ManagedRuleIdentifiers Class

Managed rules that are supported by AWS Config.

Source: aws-config/lib/rule.ts
Type last changed: v2.67.0 · 2 Mar 2023

Example

declare const fn: lambda.Function;
declare const samplePolicyText: string;

new config.ManagedRule(this, 'ManagedRule', {
  identifier: config.ManagedRuleIdentifiers.API_GW_XRAY_ENABLED,
  evaluationModes: config.EvaluationMode.DETECTIVE_AND_PROACTIVE,
});

new config.CustomRule(this, 'CustomRule', {
  lambdaFunction: fn,
  evaluationModes: config.EvaluationMode.PROACTIVE,
});

new config.CustomPolicy(this, 'CustomPolicy', {
  policyText: samplePolicyText,
  evaluationModes: config.EvaluationMode.DETECTIVE,
});

python

# fn: lambda.Function
# sample_policy_text: str


config.ManagedRule(self, "ManagedRule",
    identifier=config.ManagedRuleIdentifiers.API_GW_XRAY_ENABLED,
    evaluation_modes=config.EvaluationMode.DETECTIVE_AND_PROACTIVE
)

config.CustomRule(self, "CustomRule",
    lambda_function=fn,
    evaluation_modes=config.EvaluationMode.PROACTIVE
)

config.CustomPolicy(self, "CustomPolicy",
    policy_text=sample_policy_text,
    evaluation_modes=config.EvaluationMode.DETECTIVE
)

java

Function fn;
String samplePolicyText;


ManagedRule.Builder.create(this, "ManagedRule")
        .identifier(ManagedRuleIdentifiers.API_GW_XRAY_ENABLED)
        .evaluationModes(EvaluationMode.DETECTIVE_AND_PROACTIVE)
        .build();

CustomRule.Builder.create(this, "CustomRule")
        .lambdaFunction(fn)
        .evaluationModes(EvaluationMode.PROACTIVE)
        .build();

CustomPolicy.Builder.create(this, "CustomPolicy")
        .policyText(samplePolicyText)
        .evaluationModes(EvaluationMode.DETECTIVE)
        .build();

csharp

// Install: dotnet add package Amazon.CDK.Lib
Function fn;
string samplePolicyText;


new ManagedRule(this, "ManagedRule", new ManagedRuleProps {
    Identifier = ManagedRuleIdentifiers.API_GW_XRAY_ENABLED,
    EvaluationModes = EvaluationMode.DETECTIVE_AND_PROACTIVE
});

new CustomRule(this, "CustomRule", new CustomRuleProps {
    LambdaFunction = fn,
    EvaluationModes = EvaluationMode.PROACTIVE
});

new CustomPolicy(this, "CustomPolicy", new CustomPolicyProps {
    PolicyText = samplePolicyText,
    EvaluationModes = EvaluationMode.DETECTIVE
});

// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var fn Function
var samplePolicyText string


config.NewManagedRule(this, jsii.String("ManagedRule"), &ManagedRuleProps{
	Identifier: config.ManagedRuleIdentifiers_API_GW_XRAY_ENABLED(),
	EvaluationModes: config.EvaluationMode_DETECTIVE_AND_PROACTIVE(),
})

config.NewCustomRule(this, jsii.String("CustomRule"), &CustomRuleProps{
	LambdaFunction: fn,
	EvaluationModes: config.EvaluationMode_PROACTIVE(),
})

config.NewCustomPolicy(this, jsii.String("CustomPolicy"), &CustomPolicyProps{
	PolicyText: samplePolicyText,
	EvaluationModes: config.EvaluationMode_DETECTIVE(),
})

Properties

ACCESS_KEYS_ROTATEDstringaccess_keys_rotatedstrACCESS_KEYS_ROTATEDStringACCESS_KEYS_ROTATEDstringACCESS_KEYS_ROTATED*stringstatic#

Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge.

ACCOUNT_PART_OF_ORGANIZATIONSstringaccount_part_of_organizationsstrACCOUNT_PART_OF_ORGANIZATIONSStringACCOUNT_PART_OF_ORGANIZATIONSstringACCOUNT_PART_OF_ORGANIZATIONS*stringstatic#

Checks whether AWS account is part of AWS Organizations.

ACM_CERTIFICATE_EXPIRATION_CHECKstringacm_certificate_expiration_checkstrACM_CERTIFICATE_EXPIRATION_CHECKStringACM_CERTIFICATE_EXPIRATION_CHECKstringACM_CERTIFICATE_EXPIRATION_CHECK*stringstatic#

Checks whether ACM Certificates in your account are marked for expiration within the specified number of days.

ALB_DESYNC_MODE_CHECKstringalb_desync_mode_checkstrALB_DESYNC_MODE_CHECKStringALB_DESYNC_MODE_CHECKstringALB_DESYNC_MODE_CHECK*stringstatic#

Checks if an Application Load Balancer (ALB) is configured with a user defined desync mitigation mode.

ALB_HTTP_DROP_INVALID_HEADER_ENABLEDstringalb_http_drop_invalid_header_enabledstrALB_HTTP_DROP_INVALID_HEADER_ENABLEDStringALB_HTTP_DROP_INVALID_HEADER_ENABLEDstringALB_HTTP_DROP_INVALID_HEADER_ENABLED*stringstatic#

Checks if rule evaluates Application Load Balancers (ALBs) to ensure they are configured to drop http headers.

ALB_HTTP_TO_HTTPS_REDIRECTION_CHECKstringalb_http_to_https_redirection_checkstrALB_HTTP_TO_HTTPS_REDIRECTION_CHECKStringALB_HTTP_TO_HTTPS_REDIRECTION_CHECKstringALB_HTTP_TO_HTTPS_REDIRECTION_CHECK*stringstatic#

Checks whether HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancer.

ALB_WAF_ENABLEDstringalb_waf_enabledstrALB_WAF_ENABLEDStringALB_WAF_ENABLEDstringALB_WAF_ENABLED*stringstatic#

Checks if Web Application Firewall (WAF) is enabled on Application Load Balancers (ALBs).

API_GW_ASSOCIATED_WITH_WAFstringapi_gw_associated_with_wafstrAPI_GW_ASSOCIATED_WITH_WAFStringAPI_GW_ASSOCIATED_WITH_WAFstringAPI_GW_ASSOCIATED_WITH_WAF*stringstatic#

Checks if an Amazon API Gateway API stage is using an AWS WAF Web ACL.

