Checks

Alibaba Cloud SLS should have an alarm configured for Cloud Firewall rule changes. By directing ActionTrail logs to SLS with alert rules, real-time monitoring of firewall modifications is achieved. This ensures creation, update, or deletion of Cloud Firewall control policies is promptly detected and reviewed.

Alibaba Cloud SLS should have an alarm configured for customer-created KMS CMKs that are disabled or scheduled for deletion. By directing ActionTrail logs to SLS with alert rules, disabling or deletion of encryption keys is promptly detected, preventing accidental or malicious loss of access to encrypted data.

Alibaba Cloud Simple Log Service (SLS) Logstore data retention should be configured for at least 365 days. The Logstore retention period controls how long activity logs are stored and available for analysis. Ensuring a minimum retention of 365 days provides sufficient time to investigate security incidents, perform forensic analysis, and meet regulatory compliance requirements.

Alibaba Cloud SLS should have an alarm configured for failed console authentication attempts. By directing ActionTrail logs to SLS with alert rules, repeated login failures are detected promptly, enabling early identification of brute-force or credential stuffing attacks against the Management Console.

Alibaba Cloud SLS should have an alarm configured for console logins not protected by MFA. By directing ActionTrail logs to SLS with alert rules, single-factor console sign-in events are detected, helping identify accounts that bypass MFA enforcement policies.

Alibaba Cloud SLS should have an alarm configured for OSS bucket policy changes. By directing ActionTrail logs to SLS with alert rules, modifications to bucket access policies are detected promptly, enabling quick identification of dangerous permission changes on sensitive storage resources.

Alibaba Cloud SLS should have an alarm configured for OSS Bucket RAM permission changes. By directing ActionTrail logs to SLS with alert rules, OSS permission modifications are monitored in real time. This ensures changes to bucket access controls and RAM policies affecting OSS are promptly detected.

Alibaba Cloud SLS should have an alarm configured for RAM Role creation, deletion, and update activities. By directing ActionTrail logs to SLS with alert rules, role changes are monitored in real time. This ensures RAM role modifications are detected promptly, enabling early identification of unauthorized privilege escalation.

Alibaba Cloud SLS should have an alarm configured for RDS Instance configuration changes. By directing ActionTrail logs to SLS with alert rules, database configuration modifications are monitored in real time. This ensures changes to security parameters, network settings, or access controls are promptly detected.

Alibaba Cloud SLS should have an alarm configured for root account login attempts. By directing ActionTrail logs to SLS with alert rules, usage of the fully privileged root account is detected promptly, supporting least privilege and enabling timely review of root-level operations.

Alibaba Cloud SLS should have an alarm configured for Security Group changes. By directing ActionTrail logs to SLS with alert rules, real-time monitoring is achieved. Security Groups are stateful packet filters controlling VPC ingress and egress traffic; monitoring their changes ensures network access modifications are promptly detected.

Alibaba Cloud SLS should have an alarm configured for unauthorized API calls. By directing ActionTrail logs to SLS with alert rules, API calls resulting in unauthorized errors are detected promptly, helping identify misconfigured applications, compromised credentials, or active attacker reconnaissance.

Alibaba Cloud SLS should have an alarm configured for VPC changes. By directing ActionTrail logs to SLS with alert rules, VPC modifications are monitored in real time. This ensures creation, deletion, or modification of VPCs and associated components is promptly detected.

Alibaba Cloud SLS should have an alarm configured for VPC network route changes. By directing ActionTrail logs to SLS with alert rules, route table modifications are monitored in real time. This ensures creation, deletion, or modification of route entries is detected, verifying VPC traffic flows through expected paths.

Ensure that SMN notification topics have at least one confirmed subscription so alerts can be delivered to recipients.

Amazon SNS subscriptions are evaluated for endpoint protocol. Subscriptions using http are identified, while HTTPS endpoints indicate encrypted delivery in transit.

Amazon SNS topics are assessed for server-side encryption with AWS KMS. Topics lacking a configured KMS key (e.g., missing kms_master_key_id) are identified as unencrypted at rest.

SNS topic policies are analyzed for public principals (e.g., *). Topics that grant access without restrictive conditions such as aws:SourceArn, aws:SourceAccount, aws:PrincipalOrgID, or sns:Endpoint scoping are treated as publicly accessible.

Azure SQL Server auditing is assessed at the server level to confirm audit logging is active. Configurations with any auditing policy state set to Disabled indicate auditing is not configured for the server and its databases.

Azure SQL Server auditing settings are evaluated to ensure auditing is enabled and log retention is greater than 90 days. It considers the auditing policy state and the configured retention_days value.

Azure SQL Server is configured with a Microsoft Entra (Azure AD) administrator at the server scope, indicated by administrator_type set to ActiveDirectory.

Azure SQL Server instances are evaluated for the server-level security alert policy of Microsoft Defender for SQL, expecting the policy state to be Enabled.

Azure SQL logical servers are assessed for the configured minimum TLS version for client connections. The finding determines whether the minimal accepted version aligns with recommended modern values such as 1.2 or 1.3.

Azure SQL Server uses Transparent Data Encryption with a customer-managed key in Azure Key Vault, and each database has TDE Enabled