Class ManagedRuleIdentifiers
Managed rules that are supported by AWS Config.
Inheritance
Namespace: Amazon.CDK.AWS.Config
Assembly: Amazon.CDK.AWS.Config.dll
Syntax (csharp)
public class ManagedRuleIdentifiers : DeputyBase
Syntax (vb)
Public Class ManagedRuleIdentifiers
Inherits DeputyBase
Remarks
See: https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
ExampleMetadata: infused
Examples
// https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html
// https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html
new ManagedRule(this, "AccessKeysRotated", new ManagedRuleProps {
Identifier = ManagedRuleIdentifiers.ACCESS_KEYS_ROTATED,
InputParameters = new Dictionary<string, object> {
{ "maxAccessKeyAge", 60 }
},
// default is 24 hours
MaximumExecutionFrequency = MaximumExecutionFrequency.TWELVE_HOURS
});
Synopsis
Constructors
ManagedRuleIdentifiers(ByRefValue) | Used by jsii to construct an instance of this class from a Javascript-owned object reference |
ManagedRuleIdentifiers(DeputyBase.DeputyProps) | Used by jsii to construct an instance of this class from DeputyProps |
Properties
ACCESS_KEYS_ROTATED | Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. |
ACCOUNT_PART_OF_ORGANIZATIONS | Checks whether AWS account is part of AWS Organizations. |
ACM_CERTIFICATE_EXPIRATION_CHECK | Checks whether ACM Certificates in your account are marked for expiration within the specified number of days. |
ALB_HTTP_DROP_INVALID_HEADER_ENABLED | Checks if rule evaluates Application Load Balancers (ALBs) to ensure they are configured to drop http headers. |
ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK | Checks whether HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancer. |
ALB_WAF_ENABLED | Checks if Web Application Firewall (WAF) is enabled on Application Load Balancers (ALBs). |
API_GW_CACHE_ENABLED_AND_ENCRYPTED | Checks that all methods in Amazon API Gateway stages have caching enabled and encrypted. |
API_GW_ENDPOINT_TYPE_CHECK | Checks that Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType. |
API_GW_EXECUTION_LOGGING_ENABLED | Checks that all methods in Amazon API Gateway stage has logging enabled. |
APPROVED_AMIS_BY_ID | Checks whether running instances are using specified AMIs. |
APPROVED_AMIS_BY_TAG | Checks whether running instances are using specified AMIs. |
AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED | Checks whether your Auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. |
CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED | Checks whether AWS CloudTrail trails are configured to send logs to Amazon CloudWatch Logs. |
CLOUD_TRAIL_ENABLED | Checks whether AWS CloudTrail is enabled in your AWS account. |
CLOUD_TRAIL_ENCRYPTION_ENABLED | Checks whether AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) customer master key (CMK) encryption. |
CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED | Checks whether AWS CloudTrail creates a signed digest file with logs. |
CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK | Checks whether an AWS CloudFormation stack's actual configuration differs, or has drifted, from it's expected configuration. |
CLOUDFORMATION_STACK_NOTIFICATION_CHECK | Checks whether your CloudFormation stacks are sending event notifications to an SNS topic. |
CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED | Checks if an Amazon CloudFront distribution is configured to return a specific object that is the default root object. |
CLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLED | Checks that Amazon CloudFront distribution with Amazon S3 Origin type has Origin Access Identity (OAI) configured. |
CLOUDFRONT_ORIGIN_FAILOVER_ENABLED | Checks whether an origin group is configured for the distribution of at least 2 origins in the origin group for Amazon CloudFront. |
CLOUDFRONT_SNI_ENABLED | Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests. |
CLOUDFRONT_VIEWER_POLICY_HTTPS | Checks whether your Amazon CloudFront distributions use HTTPS (directly or via a redirection). |
CLOUDTRAIL_MULTI_REGION_ENABLED | Checks that there is at least one multi-region AWS CloudTrail. |
CLOUDTRAIL_S3_DATAEVENTS_ENABLED | Checks whether at least one AWS CloudTrail trail is logging Amazon S3 data events for all S3 buckets. |
CLOUDTRAIL_SECURITY_TRAIL_ENABLED | Checks that there is at least one AWS CloudTrail trail defined with security best practices. |
CLOUDWATCH_ALARM_ACTION_CHECK | Checks whether CloudWatch alarms have at least one alarm action, one INSUFFICIENT_DATA action, or one OK action enabled. |
CLOUDWATCH_ALARM_RESOURCE_CHECK | Checks whether the specified resource type has a CloudWatch alarm for the specified metric. |
CLOUDWATCH_ALARM_SETTINGS_CHECK | Checks whether CloudWatch alarms with the given metric name have the specified settings. |
CLOUDWATCH_LOG_GROUP_ENCRYPTED | Checks whether a log group in Amazon CloudWatch Logs is encrypted with a AWS Key Management Service (KMS) managed Customer Master Keys (CMK). |
CMK_BACKING_KEY_ROTATION_ENABLED | Checks that key rotation is enabled for each key and matches to the key ID of the customer created customer master key (CMK). |
CODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECK | Checks whether the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. |
CODEBUILD_PROJECT_SOURCE_REPO_URL_CHECK | Checks whether the GitHub or Bitbucket source repository URL contains either personal access tokens or user name and password. |
CODEPIPELINE_DEPLOYMENT_COUNT_CHECK | Checks whether the first deployment stage of the AWS CodePipeline performs more than one deployment. |
CODEPIPELINE_REGION_FANOUT_CHECK | Checks whether each stage in the AWS CodePipeline deploys to more than N times the number of the regions the AWS CodePipeline has deployed in all the previous combined stages, where N is the region fanout number. |
CW_LOGGROUP_RETENTION_PERIOD_CHECK | Checks whether Amazon CloudWatch LogGroup retention period is set to specific number of days. |
DAX_ENCRYPTION_ENABLED | Checks that DynamoDB Accelerator (DAX) clusters are encrypted. |
DMS_REPLICATION_NOT_PUBLIC | Checks whether AWS Database Migration Service replication instances are public. |
DYNAMODB_AUTOSCALING_ENABLED | Checks whether Auto Scaling or On-Demand is enabled on your DynamoDB tables and/or global secondary indexes. |
DYNAMODB_IN_BACKUP_PLAN | Checks whether Amazon DynamoDB table is present in AWS Backup plans. |
DYNAMODB_PITR_ENABLED | Checks that point in time recovery (PITR) is enabled for Amazon DynamoDB tables. |
DYNAMODB_TABLE_ENCRYPTED_KMS | Checks whether Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS). |
DYNAMODB_TABLE_ENCRYPTION_ENABLED | Checks whether the Amazon DynamoDB tables are encrypted and checks their status. |
DYNAMODB_THROUGHPUT_LIMIT_CHECK | Checks whether provisioned DynamoDB throughput is approaching the maximum limit for your account. |
EBS_ENCRYPTED_VOLUMES | Checks whether the EBS volumes that are in an attached state are encrypted. |
EBS_IN_BACKUP_PLAN | Checks if Amazon Elastic Block Store (Amazon EBS) volumes are added in backup plans of AWS Backup. |
EBS_OPTIMIZED_INSTANCE | Checks whether EBS optimization is enabled for your EC2 instances that can be EBS-optimized. |
EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK | Checks whether Amazon Elastic Block Store snapshots are not publicly restorable. |
EC2_DESIRED_INSTANCE_TENANCY | Checks instances for specified tenancy. |
EC2_DESIRED_INSTANCE_TYPE | Checks whether your EC2 instances are of the specified instance types. |
EC2_EBS_ENCRYPTION_BY_DEFAULT | Check that Amazon Elastic Block Store (EBS) encryption is enabled by default. |