API_GW_CACHE_ENABLED_AND_ENCRYPTEDstringapi_gw_cache_enabled_and_encryptedstrAPI_GW_CACHE_ENABLED_AND_ENCRYPTEDStringAPI_GW_CACHE_ENABLED_AND_ENCRYPTEDstringAPI_GW_CACHE_ENABLED_AND_ENCRYPTED*stringstatic#

Checks that all methods in Amazon API Gateway stages have caching enabled and encrypted.

API_GW_ENDPOINT_TYPE_CHECKstringapi_gw_endpoint_type_checkstrAPI_GW_ENDPOINT_TYPE_CHECKStringAPI_GW_ENDPOINT_TYPE_CHECKstringAPI_GW_ENDPOINT_TYPE_CHECK*stringstatic#

Checks that Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType.

API_GW_EXECUTION_LOGGING_ENABLEDstringapi_gw_execution_logging_enabledstrAPI_GW_EXECUTION_LOGGING_ENABLEDStringAPI_GW_EXECUTION_LOGGING_ENABLEDstringAPI_GW_EXECUTION_LOGGING_ENABLED*stringstatic#

Checks that all methods in Amazon API Gateway stage has logging enabled.

API_GW_SSL_ENABLEDstringapi_gw_ssl_enabledstrAPI_GW_SSL_ENABLEDStringAPI_GW_SSL_ENABLEDstringAPI_GW_SSL_ENABLED*stringstatic#

Checks if a REST API stage uses an Secure Sockets Layer (SSL) certificate.

API_GW_XRAY_ENABLEDstringapi_gw_xray_enabledstrAPI_GW_XRAY_ENABLEDStringAPI_GW_XRAY_ENABLEDstringAPI_GW_XRAY_ENABLED*stringstatic#

Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs.

API_GWV2_ACCESS_LOGS_ENABLEDstringapi_gwv2_access_logs_enabledstrAPI_GWV2_ACCESS_LOGS_ENABLEDStringAPI_GWV2_ACCESS_LOGS_ENABLEDstringAPI_GWV2_ACCESS_LOGS_ENABLED*stringstatic#

Checks if Amazon API Gateway V2 stages have access logging enabled.

API_GWV2_AUTHORIZATION_TYPE_CONFIGUREDstringapi_gwv2_authorization_type_configuredstrAPI_GWV2_AUTHORIZATION_TYPE_CONFIGUREDStringAPI_GWV2_AUTHORIZATION_TYPE_CONFIGUREDstringAPI_GWV2_AUTHORIZATION_TYPE_CONFIGURED*stringstatic#

Checks if Amazon API Gatewayv2 API routes have an authorization type set.

APPROVED_AMIS_BY_IDstringapproved_amis_by_idstrAPPROVED_AMIS_BY_IDStringAPPROVED_AMIS_BY_IDstringAPPROVED_AMIS_BY_ID*stringstatic#

Checks whether running instances are using specified AMIs.

APPROVED_AMIS_BY_TAGstringapproved_amis_by_tagstrAPPROVED_AMIS_BY_TAGStringAPPROVED_AMIS_BY_TAGstringAPPROVED_AMIS_BY_TAG*stringstatic#

Checks whether running instances are using specified AMIs.

AURORA_LAST_BACKUP_RECOVERY_POINT_CREATEDstringaurora_last_backup_recovery_point_createdstrAURORA_LAST_BACKUP_RECOVERY_POINT_CREATEDStringAURORA_LAST_BACKUP_RECOVERY_POINT_CREATEDstringAURORA_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon Aurora DB clusters.

AURORA_MYSQL_BACKTRACKING_ENABLEDstringaurora_mysql_backtracking_enabledstrAURORA_MYSQL_BACKTRACKING_ENABLEDStringAURORA_MYSQL_BACKTRACKING_ENABLEDstringAURORA_MYSQL_BACKTRACKING_ENABLED*stringstatic#

Checks if an Amazon Aurora MySQL cluster has backtracking enabled.

AURORA_RESOURCES_PROTECTED_BY_BACKUP_PLANstringaurora_resources_protected_by_backup_planstrAURORA_RESOURCES_PROTECTED_BY_BACKUP_PLANStringAURORA_RESOURCES_PROTECTED_BY_BACKUP_PLANstringAURORA_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon Aurora DB clusters are protected by a backup plan.

AUTOSCALING_CAPACITY_REBALANCINGstringautoscaling_capacity_rebalancingstrAUTOSCALING_CAPACITY_REBALANCINGStringAUTOSCALING_CAPACITY_REBALANCINGstringAUTOSCALING_CAPACITY_REBALANCING*stringstatic#

Checks if Capacity Rebalancing is enabled for Amazon EC2 Auto Scaling groups that use multiple instance types.

AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIREDstringautoscaling_group_elb_healthcheck_requiredstrAUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIREDStringAUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIREDstringAUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED*stringstatic#

Checks whether your Auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.

AUTOSCALING_LAUNCH_CONFIG_HOP_LIMITstringautoscaling_launch_config_hop_limitstrAUTOSCALING_LAUNCH_CONFIG_HOP_LIMITStringAUTOSCALING_LAUNCH_CONFIG_HOP_LIMITstringAUTOSCALING_LAUNCH_CONFIG_HOP_LIMIT*stringstatic#

Checks the number of network hops that the metadata token can travel.

AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLEDstringautoscaling_launch_config_public_ip_disabledstrAUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLEDStringAUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLEDstringAUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED*stringstatic#

Checks if Amazon EC2 Auto Scaling groups have public IP addresses enabled through Launch Configurations.

AUTOSCALING_LAUNCH_TEMPLATEstringautoscaling_launch_templatestrAUTOSCALING_LAUNCH_TEMPLATEStringAUTOSCALING_LAUNCH_TEMPLATEstringAUTOSCALING_LAUNCH_TEMPLATE*stringstatic#

Checks if an Amazon Elastic Compute Cloud (EC2) Auto Scaling group is created from an EC2 launch template.

AUTOSCALING_LAUNCHCONFIG_REQUIRES_IMDSV2stringautoscaling_launchconfig_requires_imdsv2strAUTOSCALING_LAUNCHCONFIG_REQUIRES_IMDSV2StringAUTOSCALING_LAUNCHCONFIG_REQUIRES_IMDSV2stringAUTOSCALING_LAUNCHCONFIG_REQUIRES_IMDSV2*stringstatic#

Checks whether only IMDSv2 is enabled.

