Checks

Amazon OpenSearch domains are assessed for public exposure via their resource-based access policies. Domains inside a VPC are treated as privately reachable; domains with overly permissive policies that allow broad, unauthenticated access are identified as publicly accessible.

OpenSearch Service domains are assessed for pending service software updates. This focuses on internal platform updates, distinct from engine version upgrades.

OpenSearch Service domains use Amazon Cognito or SAML to authenticate access to Kibana/OpenSearch Dashboards.

The evaluation identifies domains where either provider is enabled for Dashboards access.

Assigning a password to the compute instance using plaintext could lead to compromise; it would be preferable to use key-pairs as a login mechanism

Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

Security groups should include a description for auditing purposes. Simplifies auditing, debugging, and managing security groups.

GitHub Actions organization settings define whether workflows are allowed to create and approve pull requests.

The evaluation determines whether that permission is disabled, so that approving a pull request always requires a human reviewer.

GitHub organization base repository permission for members uses a strict setting such as read or none rather than permissive options like write or admin. Applies to members, not outside collaborators.

GitHub Actions organization settings define the default GITHUB_TOKEN permissions granted to every workflow run.

The evaluation determines whether the organization default is read-only, so that workflows have to opt in to write access through an explicit permissions block.

GitHub organization settings require all members to use two-factor authentication (2FA).

The evaluation determines whether access to organization resources is conditioned on members having 2FA enabled.

GitHub organization repository creation is restricted so that only trusted owners or specific teams can create new repositories within the organization.

Ensure repository deletion/transfer is restricted so only trusted organization users (owners) can delete or transfer repositories.

AWS account membership in AWS Organizations with organization status ACTIVE.

Assesses if the account is associated with an organization and that the organization state is ACTIVE.

MongoDB Atlas organizations can require Atlas Administration API requests to originate only from IPs or CIDRs listed in the organization's API access list (apiAccessListRequired).

AWS Organizations delegated administrators are compared against a predefined trusted list to identify delegations that are not explicitly approved. The evaluation also notes when no delegated administrators exist.

MongoDB Atlas organization mandates multi-factor authentication for all members before accessing organization resources (multi_factor_auth_required).

AWS Organizations is assessed for an AI services opt-out policy that sets services.default.opt_out_policy to optOut and blocks child overrides via @@operators_allowed_for_child_policies set to @@none.

AWS Organizations SCPs limit account actions to approved regions using conditions on aws:RequestedRegion.

This evaluates whether policies exist and fully restrict access to the configured allowlist, rather than only some regions.

MongoDB Atlas organizations specify a designated security contact email to receive security notifications and advisories.

Assesses whether this contact is configured at the organization level.

MongoDB Atlas organization setting maxServiceAccountSecretValidityInHours caps the lifetime of new Admin API service account secrets. Evaluation focuses on whether a limit is configured and whether it is at or below the defined policy threshold (default 8 hours).

AWS Organizations tag policies are evaluated for their presence and attachment to organization targets (accounts or OUs), distinguishing between no policies, policies defined but not attached, and policies attached to at least one target.

GitHub organization has a verified badge.