Checks

Azure virtual machines use managed disks for the OS disk and every data disk, rather than page blob VHDs in storage accounts.

The evaluation confirms that all attached VM disks are managed.

Azure virtual machines are associated with a Just-in-Time (JIT) network access policy that opens management ports only for approved, time-bound requests from specified source IPs.

Azure Linux virtual machines are assessed for SSH configuration where disablePasswordAuthentication is set to true, allowing only public key authentication and disallowing interactive passwords.

Azure VM scale sets are associated with at least one load balancer backend pool.

The evaluation looks for a backend pool link on each scale set's network configuration.

Azure VM scale sets with 0 VM instances are identified as empty.

Azure virtual machines are evaluated for a backup policy in a Recovery Services vault with a daily retention period that meets the configured minimum. VMs lacking protection or using a shorter retention window are identified for review.

Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled.

Identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.

Ensure that default security groups restrict all traffic to prevent unauthorized access to cloud resources.

Non-default VPCs are evaluated across the account to determine whether they exist in more than one region. The result reflects if your custom network topology is regionally distributed or concentrated in a single region.

VPC endpoint policies are assessed for restriction to configured trusted AWS accounts. If Principal values (including *) or account ARNs permit non-trusted principals, or conditions aren't sufficiently restrictive, the endpoint is identified. Endpoints without editable policies are excluded.

Amazon VPCs are evaluated for an interface VPC endpoint to the Amazon EC2 API (ec2). Its presence indicates private EC2 API connectivity over AWS PrivateLink within the VPC.

VPC interface endpoints are evaluated for whether their endpoint network interfaces are placed in multiple subnets, which implies distribution across different Availability Zones. Endpoints present in only one subnet are identified.

VPC endpoint services are assessed for their allowed principals, comparing each to a configured set of trusted accounts and identifying any untrusted principals or a wildcard * present in the allowlist.

Alibaba Cloud VPC Flow Logs capture IP traffic information for Elastic Network Interfaces, VSwitches, or entire VPCs. When a flow log is created for a VPC, all ENIs within it, including newly created ones, are automatically monitored. Flow log data is stored in Log Service where it can be viewed and analyzed for security and operational purposes.

AWS VPCs have Flow Logs configured to capture IP traffic for their network interfaces and deliver records to a logging destination.

VPCs lacking an active flow log configuration are highlighted.

AWS VPC peering route tables are assessed for least-privilege routing. Routes that target 0.0.0.0/0 or an entire peer VPC CIDR are considered overly broad; only specific subnets or narrower prefixes should be advertised across the peering link.

Ensure that Virtual Private Cloud (VPC) security groups do not have ingress rules that allow all protocols from 0.0.0.0/0 (i.e., rules with no port range specified).

Security groups should not allow unrestricted egress to all destinations. Huawei Cloud represents unrestricted destinations as 0.0.0.0/0, ::/0, or an empty remote IP prefix without a remote security group or address group. Open egress allows instances to reach any destination on the internet, increasing the risk of data exfiltration and command-and-control communication.

Security groups should not allow ingress from 0.0.0.0/0 on sensitive ports such as SSH (22), RDP (3389), MySQL (3306), Redis (6379), and MongoDB (27017). Open ingress on these ports exposes critical services to the internet and significantly increases the attack surface.

VPCs are assessed for subnets spread across multiple Availability Zones. The finding distinguishes VPCs with subnets confined to a single AZ or with no subnets from those with subnets in 2+ distinct AZs.

VPC subnets where MapPublicIpOnLaunch is true automatically assign a public IPv4 address to instances at launch.

This identifies subnets configured for default public IP assignment.

Amazon VPCs are assessed for network segmentation: at least one public subnet (internet-routable) and one private subnet (non-internet-routable).

It flags VPCs with no subnets, only public subnets, or only private subnets.

AWS Site-to-Site VPN connections have two IPsec tunnels. This evaluates tunnel status and detects when any tunnel is not UP, indicating whether both tunnels are concurrently available for high availability.

Ensure that Web Application Firewall (WAF) is enabled to protect web applications from common exploits.