Checks

RBAC Roles and ClusterRoles granting read permissions to Kubernetes Secrets are identified. The evaluation looks for rules that allow get, list, or watch on secrets, either namespace-scoped or cluster-wide.

Cluster-wide RBAC identifies users or groups granted create on serviceaccounts/token via ClusterRoles/ClusterRoleBindings.

Highlights principals allowed to mint service account tokens through the TokenRequest subresource.

User or group RBAC assignments that grant privileges to create, update, or delete validatingwebhookconfigurations and mutatingwebhookconfigurations are identified.

Focus is on permissions that allow modifying admission webhook configuration objects.

Kubernetes RBAC Roles/ClusterRoles are evaluated for wildcard use in rule resources or verbs. The presence of * means all resources or all actions are granted. This finding highlights roles whose rules include such wildcards.

Ensure that Huawei Cloud Relational Database Service (RDS) instances have automatic backup enabled to protect against data loss.

Aurora MySQL DB clusters have Backtrack configured with a non-zero BacktrackWindow, retaining change records to allow rewinding to a consistent earlier time. Applies to aurora-mysql engines only.

RDS DB clusters are evaluated for the CopyTagsToSnapshot setting that propagates cluster tags to their DB snapshots.

Aurora tagging is configured at the cluster level; instance-level copying isn't supported.

RDS event subscriptions for the db-cluster source type are enabled and cover critical cluster event categories: maintenance and failure (or all cluster events).

RDS DB clusters are evaluated for use of a custom administrator username, flagging clusters that use defaults such as admin or postgres.

RDS DB clusters have deletion protection enabled (deletion_protection=true).

RDS DB clusters on supported engines (MySQL/MariaDB/PostgreSQL/Aurora) have IAM database authentication enabled for database logins, indicating token-based access managed by IAM instead of static passwords.

RDS clusters running Aurora MySQL, Aurora PostgreSQL, MySQL, or PostgreSQL are assessed for CloudWatch Logs publishing, confirming that database logs are exported to a CloudWatch Logs group.

RDS Multi-AZ DB clusters are configured for automatic minor engine upgrades via auto_minor_version_upgrade.

The evaluation checks these clusters to see if this setting is enabled so preferred minor releases are applied during the maintenance window.

RDS DB clusters are assessed for deployment across multiple Availability Zones (Multi-AZ), verifying that redundant instances exist to support automatic failover instead of a single-AZ configuration.

RDS DB clusters are assessed for use of a non-default database port.

Evaluation focuses on whether the cluster listens on the engine's well-known default port (e.g., 3306, 5432, 1433, 1521, 50000) or on a custom port.

RDS DB clusters are covered by an AWS Backup backup plan when resource assignments include the cluster, either explicitly, by tags, or via an appropriate resource scope.

RDS DB clusters are assessed for encryption at rest via AWS KMS. It determines whether cluster storage-and related artifacts like automated backups and snapshots-are encrypted with a KMS key.

RDS DB instances are evaluated for automated backups by confirming the backup retention period is greater than 0 days, indicating point-in-time recovery is configured.

RDS DB instances are evaluated for server certificate validity windows, including default and customer-managed certificates. Certificates expired or approaching expiration (e.g., <1 month, <3 months, 3-6 months, >6 months) are identified using the certificate valid_till date.

RDS DB instances are assessed for propagating instance tags to their DB snapshots using CopyTagsToSnapshot.

Aurora engines manage this at the cluster level and aren't evaluated per instance.

RDS event subscriptions for DB instances are assessed for coverage of the critical categories maintenance, configuration change, and failure.

The evaluation looks for enabled db-instance subscriptions and confirms these categories are included or that all events are selected.

RDS DB instances are evaluated for use of a custom administrator username. The finding identifies instances or clusters where the admin user matches common defaults like admin or postgres (checked at the instance or cluster level).

RDS DB instances are assessed for deletion protection. If an instance belongs to an Aurora cluster, the setting is evaluated at the cluster level; otherwise, it is evaluated on the instance itself.

RDS DB instances use a supported, non-deprecated engine version for MariaDB, MySQL, or PostgreSQL. The instance's engine and engine_version are evaluated against versions currently supported in the region.