Checks

Azure Monitor Activity Logs sent to a Storage account are evaluated to confirm encryption with Customer-Managed Keys (CMK) instead of Microsoft-managed keys.

Azure Monitor Activity Logs sent to a Storage account are evaluated for Blob public access. The finding identifies whether the account that stores the logs has AllowBlobPublicAccess turned on.

ActiveMQ broker deployment mode is configured as active/standby (ACTIVE_STANDBY_MULTI_AZ), indicating a redundant pair operating across Availability Zones

Amazon MQ brokers have autoMinorVersionUpgrade enabled to automatically apply supported minor and patch engine updates during the scheduled maintenance window.

Amazon MQ RabbitMQ brokers are assessed for cluster deployment mode (CLUSTER_MULTI_AZ) with nodes spread across multiple AZs and shared state.

Brokers configured otherwise are identified.

Amazon MQ brokers have logging to CloudWatch Logs enabled per engine type: ActiveMQ requires both general and audit logs; RabbitMQ requires general logs.

Amazon MQ brokers are evaluated for public accessibility, determining whether a broker exposes a public endpoint or is restricted to VPC-only connectivity via its publicly accessible setting.

Azure Database for MySQL Flexible Server audit configuration includes the CONNECTION event in audit_log_events.

Azure Database for MySQL Flexible Server with audit_log_enabled set to ON generates audit logs for connections, authentication, DDL/DML, and administrative actions.

Azure MySQL Flexible Server is evaluated for geo-redundant backup. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and recovery from a full regional outage.

Azure MySQL Flexible Server is evaluated for high availability mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.

Azure Database for MySQL Flexible Server uses the tls_version setting to permit only modern TLS for client connections, requiring TLSv1.2+ and excluding TLSv1.0 and TLSv1.1.

Azure Database for MySQL Flexible Server uses the require_secure_transport parameter to enforce encrypted connections. This evaluation determines whether the server is configured to require TLS/SSL for all client sessions.

Neptune DB cluster automated backup is enabled and retention days are more than the required minimum retention period (default to 7 days).

Neptune DB cluster is configured to copy all tags to snapshots when snapshots are created.

Neptune DB cluster has deletion protection enabled.

Neptune DB clusters are evaluated for IAM database authentication.

If this setting is enabled, the cluster supports IAM-based authentication. If disabled, the cluster requires traditional database credentials instead.

Neptune DB cluster is inspected for CloudWatch export of audit events. The finding indicates whether the cluster publishes audit logs to CloudWatch; a failed status in the report means the audit export is not enabled and audit records are not being forwarded to CloudWatch for centralized logging and review.

Amazon Neptune DB clusters are evaluated for Multi-AZ deployment by checking whether the cluster has read-replica instances distributed across multiple Availability Zones.

A failing result indicates the cluster is deployed in a single AZ and lacks read-replicas that enable automatic promotion and cross-AZ failover.

Neptune DB manual cluster snapshot is evaluated to determine if its restore attributes allow access to all AWS accounts (public).

A failed status in the report means the snapshot is publicly shared and can be copied or restored by any AWS account; PASS means it is not shared publicly.

Neptune DB cluster snapshot is encrypted at rest. The evaluation looks at whether each snapshot's encrypted attribute is enabled, confirming that the data is protected while stored.

Neptune DB cluster is evaluated for encryption at rest. Indicating the cluster's underlying storage is not encrypted.

Neptune cluster is associated with one or more public subnets.

Azure subscription contains an Azure Bastion host for secure RDP/SSH brokering over TLS on 443/TCP to virtual machines using private IPs. The assessment identifies whether such a bastion is available.