AUTOSCALING_MULTIPLE_AZstringautoscaling_multiple_azstrAUTOSCALING_MULTIPLE_AZStringAUTOSCALING_MULTIPLE_AZstringAUTOSCALING_MULTIPLE_AZ*stringstatic#

Checks if the Auto Scaling group spans multiple Availability Zones.

AUTOSCALING_MULTIPLE_INSTANCE_TYPESstringautoscaling_multiple_instance_typesstrAUTOSCALING_MULTIPLE_INSTANCE_TYPESStringAUTOSCALING_MULTIPLE_INSTANCE_TYPESstringAUTOSCALING_MULTIPLE_INSTANCE_TYPES*stringstatic#

Checks if an Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling group uses multiple instance types.

BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECKstringbackup_plan_min_frequency_and_min_retention_checkstrBACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECKStringBACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECKstringBACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK*stringstatic#

Checks if a backup plan has a backup rule that satisfies the required frequency and retention period.

BACKUP_RECOVERY_POINT_ENCRYPTEDstringbackup_recovery_point_encryptedstrBACKUP_RECOVERY_POINT_ENCRYPTEDStringBACKUP_RECOVERY_POINT_ENCRYPTEDstringBACKUP_RECOVERY_POINT_ENCRYPTED*stringstatic#

Checks if a recovery point is encrypted.

BACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLEDstringbackup_recovery_point_manual_deletion_disabledstrBACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLEDStringBACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLEDstringBACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLED*stringstatic#

Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points.

BACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECKstringbackup_recovery_point_minimum_retention_checkstrBACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECKStringBACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECKstringBACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECK*stringstatic#

Checks if a recovery point expires no earlier than after the specified period.

BEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLEDstringbeanstalk_enhanced_health_reporting_enabledstrBEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLEDStringBEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLEDstringBEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLED*stringstatic#

Checks if an AWS Elastic Beanstalk environment is configured for enhanced health reporting.

CLB_DESYNC_MODE_CHECKstringclb_desync_mode_checkstrCLB_DESYNC_MODE_CHECKStringCLB_DESYNC_MODE_CHECKstringCLB_DESYNC_MODE_CHECK*stringstatic#

Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode.

CLB_MULTIPLE_AZstringclb_multiple_azstrCLB_MULTIPLE_AZStringCLB_MULTIPLE_AZstringCLB_MULTIPLE_AZ*stringstatic#

Checks if a Classic Load Balancer spans multiple Availability Zones (AZs).

CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLEDstringcloud_trail_cloud_watch_logs_enabledstrCLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLEDStringCLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLEDstringCLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED*stringstatic#

Checks whether AWS CloudTrail trails are configured to send logs to Amazon CloudWatch Logs.

CLOUD_TRAIL_ENABLEDstringcloud_trail_enabledstrCLOUD_TRAIL_ENABLEDStringCLOUD_TRAIL_ENABLEDstringCLOUD_TRAIL_ENABLED*stringstatic#

Checks whether AWS CloudTrail is enabled in your AWS account.

CLOUD_TRAIL_ENCRYPTION_ENABLEDstringcloud_trail_encryption_enabledstrCLOUD_TRAIL_ENCRYPTION_ENABLEDStringCLOUD_TRAIL_ENCRYPTION_ENABLEDstringCLOUD_TRAIL_ENCRYPTION_ENABLED*stringstatic#

Checks whether AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) customer master key (CMK) encryption.

CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLEDstringcloud_trail_log_file_validation_enabledstrCLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLEDStringCLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLEDstringCLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED*stringstatic#

Checks whether AWS CloudTrail creates a signed digest file with logs.

CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECKstringcloudformation_stack_drift_detection_checkstrCLOUDFORMATION_STACK_DRIFT_DETECTION_CHECKStringCLOUDFORMATION_STACK_DRIFT_DETECTION_CHECKstringCLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK*stringstatic#

Checks whether an AWS CloudFormation stack's actual configuration differs, or has drifted, from its expected configuration.

CLOUDFORMATION_STACK_NOTIFICATION_CHECKstringcloudformation_stack_notification_checkstrCLOUDFORMATION_STACK_NOTIFICATION_CHECKStringCLOUDFORMATION_STACK_NOTIFICATION_CHECKstringCLOUDFORMATION_STACK_NOTIFICATION_CHECK*stringstatic#

Checks whether your CloudFormation stacks are sending event notifications to an SNS topic.

CLOUDFRONT_ACCESSLOGS_ENABLEDstringcloudfront_accesslogs_enabledstrCLOUDFRONT_ACCESSLOGS_ENABLEDStringCLOUDFRONT_ACCESSLOGS_ENABLEDstringCLOUDFRONT_ACCESSLOGS_ENABLED*stringstatic#

Checks if Amazon CloudFront distributions are configured to capture information from Amazon Simple Storage Service (Amazon S3) server access logs.

CLOUDFRONT_ASSOCIATED_WITH_WAFstringcloudfront_associated_with_wafstrCLOUDFRONT_ASSOCIATED_WITH_WAFStringCLOUDFRONT_ASSOCIATED_WITH_WAFstringCLOUDFRONT_ASSOCIATED_WITH_WAF*stringstatic#

Checks if Amazon CloudFront distributions are associated with either WAF or WAFv2 web access control lists (ACLs).

CLOUDFRONT_CUSTOM_SSL_CERTIFICATEstringcloudfront_custom_ssl_certificatestrCLOUDFRONT_CUSTOM_SSL_CERTIFICATEStringCLOUDFRONT_CUSTOM_SSL_CERTIFICATEstringCLOUDFRONT_CUSTOM_SSL_CERTIFICATE*stringstatic#

Checks if the certificate associated with an Amazon CloudFront distribution is the default Secure Sockets Layer (SSL) certificate.

CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGUREDstringcloudfront_default_root_object_configuredstrCLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGUREDStringCLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGUREDstringCLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED*stringstatic#

Checks if an Amazon CloudFront distribution is configured to return a specific object that is the default root object.

CLOUDFRONT_NO_DEPRECATED_SSL_PROTOCOLSstringcloudfront_no_deprecated_ssl_protocolsstrCLOUDFRONT_NO_DEPRECATED_SSL_PROTOCOLSStringCLOUDFRONT_NO_DEPRECATED_SSL_PROTOCOLSstringCLOUDFRONT_NO_DEPRECATED_SSL_PROTOCOLS*stringstatic#

Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins.

CLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLEDstringcloudfront_origin_access_identity_enabledstrCLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLEDStringCLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLEDstringCLOUDFRONT_ORIGIN_ACCESS_IDENTITY_ENABLED*stringstatic#

Checks that Amazon CloudFront distribution with Amazon S3 Origin type has Origin Access Identity (OAI) configured.

CLOUDFRONT_ORIGIN_FAILOVER_ENABLEDstringcloudfront_origin_failover_enabledstrCLOUDFRONT_ORIGIN_FAILOVER_ENABLEDStringCLOUDFRONT_ORIGIN_FAILOVER_ENABLEDstringCLOUDFRONT_ORIGIN_FAILOVER_ENABLED*stringstatic#

Checks whether an origin group is configured for the distribution of at least 2 origins in the origin group for Amazon CloudFront.

CLOUDFRONT_SECURITY_POLICY_CHECKstringcloudfront_security_policy_checkstrCLOUDFRONT_SECURITY_POLICY_CHECKStringCLOUDFRONT_SECURITY_POLICY_CHECKstringCLOUDFRONT_SECURITY_POLICY_CHECK*stringstatic#

Checks if Amazon CloudFront distributions are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections.

CLOUDFRONT_SNI_ENABLEDstringcloudfront_sni_enabledstrCLOUDFRONT_SNI_ENABLEDStringCLOUDFRONT_SNI_ENABLEDstringCLOUDFRONT_SNI_ENABLED*stringstatic#

Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests.

CLOUDFRONT_TRAFFIC_TO_ORIGIN_ENCRYPTEDstringcloudfront_traffic_to_origin_encryptedstrCLOUDFRONT_TRAFFIC_TO_ORIGIN_ENCRYPTEDStringCLOUDFRONT_TRAFFIC_TO_ORIGIN_ENCRYPTEDstringCLOUDFRONT_TRAFFIC_TO_ORIGIN_ENCRYPTED*stringstatic#

Checks if Amazon CloudFront distributions are encrypting traffic to custom origins.

CLOUDFRONT_VIEWER_POLICY_HTTPSstringcloudfront_viewer_policy_httpsstrCLOUDFRONT_VIEWER_POLICY_HTTPSStringCLOUDFRONT_VIEWER_POLICY_HTTPSstringCLOUDFRONT_VIEWER_POLICY_HTTPS*stringstatic#

Checks whether your Amazon CloudFront distributions use HTTPS (directly or via a redirection).

CLOUDTRAIL_MULTI_REGION_ENABLEDstringcloudtrail_multi_region_enabledstrCLOUDTRAIL_MULTI_REGION_ENABLEDStringCLOUDTRAIL_MULTI_REGION_ENABLEDstringCLOUDTRAIL_MULTI_REGION_ENABLED*stringstatic#

Checks that there is at least one multi-region AWS CloudTrail.

CLOUDTRAIL_S3_DATAEVENTS_ENABLEDstringcloudtrail_s3_dataevents_enabledstrCLOUDTRAIL_S3_DATAEVENTS_ENABLEDStringCLOUDTRAIL_S3_DATAEVENTS_ENABLEDstringCLOUDTRAIL_S3_DATAEVENTS_ENABLED*stringstatic#

Checks whether at least one AWS CloudTrail trail is logging Amazon S3 data events for all S3 buckets.

CLOUDTRAIL_SECURITY_TRAIL_ENABLEDstringcloudtrail_security_trail_enabledstrCLOUDTRAIL_SECURITY_TRAIL_ENABLEDStringCLOUDTRAIL_SECURITY_TRAIL_ENABLEDstringCLOUDTRAIL_SECURITY_TRAIL_ENABLED*stringstatic#

Checks that there is at least one AWS CloudTrail trail defined with security best practices.

CLOUDWATCH_ALARM_ACTION_CHECKstringcloudwatch_alarm_action_checkstrCLOUDWATCH_ALARM_ACTION_CHECKStringCLOUDWATCH_ALARM_ACTION_CHECKstringCLOUDWATCH_ALARM_ACTION_CHECK*stringstatic#

Checks whether CloudWatch alarms have at least one alarm action, one INSUFFICIENT_DATA action, or one OK action enabled.

CLOUDWATCH_ALARM_ACTION_ENABLED_CHECKstringcloudwatch_alarm_action_enabled_checkstrCLOUDWATCH_ALARM_ACTION_ENABLED_CHECKStringCLOUDWATCH_ALARM_ACTION_ENABLED_CHECKstringCLOUDWATCH_ALARM_ACTION_ENABLED_CHECK*stringstatic#

Checks if Amazon CloudWatch alarms actions are in enabled state.

CLOUDWATCH_ALARM_RESOURCE_CHECKstringcloudwatch_alarm_resource_checkstrCLOUDWATCH_ALARM_RESOURCE_CHECKStringCLOUDWATCH_ALARM_RESOURCE_CHECKstringCLOUDWATCH_ALARM_RESOURCE_CHECK*stringstatic#

Checks whether the specified resource type has a CloudWatch alarm for the specified metric.

CLOUDWATCH_ALARM_SETTINGS_CHECKstringcloudwatch_alarm_settings_checkstrCLOUDWATCH_ALARM_SETTINGS_CHECKStringCLOUDWATCH_ALARM_SETTINGS_CHECKstringCLOUDWATCH_ALARM_SETTINGS_CHECK*stringstatic#

Checks whether CloudWatch alarms with the given metric name have the specified settings.

CLOUDWATCH_LOG_GROUP_ENCRYPTEDstringcloudwatch_log_group_encryptedstrCLOUDWATCH_LOG_GROUP_ENCRYPTEDStringCLOUDWATCH_LOG_GROUP_ENCRYPTEDstringCLOUDWATCH_LOG_GROUP_ENCRYPTED*stringstatic#

Checks whether a log group in Amazon CloudWatch Logs is encrypted with a AWS Key Management Service (KMS) managed Customer Master Keys (CMK).

CMK_BACKING_KEY_ROTATION_ENABLEDstringcmk_backing_key_rotation_enabledstrCMK_BACKING_KEY_ROTATION_ENABLEDStringCMK_BACKING_KEY_ROTATION_ENABLEDstringCMK_BACKING_KEY_ROTATION_ENABLED*stringstatic#

Checks that key rotation is enabled for each key and matches to the key ID of the customer created customer master key (CMK).

