Checks

AWS WAF Classic global rule groups are assessed for the presence of one or more rules. Empty groups are identified even when referenced by a web ACL, meaning the group adds no match logic.

AWS WAF Classic global rules contain at least one condition that matches HTTP(S) requests the rule evaluates for action (e.g., allow, block, count).

AWS WAF Classic global Web ACLs have logging enabled to capture evaluated web requests and rule actions for each ACL

AWS WAF Classic global web ACLs are evaluated for the presence of at least one rule or rule group that inspects HTTP(S) requests

AWS WAF Classic Regional rule groups are evaluated to confirm they contain at least one rule. Groups with no rule entries are considered empty.

AWS WAF Classic Regional rules have one or more conditions (predicates) attached (IP, byte/regex, geo, size, SQLi/XSS) to define which requests the rule evaluates

AWS WAF Classic Regional Web ACLs are evaluated for logging enabled to capture evaluated web requests and rule actions. Regional Web ACLs protect Application Load Balancers and API Gateway stages.

AWS WAF Classic Regional web ACL contains at least one rule or rule group to inspect and act on HTTP(S) requests. An ACL with no entries is considered empty.

AWS WAFv2 Web ACLs with logging capture details of inspected requests and rule evaluations. The assessment determines for each Web ACL whether logging is configured to record traffic analyzed by that ACL.

AWS WAFv2 Web ACLs are assessed to confirm that every associated rule and rule group has CloudWatch metrics enabled for visibility into rule evaluations and traffic

AWS WAFv2 web ACLs are evaluated for the presence of at least one configured rule or rule group that defines how HTTP(S) requests are inspected and acted upon.

AWS Well-Architected workloads are assessed for the presence and count of risks labeled HIGH or MEDIUM across the framework pillars. The result indicates whether any such risks remain recorded for the workload.

Amazon WorkSpaces evaluates encryption at rest on each workspace's EBS volumes. It checks whether the root and user volumes are encrypted with a KMS key and identifies workspaces where either volume is unencrypted.

Amazon WorkSpaces reside in a VPC that includes 2 private subnets and 1 public subnet, with the WorkSpace launched in a private subnet and the VPC providing NAT Gateway egress.

Cloudflare zones are assessed for Always Online configuration by checking if it is disabled to prevent serving stale cached content when the origin server is unavailable, which could expose outdated or sensitive information.

Cloudflare zones are assessed for Automatic HTTPS Rewrites configuration by checking if it is enabled to automatically rewrite insecure HTTP links to HTTPS, resolving mixed content issues and enhancing site security.

Cloudflare zones are assessed for Bot Fight Mode configuration by checking if it is enabled to detect and mitigate automated bot traffic targeting the zone through browser integrity checks.

Cloudflare zones are assessed for Browser Integrity Check configuration by verifying that HTTP headers are analyzed to identify requests from bots or clients with missing/invalid browser signatures.

Cloudflare zones are assessed for Challenge Passage (challenge TTL) configuration by checking if it is set between 15 minutes and 45 minutes to balance security with user experience.

Cloudflare zones are assessed for Development Mode configuration by checking if it is disabled to ensure caching, security features, and performance optimizations are active in production environments.

Cloudflare zones are assessed for DNSSEC configuration by checking if it is enabled to cryptographically sign DNS responses and protect against DNS spoofing and cache poisoning attacks.

Cloudflare zones are assessed for Email Obfuscation (Scrape Shield) configuration by checking if it is enabled to protect email addresses on the website from automated harvesting by bots and spammers.

Cloudflare zones are assessed for firewall blocking rules by checking if custom rules use block, challenge, js_challenge, or managed_challenge actions to actively protect against threats rather than only logging.

Cloudflare zones are assessed for Hotlink Protection (Scrape Shield) configuration by checking if it is enabled to prevent other websites from directly linking to images and media, consuming bandwidth without authorization.