Checks

The Suspicious programmatic login system-defined alert rule should be enabled with alerts sent to the alert center, email notifications turned on, recipients set to all super administrators, and severity set to Low or higher. This ensures administrators are notified when Google detects suspicious login attempts from applications or programs.

Amazon S3 access points have Block Public Access configured with all settings enabled: block_public_acls, ignore_public_acls, block_public_policy, and restrict_public_buckets.

The evaluation inspects each access point's public access block configuration.

Amazon S3 account-level Block Public Access is assessed for ignore_public_acls and restrict_public_buckets to confirm centralized blocking of ACL-based public access and limiting buckets with public policies to in-account principals.

Amazon S3 buckets are evaluated for Object Ownership set to BucketOwnerEnforced, which disables bucket and object ACLs. Buckets using any other ownership setting indicate that ACLs remain enabled.

Amazon S3 bucket policies are analyzed for statements that grant cross-account access.

Any policy that names principals outside the owning account (other account IDs or Principal: "*") is treated as cross-account; absence of a policy implies no cross-account grants.

Amazon S3 buckets use cross-Region replication with versioning and an enabled rule that targets a destination bucket in a different AWS Region.

Buckets with same-Region targets, missing destinations, or disabled versioning don't meet this replication posture.

[DEPRECATED] Amazon S3 buckets have a default server-side encryption setting that automatically encrypts new objects using SSE-S3 or SSE-KMS. This evaluates whether a bucket has a default encryption configuration defined.

Amazon S3 buckets define a notification configuration that publishes bucket events (for example s3:ObjectCreated:*, s3:ObjectRemoved:*) to a destination. The evaluation identifies buckets that lack any notification setup.

Amazon S3 buckets use server-side encryption with AWS KMS keys, including dual-layer aws:kms:dsse. The evaluation identifies buckets whose default encryption is aws:kms or aws:kms:dsse rather than SSE-S3.

Amazon S3 buckets are evaluated for Block Public Access settings, ensuring ignore_public_acls and restrict_public_buckets are enabled at the bucket or account scope.

Account-wide protections, when present, are treated as effective for the bucket.

Amazon S3 buckets use Lifecycle configurations with at least one rule Status: Enabled to automate object Transitions and Expiration based on age, prefix, or tags

Amazon S3 buckets are assessed for MFA Delete status. MFA Delete requires a second factor to permanently delete object versions or change Versioning configuration. The finding highlights buckets where this protection is not enabled.

Amazon S3 buckets have Object Lock enabled at the bucket level, applying WORM controls to object versions

Spot-checks a configurable sample of objects in each S3 bucket and flags any whose ACL grants access to the AllUsers or AuthenticatedUsers groups. This is a sampling-based check, not a comprehensive audit, so public objects outside the sample can be missed. It is disabled by default and must be enabled via the s3_bucket_object_public_enabled configuration flag.

Amazon S3 buckets are evaluated for object versioning being Enabled, which maintains multiple versions of the same object key for historical state retention

Amazon S3 bucket policies are evaluated for public write permissions (e.g., s3:PutObject, s3:Delete*, or s3:*). Account or bucket Public Access Block that restricts public buckets is considered when determining exposure.

Amazon S3 buckets are evaluated for public access via ACLs and bucket policies. The check identifies account or bucket PublicAccessBlock protections (IgnorePublicAcls, RestrictPublicBuckets) and flags buckets granting group access to AllUsers or AuthenticatedUsers, or with a public bucket policy.

Amazon S3 buckets are evaluated for public listing via ACLs. Grants of READ, READ_ACP, or FULL_CONTROL to the AllUsers or AuthenticatedUsers groups are identified. Effective Block Public Access at account or bucket level (notably IgnorePublicAcls and RestrictPublicBuckets) is considered in the evaluation.

Amazon S3 buckets are assessed for ACL grants that allow public write access to AllUsers or AuthenticatedUsers via WRITE, WRITE_ACP, or FULL_CONTROL. Effective Block Public Access at account or bucket level (ignore_public_acls, restrict_public_buckets) is considered.

Amazon S3 buckets are evaluated for a bucket policy that enforces secure transport by denying requests when aws:SecureTransport is false.

Buckets without this explicit denial, or without a policy, are treated as allowing access over insecure transport.

Amazon S3 buckets are evaluated for server access logging configured to record access requests and deliver logs to a designated destination bucket.

Amazon S3 buckets using predictable service naming (e.g., aws-glue-assets-<account>-<region>, sagemaker-<region>-<account>) are identified and their ownership checked.

Buckets tied to your account that match these patterns but are owned by another account-across regions-are surfaced as shadow-resource candidates.

Amazon S3 Multi-Region Access Points are evaluated for Block Public Access being fully enabled (block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets).

Focus is on the MRAP's own settings, separate from bucket or account configurations.

SageMaker Clarify provides bias detection and model explainability for ML workloads.

This check verifies that at least one SageMaker processing job using the AWS-managed Clarify container image exists in each successfully scanned region. The absence of Clarify jobs indicates that responsible-AI controls such as bias detection and explainability are not in place.