CODEBUILD_PROJECT_ARTIFACT_ENCRYPTIONstringcodebuild_project_artifact_encryptionstrCODEBUILD_PROJECT_ARTIFACT_ENCRYPTIONStringCODEBUILD_PROJECT_ARTIFACT_ENCRYPTIONstringCODEBUILD_PROJECT_ARTIFACT_ENCRYPTION*stringstatic#

Checks if an AWS CodeBuild project has encryption enabled for all of its artifacts.

CODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECKstringcodebuild_project_environment_privileged_checkstrCODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECKStringCODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECKstringCODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECK*stringstatic#

Checks if an AWS CodeBuild project environment has privileged mode enabled.

CODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECKstringcodebuild_project_envvar_awscred_checkstrCODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECKStringCODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECKstringCODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECK*stringstatic#

Checks whether the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

CODEBUILD_PROJECT_LOGGING_ENABLEDstringcodebuild_project_logging_enabledstrCODEBUILD_PROJECT_LOGGING_ENABLEDStringCODEBUILD_PROJECT_LOGGING_ENABLEDstringCODEBUILD_PROJECT_LOGGING_ENABLED*stringstatic#

Checks if an AWS CodeBuild project environment has at least one log option enabled.

CODEBUILD_PROJECT_S3_LOGS_ENCRYPTEDstringcodebuild_project_s3_logs_encryptedstrCODEBUILD_PROJECT_S3_LOGS_ENCRYPTEDStringCODEBUILD_PROJECT_S3_LOGS_ENCRYPTEDstringCODEBUILD_PROJECT_S3_LOGS_ENCRYPTED*stringstatic#

Checks if a AWS CodeBuild project configured with Amazon S3 Logs has encryption enabled for its logs.

CODEBUILD_PROJECT_SOURCE_REPO_URL_CHECKstringcodebuild_project_source_repo_url_checkstrCODEBUILD_PROJECT_SOURCE_REPO_URL_CHECKStringCODEBUILD_PROJECT_SOURCE_REPO_URL_CHECKstringCODEBUILD_PROJECT_SOURCE_REPO_URL_CHECK*stringstatic#

Checks whether the GitHub or Bitbucket source repository URL contains either personal access tokens or user name and password.

CODEDEPLOY_AUTO_ROLLBACK_MONITOR_ENABLEDstringcodedeploy_auto_rollback_monitor_enabledstrCODEDEPLOY_AUTO_ROLLBACK_MONITOR_ENABLEDStringCODEDEPLOY_AUTO_ROLLBACK_MONITOR_ENABLEDstringCODEDEPLOY_AUTO_ROLLBACK_MONITOR_ENABLED*stringstatic#

Checks if the deployment group is configured with automatic deployment rollback and deployment monitoring with alarms attached.

CODEDEPLOY_EC2_MINIMUM_HEALTHY_HOSTS_CONFIGUREDstringcodedeploy_ec2_minimum_healthy_hosts_configuredstrCODEDEPLOY_EC2_MINIMUM_HEALTHY_HOSTS_CONFIGUREDStringCODEDEPLOY_EC2_MINIMUM_HEALTHY_HOSTS_CONFIGUREDstringCODEDEPLOY_EC2_MINIMUM_HEALTHY_HOSTS_CONFIGURED*stringstatic#

Checks if the deployment group for EC2/On-Premises Compute Platform is configured with a minimum healthy hosts fleet percentage or host count greater than or equal to the input threshold.

CODEDEPLOY_LAMBDA_ALLATONCE_TRAFFIC_SHIFT_DISABLEDstringcodedeploy_lambda_allatonce_traffic_shift_disabledstrCODEDEPLOY_LAMBDA_ALLATONCE_TRAFFIC_SHIFT_DISABLEDStringCODEDEPLOY_LAMBDA_ALLATONCE_TRAFFIC_SHIFT_DISABLEDstringCODEDEPLOY_LAMBDA_ALLATONCE_TRAFFIC_SHIFT_DISABLED*stringstatic#

Checks if the deployment group for Lambda Compute Platform is not using the default deployment configuration.

CODEPIPELINE_DEPLOYMENT_COUNT_CHECKstringcodepipeline_deployment_count_checkstrCODEPIPELINE_DEPLOYMENT_COUNT_CHECKStringCODEPIPELINE_DEPLOYMENT_COUNT_CHECKstringCODEPIPELINE_DEPLOYMENT_COUNT_CHECK*stringstatic#

Checks whether the first deployment stage of the AWS CodePipeline performs more than one deployment.

CODEPIPELINE_REGION_FANOUT_CHECKstringcodepipeline_region_fanout_checkstrCODEPIPELINE_REGION_FANOUT_CHECKStringCODEPIPELINE_REGION_FANOUT_CHECKstringCODEPIPELINE_REGION_FANOUT_CHECK*stringstatic#

Checks whether each stage in the AWS CodePipeline deploys to more than N times the number of the regions the AWS CodePipeline has deployed in all the previous combined stages, where N is the region fanout number.

CW_LOGGROUP_RETENTION_PERIOD_CHECKstringcw_loggroup_retention_period_checkstrCW_LOGGROUP_RETENTION_PERIOD_CHECKStringCW_LOGGROUP_RETENTION_PERIOD_CHECKstringCW_LOGGROUP_RETENTION_PERIOD_CHECK*stringstatic#

Checks whether Amazon CloudWatch LogGroup retention period is set to specific number of days.

DAX_ENCRYPTION_ENABLEDstringdax_encryption_enabledstrDAX_ENCRYPTION_ENABLEDStringDAX_ENCRYPTION_ENABLEDstringDAX_ENCRYPTION_ENABLED*stringstatic#

Checks that DynamoDB Accelerator (DAX) clusters are encrypted.

DMS_REPLICATION_NOT_PUBLICstringdms_replication_not_publicstrDMS_REPLICATION_NOT_PUBLICStringDMS_REPLICATION_NOT_PUBLICstringDMS_REPLICATION_NOT_PUBLIC*stringstatic#

Checks whether AWS Database Migration Service replication instances are public.

DYNAMODB_AUTOSCALING_ENABLEDstringdynamodb_autoscaling_enabledstrDYNAMODB_AUTOSCALING_ENABLEDStringDYNAMODB_AUTOSCALING_ENABLEDstringDYNAMODB_AUTOSCALING_ENABLED*stringstatic#

Checks whether Auto Scaling or On-Demand is enabled on your DynamoDB tables and/or global secondary indexes.

