Regional limits on controls

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ElastiCache.4] ElastiCache for Redis replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache for Redis replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.1] Database Migration Service replication instances should not be public

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.12] Unused Amazon EC2 EIPs should be removed

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.4] Application Load Balancer should be configured to drop http headers

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong Amazon Configuration

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[GuardDuty.1] GuardDuty should be enabled

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.10] IAM authentication should be configured for RDS instances

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.10] IAM authentication should be configured for RDS instances

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[Account.2] Amazon Web Services accounts should be part of an Amazon Organizations organization

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have Amazon X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.9] ECS task definitions should have a logging configuration

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.5] Application and Classic Load Balancers logging should be enabled

[ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElastiCache.6] ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.8] Unused IAM user credentials should be removed

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible Amazon Configuration

[RDS.7] RDS clusters should have deletion protection enabled

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.12] IAM authentication should be configured for RDS clusters

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.16] RDS DB clusters should be configured to copy tags to snapshots

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.28] RDS DB clusters should be tagged

[RDS.31] RDS DB security groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.6] S3 general purpose bucket policies should restrict access to other Amazon Web Services accounts

[S3.17] S3 general purpose buckets should be encrypted at rest with Amazon KMS keys

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.3] SNS topics should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SSM.1] Amazon EC2 instances should be managed by Amazon Systems Manager

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[StepFunctions.1] Step Functions state machines should have logging turned on

[Transfer.1] Amazon Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.2] Amazon WAF Classic Regional rules should have at least one condition

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.4] Amazon WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] Amazon WAF web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[Account.2] Amazon Web Services accounts should be part of an Amazon Organizations organization

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have Amazon X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[AutoScaling.3] Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

[AutoScaling.6] Auto Scaling groups should use multiple instance types in multiple Availability Zones

[AutoScaling.9] Amazon EC2 Auto Scaling groups should use Amazon EC2 launch templates

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudWatch.17] CloudWatch alarm actions should be activated

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECS.2] ECS services should not have public IP addresses assigned to them automatically

[ECS.3] ECS task definitions should not share the host's process namespace

[ECS.4] ECS containers should run as non-privileged

[ECS.5] ECS containers should be limited to read-only access to root filesystems

[ECS.8] Secrets should not be passed as container environment variables

[ECS.9] ECS task definitions should have a logging configuration

[ECS.10] ECS Fargate services should run on the latest Fargate platform version

[ECS.12] ECS clusters should use Container Insights

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.12] Application Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElastiCache.6] ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.16] RDS DB clusters should be configured to copy tags to snapshots

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.31] RDS DB security groups should be tagged

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.9] Redshift clusters should not use the default database name

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.11] S3 general purpose buckets should have event notifications enabled

[S3.13] S3 general purpose buckets should have Lifecycle configurations

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.3] SNS topics should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SSM.1] Amazon EC2 instances should be managed by Amazon Systems Manager

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.2] Amazon WAF Classic Regional rules should have at least one condition

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.4] Amazon WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] Amazon WAF web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.4] Amazon AppSync GraphQL APIs should be tagged

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.1] Amazon EBS snapshots should not be publicly restorable

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.9] Amazon EC2 instances should not have a public IPv4 address

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.33] EC2 transit gateway attachments should be tagged

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[ECR.1] ECR private repositories should have image scanning configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.9] ECS task definitions should have a logging configuration

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EKS.6] EKS clusters should be tagged

[EKS.7] EKS identity provider configurations should be tagged

[EKS.8] EKS clusters should have audit logging enabled

[ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElastiCache.2] ElastiCache for Redis cache clusters should have auto minor version upgrade enabled

[ElastiCache.3] ElastiCache for Redis replication groups should have automatic failover enabled

[ElastiCache.4] ElastiCache for Redis replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache for Redis replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.7] Password policies for IAM users should have strong configurations

[IAM.8] Unused IAM user credentials should be removed

[IAM.10] Password policies for IAM users should have strong Amazon Configurations