EC2_IMDSV2_CHECK | Checks whether your Amazon Elastic Compute Cloud (Amazon EC2) instance metadata version is configured with Instance Metadata Service Version 2 (IMDSv2). |
EC2_INSTANCE_DETAILED_MONITORING_ENABLED | Checks whether detailed monitoring is enabled for EC2 instances. |
EC2_INSTANCE_MANAGED_BY_SSM | Checks whether the Amazon EC2 instances in your account are managed by AWS Systems Manager. |
EC2_INSTANCE_NO_PUBLIC_IP | Checks whether Amazon Elastic Compute Cloud (Amazon EC2) instances have a public IP association. |
EC2_INSTANCE_PROFILE_ATTACHED | Checks if an Amazon Elastic Compute Cloud (Amazon EC2) instance has an Identity and Access Management (IAM) profile attached to it. |
EC2_INSTANCES_IN_VPC | Checks whether your EC2 instances belong to a virtual private cloud (VPC). |
EC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKED | Checks that none of the specified applications are installed on the instance. |
EC2_MANAGED_INSTANCE_APPLICATIONS_REQUIRED | Checks whether all of the specified applications are installed on the instance. |
EC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK | Checks whether the compliance status of AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance. |
EC2_MANAGED_INSTANCE_INVENTORY_BLOCKED | Checks whether instances managed by AWS Systems Manager are configured to collect blocked inventory types. |
EC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECK | Checks whether the compliance status of the Amazon EC2 Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance. |
EC2_MANAGED_INSTANCE_PLATFORM_CHECK | Checks whether EC2 managed instances have the desired configurations. |
EC2_SECURITY_GROUP_ATTACHED_TO_ENI | Checks that security groups are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances or to an elastic network interface. |
EC2_SECURITY_GROUPS_INCOMING_SSH_DISABLED | Checks whether the incoming SSH traffic for the security groups is accessible. |
EC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFIC | Checks whether the security groups in use do not allow unrestricted incoming TCP traffic to the specified ports. |
EC2_STOPPED_INSTANCE | Checks whether there are instances stopped for more than the allowed number of days. |
EC2_VOLUME_INUSE_CHECK | Checks whether EBS volumes are attached to EC2 instances. |
EFS_ENCRYPTED_CHECK | hecks whether Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS). |
EFS_IN_BACKUP_PLAN | Checks whether Amazon Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup. |
EIP_ATTACHED | Checks whether all Elastic IP addresses that are allocated to a VPC are attached to EC2 instances or in-use elastic network interfaces (ENIs). |
EKS_ENDPOINT_NO_PUBLIC_ACCESS | Checks whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible. |
EKS_SECRETS_ENCRYPTED | Checks whether Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys. |
ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK | Check if the Amazon ElastiCache Redis clusters have automatic backup turned on. |
ELASTICSEARCH_ENCRYPTED_AT_REST | Checks whether Amazon Elasticsearch Service (Amazon ES) domains have encryption at rest configuration enabled. |
ELASTICSEARCH_IN_VPC_ONLY | Checks whether Amazon Elasticsearch Service (Amazon ES) domains are in Amazon Virtual Private Cloud (Amazon VPC). |
ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK | Check that Amazon ElasticSearch Service nodes are encrypted end to end. |
ELB_ACM_CERTIFICATE_REQUIRED | Checks whether the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager. |
ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED | Checks if cross-zone load balancing is enabled for the Classic Load Balancers (CLBs). |
ELB_CUSTOM_SECURITY_POLICY_SSL_CHECK | Checks whether your Classic Load Balancer SSL listeners are using a custom policy. |
ELB_DELETION_PROTECTION_ENABLED | Checks whether Elastic Load Balancing has deletion protection enabled. |
ELB_LOGGING_ENABLED | Checks whether the Application Load Balancer and the Classic Load Balancer have logging enabled. |
ELB_PREDEFINED_SECURITY_POLICY_SSL_CHECK | Checks whether your Classic Load Balancer SSL listeners are using a predefined policy. |
ELB_TLS_HTTPS_LISTENERS_ONLY | Checks whether your Classic Load Balancer is configured with SSL or HTTPS listeners. |
EMR_KERBEROS_ENABLED | Checks that Amazon EMR clusters have Kerberos enabled. |
EMR_MASTER_NO_PUBLIC_IP | Checks whether Amazon Elastic MapReduce (EMR) clusters' master nodes have public IPs. |
FMS_SECURITY_GROUP_AUDIT_POLICY_CHECK | Checks whether the security groups associated inScope resources are compliant with the master security groups at each rule level based on allowSecurityGroup and denySecurityGroup flag. |
FMS_SECURITY_GROUP_CONTENT_CHECK | Checks whether AWS Firewall Manager created security groups content is the same as the master security groups. |
FMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECK | Checks whether Amazon EC2 or an elastic network interface is associated with AWS Firewall Manager security groups. |
FMS_SHIELD_RESOURCE_POLICY_CHECK | Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection. |
FMS_WEBACL_RESOURCE_POLICY_CHECK | Checks whether the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions. |
FMS_WEBACL_RULEGROUP_ASSOCIATION_CHECK | Checks that the rule groups associate with the web ACL at the correct priority. |
GUARDDUTY_ENABLED_CENTRALIZED | Checks whether Amazon GuardDuty is enabled in your AWS account and region. |
GUARDDUTY_NON_ARCHIVED_FINDINGS | Checks whether the Amazon GuardDuty has findings that are non archived. |
IAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONS | Checks that the managed AWS Identity and Access Management policies that you create do not allow blocked actions on all AWS AWS KMS keys. |
IAM_GROUP_HAS_USERS_CHECK | Checks whether IAM groups have at least one IAM user. |
IAM_INLINE_POLICY_BLOCKED_KMS_ACTIONS | Checks that the inline policies attached to your AWS Identity and Access Management users, roles, and groups do not allow blocked actions on all AWS Key Management Service keys. |
IAM_NO_INLINE_POLICY_CHECK | Checks that inline policy feature is not in use. |
IAM_PASSWORD_POLICY | Checks whether the account password policy for IAM users meets the specified requirements indicated in the parameters. |
IAM_POLICY_BLOCKED_CHECK | Checks whether for each IAM resource, a policy ARN in the input parameter is attached to the IAM resource. |
IAM_POLICY_IN_USE | Checks whether the IAM policy ARN is attached to an IAM user, or an IAM group with one or more IAM users, or an IAM role with one or more trusted entity. |
IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS | Checks the IAM policies that you create for Allow statements that grant permissions to all actions on all resources. |
IAM_ROLE_MANAGED_POLICY_CHECK | Checks that AWS Identity and Access Management (IAM) policies in a list of policies are attached to all AWS roles. |
IAM_ROOT_ACCESS_KEY_CHECK | Checks whether the root user access key is available. |
IAM_USER_GROUP_MEMBERSHIP_CHECK | Checks whether IAM users are members of at least one IAM group. |
IAM_USER_MFA_ENABLED | Checks whether the AWS Identity and Access Management users have multi-factor authentication (MFA) enabled. |
IAM_USER_NO_POLICIES_CHECK | Checks that none of your IAM users have policies attached. |
IAM_USER_UNUSED_CREDENTIALS_CHECK | Checks whether your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided. |
INTERNET_GATEWAY_AUTHORIZED_VPC_ONLY | Checks that Internet gateways (IGWs) are only attached to an authorized Amazon Virtual Private Cloud (VPCs). |
KMS_CMK_NOT_SCHEDULED_FOR_DELETION | Checks whether customer master keys (CMKs) are not scheduled for deletion in AWS Key Management Service (KMS). |