DYNAMODB_IN_BACKUP_PLANstringdynamodb_in_backup_planstrDYNAMODB_IN_BACKUP_PLANStringDYNAMODB_IN_BACKUP_PLANstringDYNAMODB_IN_BACKUP_PLAN*stringstatic#

Checks whether Amazon DynamoDB table is present in AWS Backup plans.

DYNAMODB_LAST_BACKUP_RECOVERY_POINT_CREATEDstringdynamodb_last_backup_recovery_point_createdstrDYNAMODB_LAST_BACKUP_RECOVERY_POINT_CREATEDStringDYNAMODB_LAST_BACKUP_RECOVERY_POINT_CREATEDstringDYNAMODB_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon DynamoDB Tables within the specified period.

DYNAMODB_PITR_ENABLEDstringdynamodb_pitr_enabledstrDYNAMODB_PITR_ENABLEDStringDYNAMODB_PITR_ENABLEDstringDYNAMODB_PITR_ENABLED*stringstatic#

Checks that point in time recovery (PITR) is enabled for Amazon DynamoDB tables.

DYNAMODB_RESOURCES_PROTECTED_BY_BACKUP_PLANstringdynamodb_resources_protected_by_backup_planstrDYNAMODB_RESOURCES_PROTECTED_BY_BACKUP_PLANStringDYNAMODB_RESOURCES_PROTECTED_BY_BACKUP_PLANstringDYNAMODB_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon DynamoDB tables are protected by a backup plan.

DYNAMODB_TABLE_ENCRYPTED_KMSstringdynamodb_table_encrypted_kmsstrDYNAMODB_TABLE_ENCRYPTED_KMSStringDYNAMODB_TABLE_ENCRYPTED_KMSstringDYNAMODB_TABLE_ENCRYPTED_KMS*stringstatic#

Checks whether Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS).

DYNAMODB_TABLE_ENCRYPTION_ENABLEDstringdynamodb_table_encryption_enabledstrDYNAMODB_TABLE_ENCRYPTION_ENABLEDStringDYNAMODB_TABLE_ENCRYPTION_ENABLEDstringDYNAMODB_TABLE_ENCRYPTION_ENABLED*stringstatic#

Checks whether the Amazon DynamoDB tables are encrypted and checks their status.

DYNAMODB_THROUGHPUT_LIMIT_CHECKstringdynamodb_throughput_limit_checkstrDYNAMODB_THROUGHPUT_LIMIT_CHECKStringDYNAMODB_THROUGHPUT_LIMIT_CHECKstringDYNAMODB_THROUGHPUT_LIMIT_CHECK*stringstatic#

Checks whether provisioned DynamoDB throughput is approaching the maximum limit for your account.

EBS_ENCRYPTED_VOLUMESstringebs_encrypted_volumesstrEBS_ENCRYPTED_VOLUMESStringEBS_ENCRYPTED_VOLUMESstringEBS_ENCRYPTED_VOLUMES*stringstatic#

Checks whether the EBS volumes that are in an attached state are encrypted.

EBS_IN_BACKUP_PLANstringebs_in_backup_planstrEBS_IN_BACKUP_PLANStringEBS_IN_BACKUP_PLANstringEBS_IN_BACKUP_PLAN*stringstatic#

Checks if Amazon Elastic Block Store (Amazon EBS) volumes are added in backup plans of AWS Backup.

EBS_OPTIMIZED_INSTANCEstringebs_optimized_instancestrEBS_OPTIMIZED_INSTANCEStringEBS_OPTIMIZED_INSTANCEstringEBS_OPTIMIZED_INSTANCE*stringstatic#

Checks whether EBS optimization is enabled for your EC2 instances that can be EBS-optimized.

EBS_RESOURCES_PROTECTED_BY_BACKUP_PLANstringebs_resources_protected_by_backup_planstrEBS_RESOURCES_PROTECTED_BY_BACKUP_PLANStringEBS_RESOURCES_PROTECTED_BY_BACKUP_PLANstringEBS_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon Elastic Block Store (Amazon EBS) volumes are protected by a backup plan.

EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECKstringebs_snapshot_public_restorable_checkstrEBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECKStringEBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECKstringEBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK*stringstatic#

Checks whether Amazon Elastic Block Store snapshots are not publicly restorable.

EC2_DESIRED_INSTANCE_TENANCYstringec2_desired_instance_tenancystrEC2_DESIRED_INSTANCE_TENANCYStringEC2_DESIRED_INSTANCE_TENANCYstringEC2_DESIRED_INSTANCE_TENANCY*stringstatic#

Checks instances for specified tenancy.

EC2_DESIRED_INSTANCE_TYPEstringec2_desired_instance_typestrEC2_DESIRED_INSTANCE_TYPEStringEC2_DESIRED_INSTANCE_TYPEstringEC2_DESIRED_INSTANCE_TYPE*stringstatic#

Checks whether your EC2 instances are of the specified instance types.

EC2_EBS_ENCRYPTION_BY_DEFAULTstringec2_ebs_encryption_by_defaultstrEC2_EBS_ENCRYPTION_BY_DEFAULTStringEC2_EBS_ENCRYPTION_BY_DEFAULTstringEC2_EBS_ENCRYPTION_BY_DEFAULT*stringstatic#

Check that Amazon Elastic Block Store (EBS) encryption is enabled by default.

EC2_IMDSV2_CHECKstringec2_imdsv2_checkstrEC2_IMDSV2_CHECKStringEC2_IMDSV2_CHECKstringEC2_IMDSV2_CHECK*stringstatic#

Checks whether your Amazon Elastic Compute Cloud (Amazon EC2) instance metadata version is configured with Instance Metadata Service Version 2 (IMDSv2).

EC2_INSTANCE_DETAILED_MONITORING_ENABLEDstringec2_instance_detailed_monitoring_enabledstrEC2_INSTANCE_DETAILED_MONITORING_ENABLEDStringEC2_INSTANCE_DETAILED_MONITORING_ENABLEDstringEC2_INSTANCE_DETAILED_MONITORING_ENABLED*stringstatic#

Checks whether detailed monitoring is enabled for EC2 instances.

EC2_INSTANCE_MANAGED_BY_SSMstringec2_instance_managed_by_ssmstrEC2_INSTANCE_MANAGED_BY_SSMStringEC2_INSTANCE_MANAGED_BY_SSMstringEC2_INSTANCE_MANAGED_BY_SSM*stringstatic#

Checks whether the Amazon EC2 instances in your account are managed by AWS Systems Manager.

