Checks

OCI Object Storage buckets use customer-managed encryption keys (CMEK) for server-side encryption, with an associated KMS key configured on the bucket.

OCI Object Storage buckets have service logs for write access events enabled.

The evaluation identifies buckets with an active write logging category scoped to the bucket and region; only read logging does not satisfy this condition.

OCI Object Storage buckets are assessed for public accessibility. Buckets configured as NoPublicAccess deny anonymous reads; any other public access setting indicates bucket contents may be reachable without authentication.

S3 Object Lock prevents objects from being deleted or overwritten for a fixed period or indefinitely. Enabling it protects against accidental deletion and ransomware by enforcing a write-once-read-many (WORM) model. Object Lock can only be enabled when the bucket is created.

An ObjectStorage default retention policy automatically applies a minimum retention period to every object uploaded to the bucket, preventing deletion or overwriting before the period expires. Without it, objects can be removed immediately after upload, undermining compliance and data durability requirements.

OCI Object Storage buckets are assessed for versioning being set to Enabled, indicating prior object versions are retained when updates or deletions occur.

OpenStack Swift containers are evaluated to verify that the read ACL does not use *:* (global sharing). The *:* ACL grants read access to all authenticated users from any project in the OpenStack deployment, violating project isolation and the principle of least privilege.

OpenStack Swift containers are evaluated to verify that public container listings are disabled. The .rlistings ACL allows users with read access to list all objects within the container. When combined with .r:*, this enables unauthenticated users to enumerate all objects, facilitating targeted data exfiltration.

OpenStack Swift container metadata is evaluated to detect sensitive data such as passwords, API keys, secrets, and private keys. Container metadata is accessible to any user with read access to the container. Storing secrets in metadata exposes them to unauthorized access and credential theft.

OpenStack Swift containers are evaluated to verify that anonymous read access is not granted. The .r:* ACL allows any unauthenticated user on the internet to read objects in the container. This is a critical exposure that can lead to data leaks, especially when containers hold sensitive information such as backups, logs, or application data.

OpenStack Swift containers are evaluated to verify that container sync is not configured. Container sync replicates objects to another Swift cluster, potentially outside the organization's control. Unauthorized sync configurations can be used for data exfiltration to external clusters.

OpenStack Swift containers are evaluated to verify that object versioning is enabled. Versioning preserves previous versions of objects when they are overwritten or deleted, enabling recovery from accidental modifications, ransomware attacks, and data corruption.

OpenStack Swift containers are evaluated to verify that write access is restricted. The *:* write ACL allows any authenticated user from any project to create, modify, or delete objects. The * write ACL similarly grants unrestricted write access. Both configurations violate the principle of least privilege.

Ensure that Object Storage Service (OBS) buckets are not publicly accessible to prevent unauthorized access to stored objects.

Compute instance requests an IP reservation from a public pool

The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.

Amazon OpenSearch Service domains are evaluated for fine-grained access control being enabled in advanced-security-options, ensuring role-based authorization at index, document, and field levels for API and Dashboards access.

Amazon OpenSearch Service domains have audit logs enabled via AUDIT_LOGS

Amazon OpenSearch Service domains have slow log publishing enabled for both search and indexing operations to CloudWatch Logs (SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS).

Amazon OpenSearch Service domains are evaluated for encryption at rest using AWS KMS (AES-256) across stored data, including indexes, swap files, and automated snapshots.

Amazon OpenSearch domains are assessed for fault tolerance: >= 3 data nodes (instance_count >= 3) and Zone Awareness (zone_awareness_enabled = true) to distribute data across Availability Zones.

Amazon OpenSearch domains have dedicated master nodes enabled with a master node count of at least 3 to support stable cluster coordination and elections

Amazon OpenSearch Service domains with HTTPS enforcement require encrypted connections. This assessment identifies domains missing Require HTTPS for all traffic, indicating that unencrypted HTTP is accepted.

Amazon OpenSearch Service domains are evaluated for the internal user database setting (InternalUserDatabaseEnabled). The finding identifies domains that rely on built-in HTTP basic users instead of external identity providers.

Amazon OpenSearch domains with node-to-node encryption use TLS to protect traffic between cluster nodes. The finding evaluates the domain's node_to_node_encryption configuration for intra-cluster communications.