LAMBDA_CONCURRENCY_CHECK | Checks whether the AWS Lambda function is configured with function-level concurrent execution limit. |
LAMBDA_DLQ_CHECK | Checks whether an AWS Lambda function is configured with a dead-letter queue. |
LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED | Checks whether the AWS Lambda function policy attached to the Lambda resource prohibits public access. |
LAMBDA_FUNCTION_SETTINGS_CHECK | Checks that the lambda function settings for runtime, role, timeout, and memory size match the expected values. |
LAMBDA_INSIDE_VPC | Checks whether an AWS Lambda function is in an Amazon Virtual Private Cloud. |
MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS | Checks whether AWS Multi-Factor Authentication (MFA) is enabled for all IAM users that use a console password. |
RDS_CLUSTER_DELETION_PROTECTION_ENABLED | Checks if an Amazon Relational Database Service (Amazon RDS) cluster has deletion protection enabled. |
RDS_DB_INSTANCE_BACKUP_ENABLED | Checks whether RDS DB instances have backups enabled. |
RDS_ENHANCED_MONITORING_ENABLED | Checks whether enhanced monitoring is enabled for Amazon Relational Database Service (Amazon RDS) instances. |
RDS_IN_BACKUP_PLAN | Checks whether Amazon RDS database is present in back plans of AWS Backup. |
RDS_INSTANCE_DELETION_PROTECTION_ENABLED | Checks if an Amazon Relational Database Service (Amazon RDS) instance has deletion protection enabled. |
RDS_INSTANCE_IAM_AUTHENTICATION_ENABLED | Checks if an Amazon RDS instance has AWS Identity and Access Management (IAM) authentication enabled. |
RDS_INSTANCE_PUBLIC_ACCESS_CHECK | Check whether the Amazon Relational Database Service instances are not publicly accessible. |
RDS_LOGGING_ENABLED | Checks that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled. |
RDS_MULTI_AZ_SUPPORT | Checks whether high availability is enabled for your RDS DB instances. |
RDS_SNAPSHOT_ENCRYPTED | Checks whether Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted. |
RDS_SNAPSHOTS_PUBLIC_PROHIBITED | Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public. |
RDS_STORAGE_ENCRYPTED | Checks whether storage encryption is enabled for your RDS DB instances. |
REDSHIFT_BACKUP_ENABLED | Checks that Amazon Redshift automated snapshots are enabled for clusters. |
REDSHIFT_CLUSTER_CONFIGURATION_CHECK | Checks whether Amazon Redshift clusters have the specified settings. |
REDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECK | Checks whether Amazon Redshift clusters have the specified maintenance settings. |
REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK | Checks whether Amazon Redshift clusters are not publicly accessible. |
REDSHIFT_REQUIRE_TLS_SSL | Checks whether Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. |
REQUIRED_TAGS | Checks whether your resources have the tags that you specify. |
ROOT_ACCOUNT_HARDWARE_MFA_ENABLED | Checks whether your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials. |
ROOT_ACCOUNT_MFA_ENABLED | Checks whether users of your AWS account require a multi-factor authentication (MFA) device to sign in with root credentials. |
S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS | Checks whether the required public access block settings are configured from account level. |
S3_BUCKET_BLOCKED_ACTIONS_PROHIBITED | Checks that the Amazon Simple Storage Service bucket policy does not allow blocked bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts. |
S3_BUCKET_DEFAULT_LOCK_ENABLED | Checks whether Amazon Simple Storage Service (Amazon S3) bucket has lock enabled, by default. |
S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED | Checks if Amazon Simple Storage Service (Amazon S3) buckets are publicly accessible. |
S3_BUCKET_LOGGING_ENABLED | Checks whether logging is enabled for your S3 buckets. |
S3_BUCKET_POLICY_GRANTEE_CHECK | Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide. |
S3_BUCKET_POLICY_NOT_MORE_PERMISSIVE | Verifies that your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy provided. |
S3_BUCKET_PUBLIC_READ_PROHIBITED | Checks that your Amazon S3 buckets do not allow public read access. |
S3_BUCKET_PUBLIC_WRITE_PROHIBITED | Checks that your Amazon S3 buckets do not allow public write access. |
S3_BUCKET_REPLICATION_ENABLED | Checks whether S3 buckets have cross-region replication enabled. |
S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED | Checks that your Amazon S3 bucket either has Amazon S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service. |
S3_BUCKET_SSL_REQUESTS_ONLY | Checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL). |
S3_BUCKET_VERSIONING_ENABLED | Checks whether versioning is enabled for your S3 buckets. |
S3_DEFAULT_ENCRYPTION_KMS | Checks whether the Amazon Simple Storage Service (Amazon S3) buckets are encrypted with AWS Key Management Service (AWS KMS). |
SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED | Checks whether AWS Key Management Service (KMS) key is configured for an Amazon SageMaker endpoint configuration. |
SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED | Check whether an AWS Key Management Service (KMS) key is configured for SageMaker notebook instance. |
SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS | Checks whether direct internet access is disabled for an Amazon SageMaker notebook instance. |
SECRETSMANAGER_ROTATION_ENABLED_CHECK | Checks whether AWS Secrets Manager secret has rotation enabled. |
SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK | Checks whether AWS Secrets Manager secret rotation has rotated successfully as per the rotation schedule. |
SECURITYHUB_ENABLED | Checks that AWS Security Hub is enabled for an AWS account. |
SERVICE_VPC_ENDPOINT_ENABLED | Checks whether Service Endpoint for the service provided in rule parameter is created for each Amazon VPC. |
SHIELD_ADVANCED_ENABLED_AUTO_RENEW | Checks whether EBS volumes are attached to EC2 instances. |
SHIELD_DRT_ACCESS | Verify that DDoS response team (DRT) can access AWS account. |
SNS_ENCRYPTED_KMS | Checks whether Amazon SNS topic is encrypted with AWS Key Management Service (AWS KMS). |
VPC_DEFAULT_SECURITY_GROUP_CLOSED | Checks that the default security group of any Amazon Virtual Private Cloud (VPC) does not allow inbound or outbound traffic. |
VPC_FLOW_LOGS_ENABLED | Checks whether Amazon Virtual Private Cloud flow logs are found and enabled for Amazon VPC. |
VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS | Checks whether the security group with 0.0.0.0/0 of any Amazon Virtual Private Cloud (Amazon VPC) allows only specific inbound TCP or UDP traffic. |
VPC_VPN_2_TUNNELS_UP | Checks that both AWS Virtual Private Network tunnels provided by AWS Site-to-Site VPN are in UP status. |
WAF_CLASSIC_LOGGING_ENABLED | Checks if logging is enabled on AWS Web Application Firewall (WAF) classic global web ACLs. |
WAFV2_LOGGING_ENABLED | Checks whether logging is enabled on AWS Web Application Firewall (WAFV2) regional and global web access control list (ACLs). |
Constructors
ManagedRuleIdentifiers(ByRefValue)
Used by jsii to construct an instance of this class from a Javascript-owned object reference
protected ManagedRuleIdentifiers(ByRefValue reference)
Parameters
- reference Amazon.JSII.Runtime.Deputy.ByRefValue
The Javascript-owned object reference
ManagedRuleIdentifiers(DeputyBase.DeputyProps)
Used by jsii to construct an instance of this class from DeputyProps
protected ManagedRuleIdentifiers(DeputyBase.DeputyProps props)
Parameters
- props Amazon.JSII.Runtime.Deputy.DeputyBase.DeputyProps
The deputy props
Properties
ACCESS_KEYS_ROTATED
Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge.