EC2_INSTANCE_MULTIPLE_ENI_CHECKstringec2_instance_multiple_eni_checkstrEC2_INSTANCE_MULTIPLE_ENI_CHECKStringEC2_INSTANCE_MULTIPLE_ENI_CHECKstringEC2_INSTANCE_MULTIPLE_ENI_CHECK*stringstatic#

Checks if Amazon Elastic Compute Cloud (Amazon EC2) uses multiple ENIs (Elastic Network Interfaces) or Elastic Fabric Adapters (EFAs).

EC2_INSTANCE_NO_PUBLIC_IPstringec2_instance_no_public_ipstrEC2_INSTANCE_NO_PUBLIC_IPStringEC2_INSTANCE_NO_PUBLIC_IPstringEC2_INSTANCE_NO_PUBLIC_IP*stringstatic#

Checks whether Amazon Elastic Compute Cloud (Amazon EC2) instances have a public IP association.

EC2_INSTANCE_PROFILE_ATTACHEDstringec2_instance_profile_attachedstrEC2_INSTANCE_PROFILE_ATTACHEDStringEC2_INSTANCE_PROFILE_ATTACHEDstringEC2_INSTANCE_PROFILE_ATTACHED*stringstatic#

Checks if an Amazon Elastic Compute Cloud (Amazon EC2) instance has an Identity and Access Management (IAM) profile attached to it.

This rule is NON_COMPLIANT if no IAM profile is attached to the Amazon EC2 instance.

EC2_INSTANCES_IN_VPCstringec2_instances_in_vpcstrEC2_INSTANCES_IN_VPCStringEC2_INSTANCES_IN_VPCstringEC2_INSTANCES_IN_VPC*stringstatic#

Checks whether your EC2 instances belong to a virtual private cloud (VPC).

EC2_LAST_BACKUP_RECOVERY_POINT_CREATEDstringec2_last_backup_recovery_point_createdstrEC2_LAST_BACKUP_RECOVERY_POINT_CREATEDStringEC2_LAST_BACKUP_RECOVERY_POINT_CREATEDstringEC2_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon Elastic Compute Cloud (Amazon EC2) instances.

EC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKEDstringec2_managed_instance_applications_blockedstrEC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKEDStringEC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKEDstringEC2_MANAGED_INSTANCE_APPLICATIONS_BLOCKED*stringstatic#

Checks that none of the specified applications are installed on the instance.

EC2_MANAGED_INSTANCE_APPLICATIONS_REQUIREDstringec2_managed_instance_applications_requiredstrEC2_MANAGED_INSTANCE_APPLICATIONS_REQUIREDStringEC2_MANAGED_INSTANCE_APPLICATIONS_REQUIREDstringEC2_MANAGED_INSTANCE_APPLICATIONS_REQUIRED*stringstatic#

Checks whether all of the specified applications are installed on the instance.

EC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECKstringec2_managed_instance_association_compliance_status_checkstrEC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECKStringEC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECKstringEC2_MANAGED_INSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK*stringstatic#

Checks whether the compliance status of AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance.

EC2_MANAGED_INSTANCE_INVENTORY_BLOCKEDstringec2_managed_instance_inventory_blockedstrEC2_MANAGED_INSTANCE_INVENTORY_BLOCKEDStringEC2_MANAGED_INSTANCE_INVENTORY_BLOCKEDstringEC2_MANAGED_INSTANCE_INVENTORY_BLOCKED*stringstatic#

Checks whether instances managed by AWS Systems Manager are configured to collect blocked inventory types.

EC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECKstringec2_managed_instance_patch_compliance_status_checkstrEC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECKStringEC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECKstringEC2_MANAGED_INSTANCE_PATCH_COMPLIANCE_STATUS_CHECK*stringstatic#

Checks whether the compliance status of the Amazon EC2 Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance.

EC2_MANAGED_INSTANCE_PLATFORM_CHECKstringec2_managed_instance_platform_checkstrEC2_MANAGED_INSTANCE_PLATFORM_CHECKStringEC2_MANAGED_INSTANCE_PLATFORM_CHECKstringEC2_MANAGED_INSTANCE_PLATFORM_CHECK*stringstatic#

Checks whether EC2 managed instances have the desired configurations.

EC2_NO_AMAZON_KEY_PAIRstringec2_no_amazon_key_pairstrEC2_NO_AMAZON_KEY_PAIRStringEC2_NO_AMAZON_KEY_PAIRstringEC2_NO_AMAZON_KEY_PAIR*stringstatic#

Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs.

EC2_PARAVIRTUAL_INSTANCE_CHECKstringec2_paravirtual_instance_checkstrEC2_PARAVIRTUAL_INSTANCE_CHECKStringEC2_PARAVIRTUAL_INSTANCE_CHECKstringEC2_PARAVIRTUAL_INSTANCE_CHECK*stringstatic#

Checks if the virtualization type of an EC2 instance is paravirtual.

EC2_RESOURCES_PROTECTED_BY_BACKUP_PLANstringec2_resources_protected_by_backup_planstrEC2_RESOURCES_PROTECTED_BY_BACKUP_PLANStringEC2_RESOURCES_PROTECTED_BY_BACKUP_PLANstringEC2_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon Elastic Compute Cloud (Amazon EC2) instances are protected by a backup plan.

EC2_SECURITY_GROUP_ATTACHED_TO_ENIstringec2_security_group_attached_to_enistrEC2_SECURITY_GROUP_ATTACHED_TO_ENIStringEC2_SECURITY_GROUP_ATTACHED_TO_ENIstringEC2_SECURITY_GROUP_ATTACHED_TO_ENI*stringstatic#

Checks that security groups are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances or to an elastic network interface.

EC2_SECURITY_GROUP_ATTACHED_TO_ENI_PERIODICstringec2_security_group_attached_to_eni_periodicstrEC2_SECURITY_GROUP_ATTACHED_TO_ENI_PERIODICStringEC2_SECURITY_GROUP_ATTACHED_TO_ENI_PERIODICstringEC2_SECURITY_GROUP_ATTACHED_TO_ENI_PERIODIC*stringstatic#

Checks if non-default security groups are attached to Elastic network interfaces (ENIs).