[IAM.11] Ensure IAM password policy requires at least one uppercase letter

[IAM.12] Ensure IAM password policy requires at least one lowercase letter

[IAM.13] Ensure IAM password policy requires at least one symbol

[IAM.14] Ensure IAM password policy requires at least one number

[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater

[IAM.16] Ensure IAM password policy prevents password reuse

[IAM.17] Ensure IAM password policy expires passwords within 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.3] RDS DB instances should have encryption at-rest enabled

[RDS.7] RDS clusters should have deletion protection enabled

[RDS.12] IAM authentication should be configured for RDS clusters

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.16] RDS DB clusters should be configured to copy tags to snapshots

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.28] RDS DB clusters should be tagged

[RDS.31] RDS DB security groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.14] S3 general purpose buckets should have versioning enabled

[S3.15] S3 general purpose buckets should have Object Lock enabled

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.1] SNS topics should be encrypted at-rest using Amazon KMS

[SNS.3] SNS topics should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[SSM.4] SSM documents should not be public

[StepFunctions.1] Step Functions state machines should have logging turned on

[StepFunctions.2] Step Functions activities should be tagged

[Transfer.1] Amazon Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[Account.2] Amazon Web Services accounts should be part of an Amazon Organizations organization

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have Amazon X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.4] Amazon Backup report plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudWatch.15] CloudWatch alarms should have specified actions configured

[CloudWatch.16] CloudWatch log groups should be retained for a specified time period

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.2] DynamoDB tables should have point-in-time recovery enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.1] Amazon EBS snapshots should not be publicly restorable

[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.7] EBS default encryption should be enabled

[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.9] Amazon EC2 instances should not have a public IPv4 address

[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses

[EC2.16] Unused Network Access Control Lists should be removed

[EC2.17] Amazon EC2 instances should not use multiple ENIs

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.20] Both VPN tunnels for an Amazon Site-to-Site VPN connection should be up

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.2] ECS services should not have public IP addresses assigned to them automatically

[ECS.3] ECS task definitions should not share the host's process namespace

[ECS.4] ECS containers should run as non-privileged

[ECS.8] Secrets should not be passed as container environment variables

[ECS.9] ECS task definitions should have a logging configuration

[ECS.10] ECS Fargate services should run on the latest Fargate platform version

[ECS.12] ECS clusters should use Container Insights

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination

[ELB.4] Application Load Balancer should be configured to drop http headers

[ELB.6] Application, Gateway, and Network Load Balancers should have deletion protection enabled

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong Amazon Configuration

[ELB.9] Classic Load Balancers should have cross-zone load balancing enabled

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[GuardDuty.1] GuardDuty should be enabled

[IAM.4] IAM root user access key should not exist

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[KMS.3] Amazon KMS keys should not be deleted unintentionally

[Lambda.1] Lambda function policies should prohibit public access

[Lambda.2] Lambda functions should use supported runtimes

[Lambda.3] Lambda functions should be in a VPC

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest

[RDS.6] Enhanced monitoring should be configured for RDS DB instances

[RDS.7] RDS clusters should have deletion protection enabled

[RDS.8] RDS DB instances should have deletion protection enabled

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.10] IAM authentication should be configured for RDS instances

[RDS.12] IAM authentication should be configured for RDS clusters

[RDS.13] RDS automatic minor version upgrades should be enabled

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.31] RDS DB security groups should be tagged

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.8] S3 general purpose buckets should block public access

[S3.15] S3 general purpose buckets should have Object Lock enabled

[S3.17] S3 general purpose buckets should be encrypted at rest with Amazon KMS keys

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SecretsManager.1] Secrets Manager secrets should have automatic rotation enabled

[SecretsManager.2] Secrets Manager secrets configured with automatic rotation should rotate successfully

[SecretsManager.3] Remove unused Secrets Manager secrets

[SecretsManager.4] Secrets Manager secrets should be rotated within a specified number of days

