingDeletion state, indicating a scheduled deletion during the mandatory waiting period.

AWS KMS customer-managed keys in an Enabled state are assessed for the multi-Region setting. The finding highlights keys with the multi-Region property enabled.

Customer-managed KMS symmetric keys in the Enabled state are evaluated to confirm automatic rotation of key material is configured

Detects bypass paths in enclave KMS key policies: Allow statements that grant sensitive KMS actions without a restrictive kms:RecipientAttestation:* condition and without a paired Deny that neutralizes the gap. Includes the common root-delegation shape (Principal: root, Action: kms:*) when it is not paired with an attestation Deny.

Sensitive Allow statements on enclave KMS keys are checked for deployment-context binding: PCR3 (parent IAM role, AWS-recommended), PCR4 (parent instance ID), PCR8 (EIF signing cert), or an account-level condition (aws:PrincipalAccount / SourceAccount / OrgID / ResourceAccount / OrgPaths) paired with a RecipientAttestation binding. PCR0/PCR1/PCR2 travel with the EIF and do not bind deployment.