Checks

Amazon DynamoDB Accelerator (DAX) cluster node placement across Availability Zones is evaluated. Clusters with nodes in more than one AZ within the Region are recognized as multi-AZ; clusters whose nodes reside in a single AZ are recognized as single-AZ.

DynamoDB tables use automatic capacity scaling via on-demand mode or PROVISIONED mode with auto scaling enabled for both read and write capacity units.

Provisioned tables are evaluated for scaling on both dimensions.

DynamoDB tables are evaluated for resource-based policies that permit cross-account or public principals.

Tables without a resource policy, or with policies restricted to the same account, are identified as isolated configurations.

DynamoDB tables have deletion protection enabled via the deletion protection setting, meaning delete operations require this setting to be disabled first

DynamoDB tables are evaluated for inclusion in an AWS Backup backup plan through resource assignments, including explicit tables, resource-type wildcards, or all-resources coverage.

The result indicates whether a table is governed by scheduled backups and retention defined by the plan.

DynamoDB tables use AWS KMS keys (KMS) for encryption at rest instead of the default service-owned key

DynamoDB tables have Point-in-Time Recovery (PITR) enabled

AMI block public access configuration is assessed to see whether public sharing of AMIs is blocked in the account and Region. When enabled (block-new-sharing), no AMI in the Region can be made public regardless of individual image permissions.

EC2 AMIs owned by the account are evaluated for public visibility via their launch permissions. Images shared with all accounts (Group=all) are treated as publicly accessible.

AWS Client VPN endpoints are evaluated for client connection logging that records client connect/disconnect events to CloudWatch Logs. The evaluation detects endpoints where this logging is disabled.

Instances hosting Nitro Enclave workloads (EnclaveOptions.Enabled=true) are evaluated for IMDSv2 enforcement on the metadata service (HttpTokens=required). This check assesses the host environment; it does not audit the enclave itself.

Nitro Enclave parent instances are evaluated against the EC2 lifecycle: the instance state must not be stopped, shutting-down, or terminated. Enclaves are destroyed when their parent stops, so any consumer depending on enclave availability breaks if the parent moves to a terminal state. Transient states (pending, stopping) are reported as PASS with a note.

Instances hosting Nitro Enclave workloads (EnclaveOptions.Enabled=true) are evaluated for direct internet reachability. The host must not carry a public IP and must not sit in a subnet whose route table sends 0.0.0.0/0 or ::/0 to an Internet Gateway. NAT Gateway routes are not flagged. This check assesses the host environment; it does not audit the enclave itself.

Hosts of Nitro Enclave workloads are evaluated for unrestricted ingress (0.0.0.0/0 or ::/0) on TCP/UDP ports outside a configurable allow-list (enclave_sg_allow_ports, default [22, 80, 443]). Aggregates ingress across every security group attached to the host. Assesses the host environment only.

Hosts of Nitro Enclave workloads are evaluated for unrestricted ingress on TCP ports commonly used by vsock-proxy applications (enclave_vsock_ports, default [5000, 8000-8090, 9000]). vsock is AF_VSOCK, but proxy applications bridge to TCP; this heuristic targets the bridge. Assesses the host environment only.

EBS uses encryption by default at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen KMS key

EBS snapshots with public sharing permissions (accessible by all AWS accounts) are identified, as opposed to snapshots shared privately with specific accounts.

EBS snapshots account/Region configuration for Block Public Access is assessed to see whether public sharing is fully blocked (block-all-sharing) versus only new sharing (block-new-sharing) or unblocked. The state indicates if any snapshot can be publicly shared.

EBS snapshots are evaluated for encryption at rest with AWS KMS. The finding identifies snapshots where encryption is not enabled.

EBS volumes are assessed for encryption at rest using AWS KMS.

The finding identifies volumes whose encrypted state is disabled, meaning data is stored unencrypted on block storage.

EBS volumes are evaluated for coverage by an AWS Backup plan, whether explicitly targeted or included via broad resource selection, confirming scheduled, policy-driven backups exist for the volume.

EBS volumes are evaluated for the existence of at least one associated snapshot, identifying volumes without any point-in-time backup available.

EC2 Elastic IPs are compared with Shodan's index to identify publicly reachable addresses that have been scanned and cataloged, including metadata such as open ports, ISP, and geolocation

EC2 Elastic IPs that are allocated but not associated with any instance or network interface. The evaluation identifies EIPs present in the account without an active association.