Checks

Security groups should not allow unrestricted access to all ports from the public internet (0.0.0.0/0 or ::/0). This includes rules with no port range specified or rules covering the full port range (0-65535 or 1-65535). Allowing all ports exposes every service running on the instances to potential attacks.

Security groups should not allow unrestricted access to database ports from the public internet (0.0.0.0/0 or ::/0). This includes MySQL (3306), PostgreSQL (5432), MongoDB (27017), Redis (6379), SQL Server (1433), and CouchDB (5984). Unrestricted database access can lead to data breaches and unauthorized access.

Security groups should not allow unrestricted RDP access (port 3389) from the public internet (0.0.0.0/0 or ::/0). Unrestricted RDP access increases the attack surface and can lead to unauthorized access, brute force attacks, and potential system compromise.

Security groups should not allow unrestricted SSH access (port 22) from the public internet (0.0.0.0/0 or ::/0). Unrestricted SSH access increases the attack surface and can lead to unauthorized access, brute force attacks, and potential system compromise.

Servers should not have public IP addresses directly attached to their network interfaces unless strictly required. A public IP exposes the server to inbound traffic from the internet on all ports not blocked by a security group, increasing the attack surface.

ObjectStorage access keys should have an explicit expiration date. Long-lived credentials increase the blast radius of a credential compromise because they cannot expire on their own. Setting an expiration date enforces periodic rotation and limits the exposure window if a key is leaked.

S3 Object Lock prevents objects from being deleted or overwritten for a fixed period or indefinitely. Enabling it protects against accidental deletion and ransomware by enforcing a write-once-read-many (WORM) model. Object Lock can only be enabled when the bucket is created.

An ObjectStorage default retention policy automatically applies a minimum retention period to every object uploaded to the bucket, preventing deletion or overwriting before the period expires. Without it, objects can be removed immediately after upload, undermining compliance and data durability requirements.

The Kubernetes API server of an SKE cluster should not be reachable from the entire internet. Enable the ACL extension to restrict access to a known set of source CIDRs, or run the control plane inside a STACKIT Network Area (SNA) so that it is not published on the internet at all.