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.1] SNS topics should be encrypted at-rest using Amazon KMS

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] Amazon WAF web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[ACM.3] ACM certificates should be tagged

[Account.2] Amazon Web Services accounts should be part of an Amazon Organizations organization

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have Amazon X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[AppSync.4] Amazon AppSync GraphQL APIs should be tagged

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[AutoScaling.10] EC2 Auto Scaling groups should be tagged

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudTrail.9] CloudTrail trails should be tagged

[CloudWatch.15] CloudWatch alarms should have specified actions configured

[CloudWatch.16] CloudWatch log groups should be retained for a specified time period

[CodeArtifact.1]CodeArtifact repositories should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.5] DynamoDB tables should be tagged

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses

[EC2.16] Unused Network Access Control Lists should be removed

[EC2.20] Both VPN tunnels for an Amazon Site-to-Site VPN connection should be up

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.33] EC2 transit gateway attachments should be tagged

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.35] EC2 network interfaces should be tagged

[EC2.36] EC2 customer gateways should be tagged

[EC2.37] EC2 Elastic IP addresses should be tagged

[EC2.38] EC2 instances should be tagged

[EC2.39] EC2 internet gateways should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.41] EC2 network ACLs should be tagged

[EC2.42] EC2 route tables should be tagged

[EC2.43] EC2 security groups should be tagged

[EC2.44] EC2 subnets should be tagged

[EC2.45] EC2 volumes should be tagged

[EC2.46] Amazon VPCs should be tagged

[EC2.47] Amazon VPC endpoint services should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.49] Amazon VPC peering connections should be tagged

[EC2.50] EC2 VPN gateways should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports

[EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports

[ECR.1] ECR private repositories should have image scanning configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.13] ECS services should be tagged

[ECS.14] ECS clusters should be tagged

[ECS.15] ECS task definitions should be tagged

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EKS.6] EKS clusters should be tagged

[EKS.7] EKS identity provider configurations should be tagged

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.2] Amazon EMR block public access setting should be enabled

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[ES.9] Elasticsearch domains should be tagged

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.1] GuardDuty should be enabled

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.9] MFA should be enabled for the root user

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.23] IAM Access Analyzer analyzers should be tagged

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IAM.28] IAM Access Analyzer external access analyzer should be enabled

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.2] Kinesis streams should be tagged

[Lambda.6] Lambda functions should be tagged

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.7] Network Firewall firewalls should be tagged

[NetworkFirewall.8] Network Firewall firewall policies should be tagged

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[PCA.1] Amazon Private CA root certificate authority should be disabled

[RDS.7] RDS clusters should have deletion protection enabled

[RDS.10] IAM authentication should be configured for RDS instances

[RDS.12] IAM authentication should be configured for RDS clusters

[RDS.13] RDS automatic minor version upgrades should be enabled

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.16] RDS DB clusters should be configured to copy tags to snapshots

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.25] RDS database instances should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.28] RDS DB clusters should be tagged

[RDS.29] RDS DB cluster snapshots should be tagged

[RDS.30] RDS DB instances should be tagged

[RDS.31] RDS DB security groups should be tagged

[RDS.32] RDS DB snapshots should be tagged

[RDS.33] RDS DB subnet groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.11] Redshift clusters should be tagged

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.13] Redshift cluster snapshots should be tagged

[Redshift.14] Redshift cluster subnet groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.1] S3 general purpose buckets should have block public access settings enabled

[S3.8] S3 general purpose buckets should block public access

[S3.14] S3 general purpose buckets should have versioning enabled

[S3.22] S3 general purpose buckets should log object-level write events

[S3.23] S3 general purpose buckets should log object-level read events

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SecretsManager.3] Remove unused Secrets Manager secrets

[SecretsManager.4] Secrets Manager secrets should be rotated within a specified number of days

[SecretsManager.5] Secrets Manager secrets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.3] SNS topics should be tagged

