Checks

AWS Directory Service directories are associated with Amazon SNS topics to send status change notifications (e.g., Active Impaired).

The evaluation looks for directories that have SNS event topics configured for monitoring alerts.

AWS Directory Service directories with manual snapshot capacity fully consumed or nearly exhausted, based on current snapshot count relative to the directory's maximum allowed.

AWS Directory Service Secure LDAP (LDAPS) certificates are assessed for upcoming expiration by comparing each directory's certificate expiration to the current time and identifying those with <= 90 days remaining.

AWS Directory Service RADIUS configuration uses the authentication protocol defined for MFA integration. The finding evaluates whether directories with RADIUS enabled are set to MS-CHAPv2 instead of weaker options like PAP, CHAP, or MS-CHAPv1.

AWS Directory Service directories are evaluated for RADIUS-backed multi-factor authentication, confirming that MFA is configured and the RADIUS integration is active.

EBS snapshots are expected to be governed by Data Lifecycle Manager (DLM) policies in each Region where snapshots exist.

The evaluation looks for lifecycle policies that automate snapshot creation, retention, and cleanup for those snapshots.

AWS DMS MongoDB endpoints use an authentication mechanism. Configuration expects AuthType not no (e.g., password) with an authMechanism such as scram_sha_1 or mongodb_cr.

DMS Neptune endpoints have IAM authorization enabled via the endpoint setting IamAuthEnabled.

DMS Redis OSS endpoints are assessed for the presence of TLS in their endpoint settings, such as ssl-encryption, indicating encrypted connections between the DMS replication instance and Redis.

AWS DMS endpoints have their SSL/TLS mode inspected; any value other than none denotes encrypted connections between the replication instance and databases.

Supported modes include require, verify-ca, and verify-full.

AWS DMS replication instances are evaluated for the auto_minor_version_upgrade setting to confirm automatic minor engine updates are enabled during the maintenance window.

AWS DMS replication instances are evaluated for Multi-AZ configuration. Instances with multi_az enabled are treated as having a cross-AZ standby; those without it are identified as single-AZ.

AWS DMS replication instances are evaluated for public exposure. Exposure is identified when PubliclyAccessible is enabled and an attached security group allows inbound traffic from any address. Private or allowlisted instances are not considered exposed.

AWS DMS replication tasks have logging enabled and configure SOURCE_CAPTURE and SOURCE_UNLOAD with severity at least LOGGER_SEVERITY_DEFAULT (or higher: LOGGER_SEVERITY_DEBUG, LOGGER_SEVERITY_DETAILED_DEBUG).

AWS DMS replication tasks have target logging enabled, including TARGET_APPLY and TARGET_LOAD, each set to at least LOGGER_SEVERITY_DEFAULT.

Amazon DocumentDB clusters are evaluated for automated backups and an adequate backup retention period. Clusters should have backup_retention_period set to at least the configured minimum (default 7 days). Values of 0 indicate backups are disabled; values below the threshold are considered insufficient.

Amazon DocumentDB clusters are evaluated for exporting audit and profiler logs to CloudWatch Logs. Clusters missing one or both log types are identified as lacking complete log export configuration.

Amazon DocumentDB clusters are evaluated for the deletion_protection setting on the cluster configuration.

The finding highlights clusters where this protection is not enabled.

Amazon DocumentDB clusters with Multi-AZ (multi_az) indicate deployment of a primary and one or more replicas across Availability Zones.

Amazon DocumentDB manual cluster snapshot visibility is evaluated to detect snapshots marked as public instead of limited to specified AWS accounts.

Amazon DocumentDB clusters are assessed for storage encryption at rest via the cluster's encrypted setting.

It identifies clusters where data volumes, automated backups, and snapshots aren't protected by AWS KMS-managed encryption.

AWS Elastic Disaster Recovery is assessed per Region to verify the service is initialized and that at least one recovery or drill job exists, demonstrating that failover has been exercised.

Amazon DynamoDB Accelerator (DAX) clusters are evaluated for server-side encryption at rest. The finding indicates whether the cluster's on-disk cache, configuration, and logs are encrypted using service-managed keys.

DAX clusters have endpoint encryption set to TLS, enforcing encryption in transit for client connections to the cluster