Checks

Amazon Cognito identity pools are evaluated for guest access to unauthenticated identities. The assessment considers the allow_unauthenticated_identities setting and whether an unauthenticated role can be assumed by guests.

Amazon Cognito user pools are evaluated for Threat protection (advanced security) mode: ENFORCED (full-function) vs AUDIT or disabled. This indicates whether adaptive risk responses and compromised-credential checks are applied during authentication.

Amazon Cognito user pool threat protection blocks sign-ins when compromised credentials are detected. Advanced security is ENFORCED, and the compromised-credentials policy applies a BLOCK action to sign-in events.

Amazon Cognito user pool with threat protection in ENFORCED mode and adaptive authentication actions set to BLOCK for low, medium, and high account-takeover risk levels.

Evaluates the user pool's risk configuration to confirm risky sign-in attempts are blocked across all severities.

Amazon Cognito app clients use PreventUserExistenceErrors to suppress user-existence disclosures, keeping authentication, confirmation, and recovery responses generic rather than indicating whether a username exists.

Amazon Cognito user pool app clients are evaluated for token revocation being enabled via EnableTokenRevocation.

This identifies whether each client can invalidate refresh tokens and the access/ID tokens derived from them to end user sessions.

Amazon Cognito user pools have deletion protection set to ACTIVE. The evaluation inspects each user pool's deletion protection status.

Amazon Cognito user pools with MFA set to ON, indicating an additional factor is enforced during authentication

Amazon Cognito user pools are assessed for a password policy that includes a lowercase character requirement. Pools with require_lowercase set are distinguished from those without a policy, which inherently lack this requirement.

Amazon Cognito user pools should have a password policy requiring a minimum length of 14.

This evaluation detects pools without a policy or with minimum_length below 14.

Amazon Cognito user pools are evaluated for a password policy that requires at least one number. The assessment checks whether the policy enforces a numeric character via RequireNumbers and also identifies pools with no password policy configured.

Amazon Cognito user pool password policy includes a symbol requirement for user passwords.

Assesses the presence of a policy and whether require_symbols is configured.

Amazon Cognito user pool password policy is evaluated for an uppercase character requirement (require_uppercase). The check also identifies user pools that have no password policy configured.

Amazon Cognito user pools are evaluated for self-service sign-up. The expected configuration is AllowAdminCreateUserOnly=true so only administrators create accounts.

When self sign-up is allowed, the check also highlights any linked identity pools and the authenticated role(s) that new users could assume.

Amazon Cognito user pools use administrator-issued temporary passwords. This evaluates whether a user pool defines a password policy and sets the temporary password validity to 7 days or fewer.

Amazon Cognito user pools are evaluated for an association with an AWS WAFv2 web ACL that filters and controls requests to the hosted UI and public user pool API endpoints.

AWS Config has a delegated administrator registered via AWS Organizations and at least one Configuration Aggregator with an OrganizationAggregationSource that covers all AWS regions, ensuring centralized org-wide configuration visibility.

AWS accounts have AWS Config recorders active and healthy in each Region. It identifies Regions with no recorder, a disabled recorder, or a recorder in a failure state.

AWS Config recorders are evaluated for use of the service‑linked IAM role AWSServiceRoleForConfig linked to config.amazonaws.com rather than a custom role.

The evaluation inspects active recorders and their role ARN to confirm the AWS‑managed service‑linked role is in use.

AWS Data Pipeline definitions are inspected for hardcoded secrets, such as keys, tokens, passwords, or database credentials embedded directly in pipeline objects, parameters, or parameter values.

AWS DataSync tasks are evaluated for a configured CloudWatch Logs destination (CloudWatchLogGroupArn).

Tasks that specify a log group are recognized as logging-enabled; those without one are identified as not publishing execution events.

AWS Direct Connect connectivity is provisioned with connection and location redundancy-multiple connections spread across at least two distinct Direct Connect locations in each Region.

Direct Connect gateways and virtual private gateways are assessed for interface redundancy: multiple virtual interfaces (VIFs) distributed across more than one Direct Connect connection.

Gateways with only one VIF or with all VIFs on a single connection are identified.

AWS Directory Service directories are configured to forward domain controller security event logs to CloudWatch Logs using log subscriptions.

Evaluation identifies directories with or without this forwarding in place.