public static string ACCESS_KEYS_ROTATED { get; }
Property Value
System.String
Remarks
ACCOUNT_PART_OF_ORGANIZATIONS
Checks whether AWS account is part of AWS Organizations.
public static string ACCOUNT_PART_OF_ORGANIZATIONS { get; }
Property Value
System.String
Remarks
ACM_CERTIFICATE_EXPIRATION_CHECK
Checks whether ACM Certificates in your account are marked for expiration within the specified number of days.
public static string ACM_CERTIFICATE_EXPIRATION_CHECK { get; }
Property Value
System.String
Remarks
ALB_HTTP_DROP_INVALID_HEADER_ENABLED
Checks if rule evaluates Application Load Balancers (ALBs) to ensure they are configured to drop http headers.
public static string ALB_HTTP_DROP_INVALID_HEADER_ENABLED { get; }
Property Value
System.String
Remarks
ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK
Checks whether HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancer.
public static string ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK { get; }
Property Value
System.String
Remarks
ALB_WAF_ENABLED
Checks if Web Application Firewall (WAF) is enabled on Application Load Balancers (ALBs).
public static string ALB_WAF_ENABLED { get; }
Property Value
System.String
Remarks
API_GW_CACHE_ENABLED_AND_ENCRYPTED
Checks that all methods in Amazon API Gateway stages have caching enabled and encrypted.
public static string API_GW_CACHE_ENABLED_AND_ENCRYPTED { get; }
Property Value
System.String
Remarks
API_GW_ENDPOINT_TYPE_CHECK
Checks that Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType.
public static string API_GW_ENDPOINT_TYPE_CHECK { get; }
Property Value
System.String
Remarks
API_GW_EXECUTION_LOGGING_ENABLED
Checks that all methods in Amazon API Gateway stage has logging enabled.
public static string API_GW_EXECUTION_LOGGING_ENABLED { get; }
Property Value
System.String
Remarks
APPROVED_AMIS_BY_ID
Checks whether running instances are using specified AMIs.
public static string APPROVED_AMIS_BY_ID { get; }
Property Value
System.String
Remarks
APPROVED_AMIS_BY_TAG
Checks whether running instances are using specified AMIs.
public static string APPROVED_AMIS_BY_TAG { get; }
Property Value
System.String
Remarks
AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED
Checks whether your Auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.
public static string AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED { get; }
Property Value
System.String
Remarks
CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED
Checks whether AWS CloudTrail trails are configured to send logs to Amazon CloudWatch Logs.
public static string CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED { get; }
Property Value
System.String
Remarks
CLOUD_TRAIL_ENABLED
Checks whether AWS CloudTrail is enabled in your AWS account.
public static string CLOUD_TRAIL_ENABLED { get; }
Property Value
System.String
Remarks
CLOUD_TRAIL_ENCRYPTION_ENABLED
Checks whether AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) customer master key (CMK) encryption.
public static string CLOUD_TRAIL_ENCRYPTION_ENABLED { get; }
Property Value
System.String
Remarks
CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
Checks whether AWS CloudTrail creates a signed digest file with logs.
public static string CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK
Checks whether an AWS CloudFormation stack's actual configuration differs, or has drifted, from it's expected configuration.
public static string CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK { get; }
Property Value
System.String
Remarks
CLOUDFORMATION_STACK_NOTIFICATION_CHECK
Checks whether your CloudFormation stacks are sending event notifications to an SNS topic.
public static string CLOUDFORMATION_STACK_NOTIFICATION_CHECK { get; }
Property Value
System.String
Remarks
CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED
Checks if an Amazon CloudFront distribution is configured to return a specific object that is the default root object.
public static string CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED { get; }
Property Value
System.String
Remarks
CLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLED
Checks that Amazon CloudFront distribution with Amazon S3 Origin type has Origin Access Identity (OAI) configured.
public static string CLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDFRONT_ORIGIN_FAILOVER_ENABLED
Checks whether an origin group is configured for the distribution of at least 2 origins in the origin group for Amazon CloudFront.
public static string CLOUDFRONT_ORIGIN_FAILOVER_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDFRONT_SNI_ENABLED
Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests.
public static string CLOUDFRONT_SNI_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDFRONT_VIEWER_POLICY_HTTPS
Checks whether your Amazon CloudFront distributions use HTTPS (directly or via a redirection).
public static string CLOUDFRONT_VIEWER_POLICY_HTTPS { get; }
Property Value
System.String
Remarks
CLOUDTRAIL_MULTI_REGION_ENABLED
Checks that there is at least one multi-region AWS CloudTrail.
public static string CLOUDTRAIL_MULTI_REGION_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDTRAIL_S3_DATAEVENTS_ENABLED
Checks whether at least one AWS CloudTrail trail is logging Amazon S3 data events for all S3 buckets.
public static string CLOUDTRAIL_S3_DATAEVENTS_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDTRAIL_SECURITY_TRAIL_ENABLED
Checks that there is at least one AWS CloudTrail trail defined with security best practices.
public static string CLOUDTRAIL_SECURITY_TRAIL_ENABLED { get; }
Property Value
System.String
Remarks
CLOUDWATCH_ALARM_ACTION_CHECK
Checks whether CloudWatch alarms have at least one alarm action, one INSUFFICIENT_DATA action, or one OK action enabled.
public static string CLOUDWATCH_ALARM_ACTION_CHECK { get; }
Property Value
System.String
Remarks
CLOUDWATCH_ALARM_RESOURCE_CHECK
Checks whether the specified resource type has a CloudWatch alarm for the specified metric.
public static string CLOUDWATCH_ALARM_RESOURCE_CHECK { get; }
Property Value
System.String
Remarks
CLOUDWATCH_ALARM_SETTINGS_CHECK
Checks whether CloudWatch alarms with the given metric name have the specified settings.
public static string CLOUDWATCH_ALARM_SETTINGS_CHECK { get; }
Property Value
System.String
Remarks
CLOUDWATCH_LOG_GROUP_ENCRYPTED
Checks whether a log group in Amazon CloudWatch Logs is encrypted with a AWS Key Management Service (KMS) managed Customer Master Keys (CMK).
public static string CLOUDWATCH_LOG_GROUP_ENCRYPTED { get; }
Property Value
System.String
Remarks
CMK_BACKING_KEY_ROTATION_ENABLED
Checks that key rotation is enabled for each key and matches to the key ID of the customer created customer master key (CMK).
public static string CMK_BACKING_KEY_ROTATION_ENABLED { get; }
Property Value
System.String
Remarks
CODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECK
Checks whether the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
public static string CODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECK { get; }
Property Value
System.String
Remarks
CODEBUILD_PROJECT_SOURCE_REPO_URL_CHECK
Checks whether the GitHub or Bitbucket source repository URL contains either personal access tokens or user name and password.
public static string CODEBUILD_PROJECT_SOURCE_REPO_URL_CHECK { get; }
Property Value
System.String
Remarks
CODEPIPELINE_DEPLOYMENT_COUNT_CHECK
Checks whether the first deployment stage of the AWS CodePipeline performs more than one deployment.
public static string CODEPIPELINE_DEPLOYMENT_COUNT_CHECK { get; }
Property Value
System.String
Remarks
CODEPIPELINE_REGION_FANOUT_CHECK
Checks whether each stage in the AWS CodePipeline deploys to more than N times the number of the regions the AWS CodePipeline has deployed in all the previous combined stages, where N is the region fanout number.
public static string CODEPIPELINE_REGION_FANOUT_CHECK { get; }
Property Value
System.String
Remarks
CW_LOGGROUP_RETENTION_PERIOD_CHECK
Checks whether Amazon CloudWatch LogGroup retention period is set to specific number of days.
