Checks

Ensure that Huawei Cloud Relational Database Service (RDS) instances do not have public IP addresses to prevent direct internet access to databases.

RDS DB snapshots and DB cluster snapshots are evaluated for encryption at rest, identifying snapshots created with a KMS key versus unencrypted ones.

RDS DB snapshots and DB cluster snapshots with public visibility (shared with all AWS accounts) are detected.

Snapshots limited to specific accounts or kept private are identified as restricted.

Azure Recovery Services backup policies are evaluated for adequate daily retention. Policies with fewer than 30 days of retention may not provide sufficient recovery points for incident investigation, compliance requirements, or ransomware recovery scenarios.

Azure Recovery Services vaults are evaluated for backup protected items. A vault with no protected items indicates that no resources (VMs, databases, file shares) are configured for backup through this vault, potentially leaving critical workloads unprotected.

Amazon Redshift clusters are evaluated for database audit logging that exports connection, user, and user-activity events to Amazon S3 or CloudWatch.

Amazon Redshift clusters are evaluated for automated snapshots being enabled with a retention period > 0, confirming that periodic backups are created and retained.

Amazon Redshift clusters have automatic major engine upgrades allowed via AllowVersionUpgrade so updates are applied during the maintenance window.

Amazon Redshift clusters use encryption at rest. The evaluation inspects the cluster's encryption setting to determine if on-disk data and snapshots are protected with a managed key.

Amazon Redshift clusters are assessed for the EnhancedVpcRouting setting, which routes all COPY and UNLOAD traffic between the cluster and data repositories through the VPC, enabling use of VPC security controls and logging.

Amazon Redshift clusters enforce encryption in transit by requiring TLS for client connections when require_ssl is enabled.

This evaluation identifies clusters where connections are not forced to use TLS.

Amazon Redshift clusters are evaluated for Multi-AZ deployment on provisioned RA3 clusters, confirming compute spans two Availability Zones and is served via a single endpoint.

Amazon Redshift clusters are identified when the database name equals the default dev, rather than a custom name.

Amazon Redshift clusters are assessed for use of a non-default admin username; clusters using the known default awsuser are identified.

Amazon Redshift clusters with publicly accessible endpoints in public subnets and security groups allowing TCP from 0.0.0.0/0 or ::/0 are identified as internet-exposed.

Public endpoints without internet reachability due to private subnets or restrictive rules are recognized separately.

GitHub repository setting that enables automatic deletion of head branches when pull requests merge into the default branch (delete_branch_on_merge).

GitHub repository default branch have branch protections or rulesets with Allow deletions disabled.

GitHub repository default branch blocks force pushes through branch protection.

Evaluates whether the default branch permits force pushes. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch ensures that when new commits are pushed to an open pull request, any previously granted approvals are automatically dismissed, requiring fresh reviews before the pull request can be merged.

GitHub repository default branch applies branch protection rules to administrators via enforce_admins, holding admin pushes to the same requirements as other contributors (reviews, status checks, and push restrictions). This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch has branch protection rules enabled to restrict direct changes and require reviewed, validated merges. The evaluation determines whether the default branch enforces such rules. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch requires Code Owners approval for pull requests that modify paths declared in CODEOWNERS. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch uses branch protection to require conversation resolution on pull requests (Require conversation resolution before merging). This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch enforces Require linear history, blocking merge commits and allowing only squash or rebase merges. This protection can be enforced through classic branch protection or repository rulesets.