Assessment Documentation

Documentation for Project Assessments and Self Service Organisation Assessments

Documentation by Provider

AWS
AWS Cloud9
A-C9-1
Cloud9 Environments Found
CloudFront
AWS-CF-4
Cloudfront Distribution Accepting Insecure Requests
A-CF-6
CloudFront Distribution not Compressing Responses
AWS-CF-2
Cloudfront Distribution Not Using Geoblocking
AWS-CF-3
Cloudfront Distribution Not Using Web Application Firewall
AWS-CF-5
Cloudfront Distribution Set to Global Edges
AWS-CF-1
S3 Origin Not Using Access Identity
Cloudtrail
AWS-CT-1
Enable Cloudtrail
AWS Cognito
A-COG-1
Cognito User Pools Should Have Delete Protection
Elastic Compute Cloud (EC2)
AWS-EC2-6
Default VPC Available
A-EC2-19
Disparate Subnet Masks
A-EC2-15
DNS Resolution Unshared Across VPCs
AWS-EC2-8
EC2 Instances with Monitoring Disabled
AWS-EC2-7
EC2 Instances without an IAM Profile
AWS-EC2-3
Instance Not Exclusively Using IMDSv2
AWS-EC2-1
Instance With Public IP Address
AWS-EC2-2
Instances in Public Subnets
A-EC2-18
Instances Running Outside VPC
AWS-EC2-4
Instances using SSH Keys
AWS-EC2-13
No VPC Flow Logs
AWS-EC2-9
Open Security Groups
A-EC2-14
Public AMIs Found
AWS-EC2-11
Public EBS Snapshots
AWS-EC2-5
SSH Keys found in Account
A-EC2-17
Subnets attached to Route Tables with Multiple External Routes
A-EC2-16
Subnets have Implicit Routing
AWS-EC2-12
Unencrypted EBS Snapshots
AWS-EC2-10
Unused Elastic IP Addresses
A-EC2-21
VPC Peering Connections Found
A-EC2-25
VPC Using Conflicting AWS CIDR Range
A-EC2-24
VPCs Using Default AWS Range
A-EC2-22
VPCs Using Non-Private Address Space
A-EC2-23
VPCs with Multiple NATs
A-EC2-20
VPCs without Private Zones
Elastic File System
A-EFS-2
EFS Allows Insecure Connections
A-EFS-1
EFS Mounted Without Encryption at Rest
Elastic Kubernetes Service
AWS-EKS-2
EKS Cluster out of Date
A-EKS-3
EKS Clusters Using Small Subnets
AWS-EKS-1
EKS Control Plane Publicly Accessible
Elastic Load Balancing
A-ELB-2
Load Balancer Ignores MTLS Client Certificate Expiry
A-ELB-1
Load Balancers Accepting Unencrypted HTTP
Identity & Access Management
A-IAM-18
Account Root User Has Access Keys Issued
A-IAM-19
Account Root User Has Signing Certificates
A-IAM-15
AWS Account Approaching Access Key Limit
A-IAM-16
AWS Root User Does Not Have MFA
A-IAM-10
IAM User Access Keys Unused
A-IAM-14
IAM User Approaching User Access Key Limit
A-IAM-11
IAM User Has Inactive Access Keys
A-IAM-13
IAM User has Multiple Access Keys
A-IAM-9
IAM User Inactive
A-IAM-17
IAM User Without MFA
A-IAM-2
IAM Users Password Policy Allows 8-15 Characters with Limited Characters
A-IAM-6
IAM Users Password Policy Does Not Allow Users to Change Passwords
A-IAM-4
IAM Users Password Policy Expires Passwords
A-IAM-8
IAM Users Password Policy Forces a Hard Password Expiry
A-IAM-5
IAM Users Password Policy Not Set
A-IAM-7
IAM Users Password Policy Remembers Less Than 3 Previous Passwords
A-IAM-1
IAM Users Password Policy Requires at Least 8 Characters
A-IAM-3
IAM Users Password Policy Requires Special Characters
AWS Lambda Service
A-LAM-1
Lambda Functions in Problem State
A-LAM-3
Lambda Functions Running Depreciated Runtimes
A-LAM-2
Lambda Functions with Update Problems
A-LAM-4
Lambda Functions Without Logs
Route53
A-R53-10
DKIM Records with Small Key Size
A-R53-8
Domains Due to Expire Within 90 Days
A-R53-11
Domains Missing Transfer Lock
A-R53-9
Domains with Lax DMARC Policies
A-R53-6
Domains Without DMARC Declaration
A-R53-3
Found MX records without corresponding SPF Record
A-R53-7
Hosted Zones with Default Registrar Comment
A-R53-15
ICANN Domain Status has Domain Deletion Prohibited
A-R53-16
ICANN Domain Status has Domain on Hold
A-R53-17
ICANN Domain Status has Server Renew Prohibited
A-R53-12
ICANN Domain Status is Inactive
A-R53-14
ICANN Domain Status is Indicating a Transfer
A-R53-13
ICANN Domain Status is Pending Deletion
A-R53-2
MX Records with Multiple Corresponding SPF Records
A-R53-5
MX Records Without Corresponding DKIM Record
A-R53-1
Private Zones using local TLD
A-R53-4
SPF Record Does Not Start with SPF Statement
Relational Database Service
A-RDS-2
Found Public RDS Snapshots
A-RDS-1
Found Unencrypted RDS Snapshots
Simple Storage Service (S3)
A-S3-6
S3 Bucket Allows Insecure Uploads
A-S3-1
S3 Bucket Does Not Enforce Ownership Controls
A-S3-2
S3 Bucket Does Not Include the Account ID
A-S3-7
S3 Bucket Does Not Totally Block Public Access
A-S3-4
S3 Bucket Has an Invalid Policy
A-S3-5
S3 Bucket Has No Policy
A-S3-9
S3 Bucket Has No Public Access Protections
A-S3-3
S3 Bucket Has Website Endpoint Enabled
A-S3-8
S3 Bucket Policy Allows Public Access