[SQS.2] SQS queues should be tagged

[StepFunctions.2] Step Functions activities should be tagged

[Transfer.1] Amazon Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[ACM.3] ACM certificates should be tagged

[Account.2] Amazon Web Services accounts should be part of an Amazon Organizations organization

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have Amazon X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[AppSync.4] Amazon AppSync GraphQL APIs should be tagged

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[AutoScaling.10] EC2 Auto Scaling groups should be tagged

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudTrail.9] CloudTrail trails should be tagged

[CloudWatch.15] CloudWatch alarms should have specified actions configured

[CloudWatch.16] CloudWatch log groups should be retained for a specified time period

[CodeArtifact.1]CodeArtifact repositories should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.5] DynamoDB tables should be tagged

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses

[EC2.16] Unused Network Access Control Lists should be removed

[EC2.20] Both VPN tunnels for an Amazon Site-to-Site VPN connection should be up

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.33] EC2 transit gateway attachments should be tagged

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.35] EC2 network interfaces should be tagged

[EC2.36] EC2 customer gateways should be tagged

[EC2.37] EC2 Elastic IP addresses should be tagged

[EC2.38] EC2 instances should be tagged

[EC2.39] EC2 internet gateways should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.41] EC2 network ACLs should be tagged

[EC2.42] EC2 route tables should be tagged

[EC2.43] EC2 security groups should be tagged

[EC2.44] EC2 subnets should be tagged

[EC2.45] EC2 volumes should be tagged

[EC2.46] Amazon VPCs should be tagged

[EC2.47] Amazon VPC endpoint services should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.49] Amazon VPC peering connections should be tagged

[EC2.50] EC2 VPN gateways should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[ECR.1] ECR private repositories should have image scanning configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.13] ECS services should be tagged

[ECS.14] ECS clusters should be tagged

[ECS.15] ECS task definitions should be tagged

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EKS.6] EKS clusters should be tagged

[EKS.7] EKS identity provider configurations should be tagged

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.2] Amazon EMR block public access setting should be enabled

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[ES.9] Elasticsearch domains should be tagged

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.1] GuardDuty should be enabled

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.9] MFA should be enabled for the root user

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.23] IAM Access Analyzer analyzers should be tagged

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IAM.28] IAM Access Analyzer external access analyzer should be enabled

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.2] Kinesis streams should be tagged

[Lambda.1] Lambda function policies should prohibit public access

[Lambda.2] Lambda functions should use supported runtimes

[Lambda.3] Lambda functions should be in a VPC

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Lambda.6] Lambda functions should be tagged

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[Neptune.3] Neptune DB cluster snapshots should not be public

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.7] Network Firewall firewalls should be tagged

[NetworkFirewall.8] Network Firewall firewall policies should be tagged

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[PCA.1] Amazon Private CA root certificate authority should be disabled

[RDS.7] RDS clusters should have deletion protection enabled

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.10] IAM authentication should be configured for RDS instances

[RDS.12] IAM authentication should be configured for RDS clusters

[RDS.13] RDS automatic minor version upgrades should be enabled

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.25] RDS database instances should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.28] RDS DB clusters should be tagged

[RDS.29] RDS DB cluster snapshots should be tagged

[RDS.30] RDS DB instances should be tagged

[RDS.31] RDS DB security groups should be tagged

[RDS.32] RDS DB snapshots should be tagged

[RDS.33] RDS DB subnet groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.11] Redshift clusters should be tagged

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.13] Redshift cluster snapshots should be tagged

[Redshift.14] Redshift cluster subnet groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.1] S3 general purpose buckets should have block public access settings enabled

[S3.8] S3 general purpose buckets should block public access

[S3.14] S3 general purpose buckets should have versioning enabled

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SecretsManager.3] Remove unused Secrets Manager secrets

[SecretsManager.4] Secrets Manager secrets should be rotated within a specified number of days