public static string CW_LOGGROUP_RETENTION_PERIOD_CHECK { get; }
Property Value
System.String
Remarks
DAX_ENCRYPTION_ENABLED
Checks that DynamoDB Accelerator (DAX) clusters are encrypted.
public static string DAX_ENCRYPTION_ENABLED { get; }
Property Value
System.String
Remarks
DMS_REPLICATION_NOT_PUBLIC
Checks whether AWS Database Migration Service replication instances are public.
public static string DMS_REPLICATION_NOT_PUBLIC { get; }
Property Value
System.String
Remarks
DYNAMODB_AUTOSCALING_ENABLED
Checks whether Auto Scaling or On-Demand is enabled on your DynamoDB tables and/or global secondary indexes.
public static string DYNAMODB_AUTOSCALING_ENABLED { get; }
Property Value
System.String
Remarks
DYNAMODB_IN_BACKUP_PLAN
Checks whether Amazon DynamoDB table is present in AWS Backup plans.
public static string DYNAMODB_IN_BACKUP_PLAN { get; }
Property Value
System.String
Remarks
DYNAMODB_PITR_ENABLED
Checks that point in time recovery (PITR) is enabled for Amazon DynamoDB tables.
public static string DYNAMODB_PITR_ENABLED { get; }
Property Value
System.String
Remarks
DYNAMODB_TABLE_ENCRYPTED_KMS
Checks whether Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS).
public static string DYNAMODB_TABLE_ENCRYPTED_KMS { get; }
Property Value
System.String
Remarks
DYNAMODB_TABLE_ENCRYPTION_ENABLED
Checks whether the Amazon DynamoDB tables are encrypted and checks their status.
public static string DYNAMODB_TABLE_ENCRYPTION_ENABLED { get; }
Property Value
System.String
Remarks
DYNAMODB_THROUGHPUT_LIMIT_CHECK
Checks whether provisioned DynamoDB throughput is approaching the maximum limit for your account.
public static string DYNAMODB_THROUGHPUT_LIMIT_CHECK { get; }
Property Value
System.String
Remarks
EBS_ENCRYPTED_VOLUMES
Checks whether the EBS volumes that are in an attached state are encrypted.
public static string EBS_ENCRYPTED_VOLUMES { get; }
Property Value
System.String
Remarks
EBS_IN_BACKUP_PLAN
Checks if Amazon Elastic Block Store (Amazon EBS) volumes are added in backup plans of AWS Backup.
public static string EBS_IN_BACKUP_PLAN { get; }
Property Value
System.String
Remarks
EBS_OPTIMIZED_INSTANCE
Checks whether EBS optimization is enabled for your EC2 instances that can be EBS-optimized.
public static string EBS_OPTIMIZED_INSTANCE { get; }
Property Value
System.String
Remarks
EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK
Checks whether Amazon Elastic Block Store snapshots are not publicly restorable.
public static string EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK { get; }
Property Value
System.String
Remarks
EC2_DESIRED_INSTANCE_TENANCY
Checks instances for specified tenancy.
public static string EC2_DESIRED_INSTANCE_TENANCY { get; }
Property Value
System.String
Remarks
EC2_DESIRED_INSTANCE_TYPE
Checks whether your EC2 instances are of the specified instance types.
public static string EC2_DESIRED_INSTANCE_TYPE { get; }
Property Value
System.String
Remarks
EC2_EBS_ENCRYPTION_BY_DEFAULT
Check that Amazon Elastic Block Store (EBS) encryption is enabled by default.
public static string EC2_EBS_ENCRYPTION_BY_DEFAULT { get; }
Property Value
System.String
Remarks
EC2_IMDSV2_CHECK
Checks whether your Amazon Elastic Compute Cloud (Amazon EC2) instance metadata version is configured with Instance Metadata Service Version 2 (IMDSv2).
public static string EC2_IMDSV2_CHECK { get; }
Property Value
System.String
Remarks
EC2_INSTANCE_DETAILED_MONITORING_ENABLED
Checks whether detailed monitoring is enabled for EC2 instances.
public static string EC2_INSTANCE_DETAILED_MONITORING_ENABLED { get; }
Property Value
System.String
Remarks
EC2_INSTANCE_MANAGED_BY_SSM
Checks whether the Amazon EC2 instances in your account are managed by AWS Systems Manager.
public static string EC2_INSTANCE_MANAGED_BY_SSM { get; }
Property Value
System.String
Remarks
EC2_INSTANCE_NO_PUBLIC_IP
Checks whether Amazon Elastic Compute Cloud (Amazon EC2) instances have a public IP association.
public static string EC2_INSTANCE_NO_PUBLIC_IP { get; }
Property Value
System.String
Remarks
EC2_INSTANCE_PROFILE_ATTACHED
Checks if an Amazon Elastic Compute Cloud (Amazon EC2) instance has an Identity and Access Management (IAM) profile attached to it.
public static string EC2_INSTANCE_PROFILE_ATTACHED { get; }
Property Value
System.String
Remarks
This rule is NON_COMPLIANT if no IAM profile is attached to the Amazon EC2 instance.
See: https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-profile-attached.html
EC2_INSTANCES_IN_VPC
Checks whether your EC2 instances belong to a virtual private cloud (VPC).
public static string EC2_INSTANCES_IN_VPC { get; }
Property Value
System.String
Remarks
EC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKED
Checks that none of the specified applications are installed on the instance.
public static string EC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKED { get; }
Property Value
System.String
Remarks
EC2_MANAGED_INSTANCE_APPLICATIONS_REQUIRED
Checks whether all of the specified applications are installed on the instance.
public static string EC2_MANAGED_INSTANCE_APPLICATIONS_REQUIRED { get; }
Property Value
System.String
Remarks
EC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK
Checks whether the compliance status of AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance.
public static string EC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK { get; }
Property Value
System.String
Remarks
EC2_MANAGED_INSTANCE_INVENTORY_BLOCKED
Checks whether instances managed by AWS Systems Manager are configured to collect blocked inventory types.
public static string EC2_MANAGED_INSTANCE_INVENTORY_BLOCKED { get; }
Property Value
System.String
Remarks
EC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECK
Checks whether the compliance status of the Amazon EC2 Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance.
public static string EC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECK { get; }
Property Value
System.String
Remarks
EC2_MANAGED_INSTANCE_PLATFORM_CHECK
Checks whether EC2 managed instances have the desired configurations.
public static string EC2_MANAGED_INSTANCE_PLATFORM_CHECK { get; }
Property Value
System.String
Remarks
EC2_SECURITY_GROUP_ATTACHED_TO_ENI
Checks that security groups are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances or to an elastic network interface.
public static string EC2_SECURITY_GROUP_ATTACHED_TO_ENI { get; }
Property Value
System.String
Remarks
EC2_SECURITY_GROUPS_INCOMING_SSH_DISABLED
Checks whether the incoming SSH traffic for the security groups is accessible.
public static string EC2_SECURITY_GROUPS_INCOMING_SSH_DISABLED { get; }
Property Value
System.String
Remarks
EC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFIC
Checks whether the security groups in use do not allow unrestricted incoming TCP traffic to the specified ports.
public static string EC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFIC { get; }
Property Value
System.String
Remarks
EC2_STOPPED_INSTANCE
Checks whether there are instances stopped for more than the allowed number of days.
public static string EC2_STOPPED_INSTANCE { get; }
Property Value
System.String
Remarks
EC2_VOLUME_INUSE_CHECK
Checks whether EBS volumes are attached to EC2 instances.
public static string EC2_VOLUME_INUSE_CHECK { get; }
Property Value
System.String
Remarks
EFS_ENCRYPTED_CHECK
hecks whether Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS).
