Checks

Azure SQL user databases have Transparent Data Encryption (TDE) enabled, ensuring encryption of database files, backups, and transaction logs at rest.

The master system database is excluded from evaluation.

Azure SQL Server server-level firewall rules are evaluated for an entry that allows the entire IPv4 space (0.0.0.0 to 255.255.255.255).

The finding identifies presence of this Internet-wide rule on the server firewall.

Azure SQL Server Vulnerability Assessment configuration, specifically whether recurring scans are set to email results to subscription admins/owners via Also send email notifications to admins and subscription owners.

Azure SQL servers are evaluated for Vulnerability Assessment configuration and whether periodic recurring scans are scheduled (e.g., weekly) for the server and its databases.

Servers with Vulnerability Assessment missing or scans not scheduled are identified.

Azure SQL Server vulnerability assessment uses recurring scans and emails results to designated recipients. This evaluates that VA is enabled and that Send scan reports to (or subscription admin notifications) is configured so scan reports are delivered.

Azure SQL Server has Vulnerability Assessment configured with a defined location to persist assessment reports and scan results

Amazon SQS queue policies are assessed for public access. The finding highlights queues with Allow statements using a wildcard Principal without restrictive conditions, compared to queues that only grant access to the owning account or explicitly trusted principals.

Amazon SQS queues are evaluated for server-side encryption configured with a KMS key (SSE-KMS) protecting message bodies at rest.

Queues without an associated KMS key are identified.

AWS Systems Manager documents are inspected for embedded secrets within their content. Patterns resembling passwords, access keys, tokens, or private keys in document steps are flagged when values appear hardcoded rather than referenced securely.

SSM documents are evaluated for public sharing (all) and for shares with AWS accounts outside a defined trusted list. Documents that remain private or are shared only with trusted accounts indicate restricted distribution.

Incident Manager uses a replication set and response plans. This evaluates whether a replication set exists and is ACTIVE, and that at least one response plan is configured for coordinated incident handling.

SSM-managed EC2 instances report patch compliance against defined baselines. This evaluates each managed node's compliance status from Patch Manager to determine whether required security updates are applied according to policy.

AWS Step Functions state machines store execution history and input/output data passed between workflow states. This check verifies that each state machine uses a customer-managed KMS key (CUSTOMER_MANAGED_KMS_KEY) for encryption at rest rather than the default AWS-owned key.

AWS Step Functions state machines are configured to emit execution logs to CloudWatch Logs via a defined loggingConfiguration with a level set above OFF.

AWS Step Functions state machines are inspected for hardcoded secrets (keys, tokens, passwords) embedded directly in the state machine definition (Amazon States Language JSON).

Such values indicate sensitive data is stored directly in task parameters instead of being sourced securely.

Azure Storage accounts are evaluated for whether Shared Key (account key) authorization is disabled, requiring identity-based access via Microsoft Entra ID and RBAC.

Azure Storage accounts with public network access disabled cannot be reached from public networks. Setting publicNetworkAccess to Disabled overrides the public access settings of individual containers and forces access through private endpoints or trusted services. This is independent from the 'Allow Blob Anonymous Access' setting.

Azure Storage accounts with blob anonymous (public) access disabled prevent containers or blobs from being set to a public access level. Setting allowBlobPublicAccess to false enforces no anonymous reads across the account. This is independent from the account's 'Public Network Access' setting, which is evaluated by storage_account_public_network_access_disabled.

Azure Storage accounts have blob versioning enabled (IsVersioningEnabled) to automatically retain previous versions of blobs created by updates or deletes

E2E Networks block volumes in the Available state should be attached to a node rather than left provisioned without an owner.

Azure Storage accounts are assessed for whether cross-tenant object replication is disallowed via AllowCrossTenantReplication=false, limiting replication policies to the same tenant.

Azure Storage accounts configure the default network access rule to Deny, so the public endpoint only accepts traffic from explicitly allowed virtual networks, IP ranges, or private endpoints

Azure Storage accounts with Default to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys

E2E Networks EFS shared file systems should have backups enabled so data can be recovered after failures or accidental changes.