[SecretsManager.5] Secrets Manager secrets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.3] SNS topics should be tagged

[SQS.2] SQS queues should be tagged

[StepFunctions.2] Step Functions activities should be tagged

[Transfer.1] Amazon Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[ECR.4] ECR public repositories should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[RDS.31] RDS DB security groups should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.1] Database Migration Service replication instances should not be public

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.12] Unused Amazon EC2 EIPs should be removed

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[ECS.12] ECS clusters should use Container Insights

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.4] Application Load Balancer should be configured to drop http headers

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong Amazon Configuration

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[GuardDuty.1] GuardDuty should be enabled

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[KMS.3] Amazon KMS keys should not be deleted unintentionally

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[Account.2] Amazon Web Services accounts should be part of an Amazon Organizations organization

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have Amazon X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CloudWatch.16] CloudWatch log groups should be retained for a specified time period

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.1] DynamoDB tables should automatically scale capacity with demand

[DynamoDB.2] DynamoDB tables should have point-in-time recovery enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.1] Amazon EBS snapshots should not be publicly restorable

[EC2.2] VPC default security groups should not allow inbound or outbound traffic

[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.6] VPC flow logging should be enabled in all VPCs

[EC2.7] EBS default encryption should be enabled

[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.9] Amazon EC2 instances should not have a public IPv4 address

[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses

[EC2.16] Unused Network Access Control Lists should be removed

[EC2.17] Amazon EC2 instances should not use multiple ENIs

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.20] Both VPN tunnels for an Amazon Site-to-Site VPN connection should be up

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.9] ECS task definitions should have a logging configuration

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination

[ELB.4] Application Load Balancer should be configured to drop http headers

[ELB.5] Application and Classic Load Balancers logging should be enabled

[ELB.6] Application, Gateway, and Network Load Balancers should have deletion protection enabled

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong Amazon Configuration

[ELB.9] Classic Load Balancers should have cross-zone load balancing enabled

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElastiCache.6] ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.1] GuardDuty should be enabled

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.4] IAM root user access key should not exist

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.8] Unused IAM user credentials should be removed

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[KMS.4] Amazon KMS key rotation should be enabled

[Lambda.1] Lambda function policies should prohibit public access

[Lambda.2] Lambda functions should use supported runtimes

[Lambda.3] Lambda functions should be in a VPC

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible Amazon Configuration

[RDS.3] RDS DB instances should have encryption at-rest enabled

[RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest

[RDS.5] RDS DB instances should be configured with multiple Availability Zones

[RDS.6] Enhanced monitoring should be configured for RDS DB instances

[RDS.7] RDS clusters should have deletion protection enabled

[RDS.8] RDS DB instances should have deletion protection enabled

[RDS.9] RDS DB instances should publish logs to CloudWatch Logs

[RDS.10] IAM authentication should be configured for RDS instances

[RDS.11] RDS instances should have automatic backups enabled

[RDS.12] IAM authentication should be configured for RDS clusters

[RDS.13] RDS automatic minor version upgrades should be enabled

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.16] RDS DB clusters should be configured to copy tags to snapshots

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.28] RDS DB clusters should be tagged

[RDS.31] RDS DB security groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.1] S3 general purpose buckets should have block public access settings enabled

[S3.5] S3 general purpose buckets should require requests to use SSL

[S3.6] S3 general purpose bucket policies should restrict access to other Amazon Web Services accounts

[S3.8] S3 general purpose buckets should block public access

[S3.9] S3 general purpose buckets should have server access logging enabled

[S3.15] S3 general purpose buckets should have Object Lock enabled

[S3.17] S3 general purpose buckets should be encrypted at rest with Amazon KMS keys

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SecretsManager.2] Secrets Manager secrets configured with automatic rotation should rotate successfully

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.1] SNS topics should be encrypted at-rest using Amazon KMS

[SNS.3] SNS topics should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SSM.1] Amazon EC2 instances should be managed by Amazon Systems Manager