public static string EFS_ENCRYPTED_CHECK { get; }
Property Value
System.String
Remarks
EFS_IN_BACKUP_PLAN
Checks whether Amazon Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup.
public static string EFS_IN_BACKUP_PLAN { get; }
Property Value
System.String
Remarks
EIP_ATTACHED
Checks whether all Elastic IP addresses that are allocated to a VPC are attached to EC2 instances or in-use elastic network interfaces (ENIs).
public static string EIP_ATTACHED { get; }
Property Value
System.String
Remarks
EKS_ENDPOINT_NO_PUBLIC_ACCESS
Checks whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible.
public static string EKS_ENDPOINT_NO_PUBLIC_ACCESS { get; }
Property Value
System.String
Remarks
EKS_SECRETS_ENCRYPTED
Checks whether Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys.
public static string EKS_SECRETS_ENCRYPTED { get; }
Property Value
System.String
Remarks
ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK
Check if the Amazon ElastiCache Redis clusters have automatic backup turned on.
public static string ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK { get; }
Property Value
System.String
Remarks
ELASTICSEARCH_ENCRYPTED_AT_REST
Checks whether Amazon Elasticsearch Service (Amazon ES) domains have encryption at rest configuration enabled.
public static string ELASTICSEARCH_ENCRYPTED_AT_REST { get; }
Property Value
System.String
Remarks
ELASTICSEARCH_IN_VPC_ONLY
Checks whether Amazon Elasticsearch Service (Amazon ES) domains are in Amazon Virtual Private Cloud (Amazon VPC).
public static string ELASTICSEARCH_IN_VPC_ONLY { get; }
Property Value
System.String
Remarks
ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK
Check that Amazon ElasticSearch Service nodes are encrypted end to end.
public static string ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK { get; }
Property Value
System.String
Remarks
ELB_ACM_CERTIFICATE_REQUIRED
Checks whether the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager.
public static string ELB_ACM_CERTIFICATE_REQUIRED { get; }
Property Value
System.String
Remarks
ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED
Checks if cross-zone load balancing is enabled for the Classic Load Balancers (CLBs).
public static string ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED { get; }
Property Value
System.String
Remarks
ELB_CUSTOM_SECURITY_POLICY_SSL_CHECK
Checks whether your Classic Load Balancer SSL listeners are using a custom policy.
public static string ELB_CUSTOM_SECURITY_POLICY_SSL_CHECK { get; }
Property Value
System.String
Remarks
ELB_DELETION_PROTECTION_ENABLED
Checks whether Elastic Load Balancing has deletion protection enabled.
public static string ELB_DELETION_PROTECTION_ENABLED { get; }
Property Value
System.String
Remarks
ELB_LOGGING_ENABLED
Checks whether the Application Load Balancer and the Classic Load Balancer have logging enabled.
public static string ELB_LOGGING_ENABLED { get; }
Property Value
System.String
Remarks
ELB_PREDEFINED_SECURITY_POLICY_SSL_CHECK
Checks whether your Classic Load Balancer SSL listeners are using a predefined policy.
public static string ELB_PREDEFINED_SECURITY_POLICY_SSL_CHECK { get; }
Property Value
System.String
Remarks
ELB_TLS_HTTPS_LISTENERS_ONLY
Checks whether your Classic Load Balancer is configured with SSL or HTTPS listeners.
public static string ELB_TLS_HTTPS_LISTENERS_ONLY { get; }
Property Value
System.String
Remarks
EMR_KERBEROS_ENABLED
Checks that Amazon EMR clusters have Kerberos enabled.
public static string EMR_KERBEROS_ENABLED { get; }
Property Value
System.String
Remarks
EMR_MASTER_NO_PUBLIC_IP
Checks whether Amazon Elastic MapReduce (EMR) clusters' master nodes have public IPs.
public static string EMR_MASTER_NO_PUBLIC_IP { get; }
Property Value
System.String
Remarks
FMS_SECURITY_GROUP_AUDIT_POLICY_CHECK
Checks whether the security groups associated inScope resources are compliant with the master security groups at each rule level based on allowSecurityGroup and denySecurityGroup flag.
public static string FMS_SECURITY_GROUP_AUDIT_POLICY_CHECK { get; }
Property Value
System.String
Remarks
FMS_SECURITY_GROUP_CONTENT_CHECK
Checks whether AWS Firewall Manager created security groups content is the same as the master security groups.
public static string FMS_SECURITY_GROUP_CONTENT_CHECK { get; }
Property Value
System.String
Remarks
FMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECK
Checks whether Amazon EC2 or an elastic network interface is associated with AWS Firewall Manager security groups.
public static string FMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECK { get; }
Property Value
System.String
Remarks
FMS_SHIELD_RESOURCE_POLICY_CHECK
Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection.
public static string FMS_SHIELD_RESOURCE_POLICY_CHECK { get; }
Property Value
System.String
Remarks
FMS_WEBACL_RESOURCE_POLICY_CHECK
Checks whether the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions.
public static string FMS_WEBACL_RESOURCE_POLICY_CHECK { get; }
Property Value
System.String
Remarks
FMS_WEBACL_RULEGROUP_ASSOCIATION_CHECK
Checks that the rule groups associate with the web ACL at the correct priority.
public static string FMS_WEBACL_RULEGROUP_ASSOCIATION_CHECK { get; }
Property Value
System.String
Remarks
The correct priority is decided by the rank of the rule groups in the ruleGroups parameter.
See: https://docs.aws.amazon.com/config/latest/developerguide/fms-webacl-rulegroup-association-check.html
GUARDDUTY_ENABLED_CENTRALIZED
Checks whether Amazon GuardDuty is enabled in your AWS account and region.
public static string GUARDDUTY_ENABLED_CENTRALIZED { get; }
Property Value
System.String
Remarks
If you provide an AWS account for centralization, the rule evaluates the Amazon GuardDuty results in the centralized account.
See: https://docs.aws.amazon.com/config/latest/developerguide/guardduty-enabled-centralized.html
GUARDDUTY_NON_ARCHIVED_FINDINGS
Checks whether the Amazon GuardDuty has findings that are non archived.
public static string GUARDDUTY_NON_ARCHIVED_FINDINGS { get; }
Property Value
System.String
Remarks
IAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONS
Checks that the managed AWS Identity and Access Management policies that you create do not allow blocked actions on all AWS AWS KMS keys.
public static string IAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONS { get; }
Property Value
System.String
Remarks
IAM_GROUP_HAS_USERS_CHECK
Checks whether IAM groups have at least one IAM user.
public static string IAM_GROUP_HAS_USERS_CHECK { get; }
Property Value
System.String
Remarks
IAM_INLINE_POLICY_BLOCKED_KMS_ACTIONS
Checks that the inline policies attached to your AWS Identity and Access Management users, roles, and groups do not allow blocked actions on all AWS Key Management Service keys.
public static string IAM_INLINE_POLICY_BLOCKED_KMS_ACTIONS { get; }
Property Value
System.String
Remarks
IAM_NO_INLINE_POLICY_CHECK
Checks that inline policy feature is not in use.
public static string IAM_NO_INLINE_POLICY_CHECK { get; }
Property Value
System.String
Remarks
IAM_PASSWORD_POLICY
Checks whether the account password policy for IAM users meets the specified requirements indicated in the parameters.
public static string IAM_PASSWORD_POLICY { get; }
Property Value
System.String
Remarks
IAM_POLICY_BLOCKED_CHECK
Checks whether for each IAM resource, a policy ARN in the input parameter is attached to the IAM resource.