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[StepFunctions.1] Step Functions state machines should have logging turned on

[Transfer.1] Amazon Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.2] Amazon WAF Classic Regional rules should have at least one condition

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.4] Amazon WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] Amazon WAF web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[ECR.4] ECR public repositories should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.1] DynamoDB tables should automatically scale capacity with demand

[DynamoDB.2] DynamoDB tables should have point-in-time recovery enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.2] VPC default security groups should not allow inbound or outbound traffic

[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.6] VPC flow logging should be enabled in all VPCs

[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.9] Amazon EC2 instances should not have a public IPv4 address

[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service

[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses

[EC2.16] Unused Network Access Control Lists should be removed

[EC2.17] Amazon EC2 instances should not use multiple ENIs

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.20] Both VPN tunnels for an Amazon Site-to-Site VPN connection should be up

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.

[ECS.9] ECS task definitions should have a logging configuration

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using Amazon KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with a public subnet

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by Amazon Certificate Manager

[ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination

[ELB.4] Application Load Balancer should be configured to drop http headers

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong Amazon Configuration

[ELB.9] Classic Load Balancers should have cross-zone load balancing enabled

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.16] Application Load Balancers should be associated with an Amazon WAF web ACL

[ElastiCache.1] ElastiCache Redis clusters should have automatic backup enabled

[ElastiCache.6] ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] Amazon Glue jobs should be tagged

[GuardDuty.1] GuardDuty should be enabled

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.4] IAM root user access key should not exist

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.8] Unused IAM user credentials should be removed

[IAM.18] Ensure a support role has been created to manage incidents with Amazon Web Services Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IoT.1] Amazon IoT Core security profiles should be tagged

[IoT.2] Amazon IoT Core mitigation actions should be tagged

[IoT.3] Amazon IoT Core dimensions should be tagged

[IoT.4] Amazon IoT Core authorizers should be tagged

[IoT.5] Amazon IoT Core role aliases should be tagged

[IoT.6] Amazon IoT Core policies should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.3] RDS DB instances should have encryption at-rest enabled

[RDS.5] RDS DB instances should be configured with multiple Availability Zones

[RDS.8] RDS DB instances should have deletion protection enabled

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.16] RDS DB clusters should be configured to copy tags to snapshots

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.31] RDS DB security groups should be tagged

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.1] S3 general purpose buckets should have block public access settings enabled

[S3.8] S3 general purpose buckets should block public access

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SecretsManager.2] Secrets Manager secrets configured with automatic rotation should rotate successfully

[ServiceCatalog.1] Service Catalog portfolios should be shared within an Amazon organization only

[SNS.1] SNS topics should be encrypted at-rest using Amazon KMS

[SNS.3] SNS topics should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[StepFunctions.1] Step Functions state machines should have logging turned on

[Transfer.1] Amazon Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[WAF.1] Amazon WAF Classic Global Web ACL logging should be enabled

[WAF.2] Amazon WAF Classic Regional rules should have at least one condition

[WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule

[WAF.4] Amazon WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] Amazon WAF Classic global rules should have at least one condition

[WAF.7] Amazon WAF Classic global rule groups should have at least one rule

[WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] Amazon WAF web ACLs should have at least one rule or rule group

[WAF.11] Amazon WAF web ACL logging should be enabled

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[AppSync.2] Amazon AppSync should have field-level logging enabled

[AppSync.4] Amazon AppSync GraphQL APIs should be tagged

[AppSync.5] Amazon AppSync GraphQL APIs should not be authenticated with API keys

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] Amazon Backup recovery points should be encrypted at rest

[Backup.2] Amazon Backup recovery points should be tagged

[Backup.3] Amazon Backup vaults should be tagged

[Backup.4] Amazon Backup report plans should be tagged

[Backup.5] Amazon Backup backup plans should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging Amazon Configuration

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.6] VPC flow logging should be enabled in all VPCs