public static string IAM_POLICY_BLOCKED_CHECK { get; }
Property Value
System.String
Remarks
IAM_POLICY_IN_USE
Checks whether the IAM policy ARN is attached to an IAM user, or an IAM group with one or more IAM users, or an IAM role with one or more trusted entity.
public static string IAM_POLICY_IN_USE { get; }
Property Value
System.String
Remarks
IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS
Checks the IAM policies that you create for Allow statements that grant permissions to all actions on all resources.
public static string IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS { get; }
Property Value
System.String
Remarks
IAM_ROLE_MANAGED_POLICY_CHECK
Checks that AWS Identity and Access Management (IAM) policies in a list of policies are attached to all AWS roles.
public static string IAM_ROLE_MANAGED_POLICY_CHECK { get; }
Property Value
System.String
Remarks
IAM_ROOT_ACCESS_KEY_CHECK
Checks whether the root user access key is available.
public static string IAM_ROOT_ACCESS_KEY_CHECK { get; }
Property Value
System.String
Remarks
IAM_USER_GROUP_MEMBERSHIP_CHECK
Checks whether IAM users are members of at least one IAM group.
public static string IAM_USER_GROUP_MEMBERSHIP_CHECK { get; }
Property Value
System.String
Remarks
IAM_USER_MFA_ENABLED
Checks whether the AWS Identity and Access Management users have multi-factor authentication (MFA) enabled.
public static string IAM_USER_MFA_ENABLED { get; }
Property Value
System.String
Remarks
IAM_USER_NO_POLICIES_CHECK
Checks that none of your IAM users have policies attached.
public static string IAM_USER_NO_POLICIES_CHECK { get; }
Property Value
System.String
Remarks
IAM users must inherit permissions from IAM groups or roles.
See: https://docs.aws.amazon.com/config/latest/developerguide/iam-user-no-policies-check.html
IAM_USER_UNUSED_CREDENTIALS_CHECK
Checks whether your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided.
public static string IAM_USER_UNUSED_CREDENTIALS_CHECK { get; }
Property Value
System.String
Remarks
INTERNET_GATEWAY_AUTHORIZED_VPC_ONLY
Checks that Internet gateways (IGWs) are only attached to an authorized Amazon Virtual Private Cloud (VPCs).
public static string INTERNET_GATEWAY_AUTHORIZED_VPC_ONLY { get; }
Property Value
System.String
Remarks
KMS_CMK_NOT_SCHEDULED_FOR_DELETION
Checks whether customer master keys (CMKs) are not scheduled for deletion in AWS Key Management Service (KMS).
public static string KMS_CMK_NOT_SCHEDULED_FOR_DELETION { get; }
Property Value
System.String
Remarks
LAMBDA_CONCURRENCY_CHECK
Checks whether the AWS Lambda function is configured with function-level concurrent execution limit.
public static string LAMBDA_CONCURRENCY_CHECK { get; }
Property Value
System.String
Remarks
LAMBDA_DLQ_CHECK
Checks whether an AWS Lambda function is configured with a dead-letter queue.
public static string LAMBDA_DLQ_CHECK { get; }
Property Value
System.String
Remarks
LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED
Checks whether the AWS Lambda function policy attached to the Lambda resource prohibits public access.
public static string LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED { get; }
Property Value
System.String
Remarks
LAMBDA_FUNCTION_SETTINGS_CHECK
Checks that the lambda function settings for runtime, role, timeout, and memory size match the expected values.
public static string LAMBDA_FUNCTION_SETTINGS_CHECK { get; }
Property Value
System.String
Remarks
LAMBDA_INSIDE_VPC
Checks whether an AWS Lambda function is in an Amazon Virtual Private Cloud.
public static string LAMBDA_INSIDE_VPC { get; }
Property Value
System.String
Remarks
MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS
Checks whether AWS Multi-Factor Authentication (MFA) is enabled for all IAM users that use a console password.
public static string MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS { get; }
Property Value
System.String
Remarks
RDS_CLUSTER_DELETION_PROTECTION_ENABLED
Checks if an Amazon Relational Database Service (Amazon RDS) cluster has deletion protection enabled.
public static string RDS_CLUSTER_DELETION_PROTECTION_ENABLED { get; }
Property Value
System.String
Remarks
RDS_DB_INSTANCE_BACKUP_ENABLED
Checks whether RDS DB instances have backups enabled.
public static string RDS_DB_INSTANCE_BACKUP_ENABLED { get; }
Property Value
System.String
Remarks
RDS_ENHANCED_MONITORING_ENABLED
Checks whether enhanced monitoring is enabled for Amazon Relational Database Service (Amazon RDS) instances.
public static string RDS_ENHANCED_MONITORING_ENABLED { get; }
Property Value
System.String
Remarks
RDS_IN_BACKUP_PLAN
Checks whether Amazon RDS database is present in back plans of AWS Backup.
public static string RDS_IN_BACKUP_PLAN { get; }
Property Value
System.String
Remarks
RDS_INSTANCE_DELETION_PROTECTION_ENABLED
Checks if an Amazon Relational Database Service (Amazon RDS) instance has deletion protection enabled.
public static string RDS_INSTANCE_DELETION_PROTECTION_ENABLED { get; }
Property Value
System.String
Remarks
RDS_INSTANCE_IAM_AUTHENTICATION_ENABLED
Checks if an Amazon RDS instance has AWS Identity and Access Management (IAM) authentication enabled.
public static string RDS_INSTANCE_IAM_AUTHENTICATION_ENABLED { get; }
Property Value
System.String
Remarks
RDS_INSTANCE_PUBLIC_ACCESS_CHECK
Check whether the Amazon Relational Database Service instances are not publicly accessible.
public static string RDS_INSTANCE_PUBLIC_ACCESS_CHECK { get; }
Property Value
System.String
Remarks
RDS_LOGGING_ENABLED
Checks that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled.
public static string RDS_LOGGING_ENABLED { get; }
Property Value
System.String
Remarks
RDS_MULTI_AZ_SUPPORT
Checks whether high availability is enabled for your RDS DB instances.
public static string RDS_MULTI_AZ_SUPPORT { get; }
Property Value
System.String
Remarks
RDS_SNAPSHOT_ENCRYPTED
Checks whether Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted.
public static string RDS_SNAPSHOT_ENCRYPTED { get; }
Property Value
System.String
Remarks
RDS_SNAPSHOTS_PUBLIC_PROHIBITED
Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public.
public static string RDS_SNAPSHOTS_PUBLIC_PROHIBITED { get; }
Property Value
System.String
Remarks
RDS_STORAGE_ENCRYPTED
Checks whether storage encryption is enabled for your RDS DB instances.
public static string RDS_STORAGE_ENCRYPTED { get; }
Property Value
System.String
Remarks
REDSHIFT_BACKUP_ENABLED
Checks that Amazon Redshift automated snapshots are enabled for clusters.
public static string REDSHIFT_BACKUP_ENABLED { get; }
Property Value
System.String
Remarks
REDSHIFT_CLUSTER_CONFIGURATION_CHECK
Checks whether Amazon Redshift clusters have the specified settings.
public static string REDSHIFT_CLUSTER_CONFIGURATION_CHECK { get; }
Property Value
System.String
Remarks
REDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECK
Checks whether Amazon Redshift clusters have the specified maintenance settings.
public static string REDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECK { get; }
Property Value
System.String
Remarks
REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK
Checks whether Amazon Redshift clusters are not publicly accessible.
public static string REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK { get; }
Property Value
System.String
Remarks
REDSHIFT_REQUIRE_TLS_SSL
Checks whether Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients.
public static string REDSHIFT_REQUIRE_TLS_SSL { get; }
Property Value
System.String
Remarks
REQUIRED_TAGS
Checks whether your resources have the tags that you specify.
public static string REQUIRED_TAGS { get; }
Property Value
System.String
Remarks
For example, you can check whether your Amazon EC2 instances have the CostCenter tag.
See: https://docs.aws.amazon.com/config/latest/developerguide/required-tags.html
ROOT_ACCOUNT_HARDWARE_MFA_ENABLED
Checks whether your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials.
public static string ROOT_ACCOUNT_HARDWARE_MFA_ENABLED { get; }
Property Value
System.String
Remarks
ROOT_ACCOUNT_MFA_ENABLED
Checks whether users of your AWS account require a multi-factor authentication (MFA) device to sign in with root credentials.
public static string ROOT_ACCOUNT_MFA_ENABLED { get; }
Property Value
System.String
Remarks
S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS
Checks whether the required public access block settings are configured from account level.
public static string S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS { get; }
Property Value
System.String
Remarks
S3_BUCKET_BLOCKED_ACTIONS_PROHIBITED
Checks that the Amazon Simple Storage Service bucket policy does not allow blocked bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts.
public static string S3_BUCKET_BLOCKED_ACTIONS_PROHIBITED { get; }
Property Value
System.String
Remarks
S3_BUCKET_DEFAULT_LOCK_ENABLED
Checks whether Amazon Simple Storage Service (Amazon S3) bucket has lock enabled, by default.
public static string S3_BUCKET_DEFAULT_LOCK_ENABLED { get; }
Property Value
System.String
Remarks
S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED
Checks if Amazon Simple Storage Service (Amazon S3) buckets are publicly accessible.
public static string S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED { get; }
Property Value
System.String
Remarks
This rule is NON_COMPLIANT if an Amazon S3 bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.
S3_BUCKET_LOGGING_ENABLED
Checks whether logging is enabled for your S3 buckets.
public static string S3_BUCKET_LOGGING_ENABLED { get; }
Property Value
System.String
Remarks
S3_BUCKET_POLICY_GRANTEE_CHECK
Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide.
public static string S3_BUCKET_POLICY_GRANTEE_CHECK { get; }
Property Value
System.String
Remarks
S3_BUCKET_POLICY_NOT_MORE_PERMISSIVE
Verifies that your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy provided.
public static string S3_BUCKET_POLICY_NOT_MORE_PERMISSIVE { get; }
Property Value
System.String
Remarks
S3_BUCKET_PUBLIC_READ_PROHIBITED
Checks that your Amazon S3 buckets do not allow public read access.
public static string S3_BUCKET_PUBLIC_READ_PROHIBITED { get; }
Property Value
System.String
Remarks
S3_BUCKET_PUBLIC_WRITE_PROHIBITED
Checks that your Amazon S3 buckets do not allow public write access.
public static string S3_BUCKET_PUBLIC_WRITE_PROHIBITED { get; }
Property Value
System.String
Remarks
S3_BUCKET_REPLICATION_ENABLED
Checks whether S3 buckets have cross-region replication enabled.
public static string S3_BUCKET_REPLICATION_ENABLED { get; }
Property Value
System.String
Remarks
S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
Checks that your Amazon S3 bucket either has Amazon S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service.
public static string S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED { get; }
Property Value
System.String
Remarks
S3_BUCKET_SSL_REQUESTS_ONLY
Checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL).
public static string S3_BUCKET_SSL_REQUESTS_ONLY { get; }
Property Value
System.String
Remarks
S3_BUCKET_VERSIONING_ENABLED
Checks whether versioning is enabled for your S3 buckets.
public static string S3_BUCKET_VERSIONING_ENABLED { get; }
Property Value
System.String
Remarks
S3_DEFAULT_ENCRYPTION_KMS
Checks whether the Amazon Simple Storage Service (Amazon S3) buckets are encrypted with AWS Key Management Service (AWS KMS).
public static string S3_DEFAULT_ENCRYPTION_KMS { get; }
Property Value
System.String
Remarks
SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED
Checks whether AWS Key Management Service (KMS) key is configured for an Amazon SageMaker endpoint configuration.
public static string SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED { get; }
Property Value
System.String
Remarks
SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED
Check whether an AWS Key Management Service (KMS) key is configured for SageMaker notebook instance.
public static string SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED { get; }
Property Value
System.String
Remarks
SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS
Checks whether direct internet access is disabled for an Amazon SageMaker notebook instance.
public static string SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS { get; }
Property Value
System.String
Remarks
SECRETSMANAGER_ROTATION_ENABLED_CHECK
Checks whether AWS Secrets Manager secret has rotation enabled.
public static string SECRETSMANAGER_ROTATION_ENABLED_CHECK { get; }
Property Value
System.String
Remarks
SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK
Checks whether AWS Secrets Manager secret rotation has rotated successfully as per the rotation schedule.
public static string SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK { get; }
Property Value
System.String
Remarks
SECURITYHUB_ENABLED
Checks that AWS Security Hub is enabled for an AWS account.
public static string SECURITYHUB_ENABLED { get; }
Property Value
System.String
Remarks
SERVICE_VPC_ENDPOINT_ENABLED
Checks whether Service Endpoint for the service provided in rule parameter is created for each Amazon VPC.
public static string SERVICE_VPC_ENDPOINT_ENABLED { get; }
Property Value
System.String
Remarks
SHIELD_ADVANCED_ENABLED_AUTO_RENEW
Checks whether EBS volumes are attached to EC2 instances.
public static string SHIELD_ADVANCED_ENABLED_AUTO_RENEW { get; }
Property Value
System.String
Remarks
SHIELD_DRT_ACCESS
Verify that DDoS response team (DRT) can access AWS account.
public static string SHIELD_DRT_ACCESS { get; }
Property Value
System.String
Remarks
SNS_ENCRYPTED_KMS
Checks whether Amazon SNS topic is encrypted with AWS Key Management Service (AWS KMS).
public static string SNS_ENCRYPTED_KMS { get; }
Property Value
System.String
Remarks
VPC_DEFAULT_SECURITY_GROUP_CLOSED
Checks that the default security group of any Amazon Virtual Private Cloud (VPC) does not allow inbound or outbound traffic.
public static string VPC_DEFAULT_SECURITY_GROUP_CLOSED { get; }
Property Value
System.String
Remarks
The rule returns NOT_APPLICABLE if the security group is not default.
See: https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html
VPC_FLOW_LOGS_ENABLED
Checks whether Amazon Virtual Private Cloud flow logs are found and enabled for Amazon VPC.
public static string VPC_FLOW_LOGS_ENABLED { get; }
Property Value
System.String
Remarks
VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS
Checks whether the security group with 0.0.0.0/0 of any Amazon Virtual Private Cloud (Amazon VPC) allows only specific inbound TCP or UDP traffic.
public static string VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS { get; }
Property Value
System.String
Remarks
VPC_VPN_2_TUNNELS_UP
Checks that both AWS Virtual Private Network tunnels provided by AWS Site-to-Site VPN are in UP status.
public static string VPC_VPN_2_TUNNELS_UP { get; }
Property Value
System.String
Remarks
WAF_CLASSIC_LOGGING_ENABLED
Checks if logging is enabled on AWS Web Application Firewall (WAF) classic global web ACLs.
public static string WAF_CLASSIC_LOGGING_ENABLED { get; }
Property Value
System.String
Remarks
WAFV2_LOGGING_ENABLED
Checks whether logging is enabled on AWS Web Application Firewall (WAFV2) regional and global web access control list (ACLs).
public static string WAFV2_LOGGING_ENABLED { get; }
Property Value
System.String