EC2_SECURITY_GROUPS_INCOMING_SSH_DISABLEDstringec2_security_groups_incoming_ssh_disabledstrEC2_SECURITY_GROUPS_INCOMING_SSH_DISABLEDStringEC2_SECURITY_GROUPS_INCOMING_SSH_DISABLEDstringEC2_SECURITY_GROUPS_INCOMING_SSH_DISABLED*stringstatic#

Checks whether the incoming SSH traffic for the security groups is accessible.

EC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFICstringec2_security_groups_restricted_incoming_trafficstrEC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFICStringEC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFICstringEC2_SECURITY_GROUPS_RESTRICTED_INCOMING_TRAFFIC*stringstatic#

Checks whether the security groups in use do not allow unrestricted incoming TCP traffic to the specified ports.

EC2_STOPPED_INSTANCEstringec2_stopped_instancestrEC2_STOPPED_INSTANCEStringEC2_STOPPED_INSTANCEstringEC2_STOPPED_INSTANCE*stringstatic#

Checks whether there are instances stopped for more than the allowed number of days.

EC2_TOKEN_HOP_LIMIT_CHECKstringec2_token_hop_limit_checkstrEC2_TOKEN_HOP_LIMIT_CHECKStringEC2_TOKEN_HOP_LIMIT_CHECKstringEC2_TOKEN_HOP_LIMIT_CHECK*stringstatic#

Checks if an Amazon Elastic Compute Cloud (EC2) instance metadata has a specified token hop limit that is below the desired limit.

EC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLEDstringec2_transit_gateway_auto_vpc_attach_disabledstrEC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLEDStringEC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLEDstringEC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLED*stringstatic#

Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled.

EC2_VOLUME_IECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECKNUSE_CHECKstringec2_volume_iecs_task_definition_user_for_host_mode_checknuse_checkstrEC2_VOLUME_IECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECKNUSE_CHECKStringEC2_VOLUME_IECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECKNUSE_CHECKstringEC2_VOLUME_IECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECKNUSE_CHECK*stringstatic#

Checks if an Amazon Elastic Container Service (Amazon ECS) task definition with host networking mode has 'privileged' or 'user' container definitions.

EC2_VOLUME_INUSE_CHECKstringec2_volume_inuse_checkstrEC2_VOLUME_INUSE_CHECKStringEC2_VOLUME_INUSE_CHECKstringEC2_VOLUME_INUSE_CHECK*stringstatic#

Checks whether EBS volumes are attached to EC2 instances.

ECR_PRIVATE_IMAGE_SCANNING_ENABLEDstringecr_private_image_scanning_enabledstrECR_PRIVATE_IMAGE_SCANNING_ENABLEDStringECR_PRIVATE_IMAGE_SCANNING_ENABLEDstringECR_PRIVATE_IMAGE_SCANNING_ENABLED*stringstatic#

Checks if a private Amazon Elastic Container Registry (ECR) repository has image scanning enabled.

ECR_PRIVATE_LIFECYCLE_POLICY_CONFIGUREDstringecr_private_lifecycle_policy_configuredstrECR_PRIVATE_LIFECYCLE_POLICY_CONFIGUREDStringECR_PRIVATE_LIFECYCLE_POLICY_CONFIGUREDstringECR_PRIVATE_LIFECYCLE_POLICY_CONFIGURED*stringstatic#

Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured.

ECR_PRIVATE_TAG_IMMUTABILITY_ENABLEDstringecr_private_tag_immutability_enabledstrECR_PRIVATE_TAG_IMMUTABILITY_ENABLEDStringECR_PRIVATE_TAG_IMMUTABILITY_ENABLEDstringECR_PRIVATE_TAG_IMMUTABILITY_ENABLED*stringstatic#

Checks if a private Amazon Elastic Container Registry (ECR) repository has tag immutability enabled.

ECS_AWSVPC_NETWORKING_ENABLEDstringecs_awsvpc_networking_enabledstrECS_AWSVPC_NETWORKING_ENABLEDStringECS_AWSVPC_NETWORKING_ENABLEDstringECS_AWSVPC_NETWORKING_ENABLED*stringstatic#

Checks if the networking mode for active ECSTaskDefinitions is set to ‘awsvpc’.

ECS_CONTAINER_INSIGHTS_ENABLEDstringecs_container_insights_enabledstrECS_CONTAINER_INSIGHTS_ENABLEDStringECS_CONTAINER_INSIGHTS_ENABLEDstringECS_CONTAINER_INSIGHTS_ENABLED*stringstatic#

Checks if Amazon Elastic Container Service clusters have container insights enabled.

ECS_CONTAINERS_NONPRIVILEGEDstringecs_containers_nonprivilegedstrECS_CONTAINERS_NONPRIVILEGEDStringECS_CONTAINERS_NONPRIVILEGEDstringECS_CONTAINERS_NONPRIVILEGED*stringstatic#

Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’.

ECS_CONTAINERS_READONLY_ACCESSstringecs_containers_readonly_accessstrECS_CONTAINERS_READONLY_ACCESSStringECS_CONTAINERS_READONLY_ACCESSstringECS_CONTAINERS_READONLY_ACCESS*stringstatic#

Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems.

ECS_FARGATE_LATEST_PLATFORM_VERSIONstringecs_fargate_latest_platform_versionstrECS_FARGATE_LATEST_PLATFORM_VERSIONStringECS_FARGATE_LATEST_PLATFORM_VERSIONstringECS_FARGATE_LATEST_PLATFORM_VERSION*stringstatic#

Checks if Amazon Elastic Container Service (ECS) Fargate Services is running on the latest Fargate platform version.

ECS_NO_ENVIRONMENT_SECRETSstringecs_no_environment_secretsstrECS_NO_ENVIRONMENT_SECRETSStringECS_NO_ENVIRONMENT_SECRETSstringECS_NO_ENVIRONMENT_SECRETS*stringstatic#

Checks if secrets are passed as container environment variables.

ECS_TASK_DEFINITION_LOG_CONFIGURATIONstringecs_task_definition_log_configurationstrECS_TASK_DEFINITION_LOG_CONFIGURATIONStringECS_TASK_DEFINITION_LOG_CONFIGURATIONstringECS_TASK_DEFINITION_LOG_CONFIGURATION*stringstatic#

Checks if logConfiguration is set on active ECS Task Definitions.

ECS_TASK_DEFINITION_MEMORY_HARD_LIMITstringecs_task_definition_memory_hard_limitstrECS_TASK_DEFINITION_MEMORY_HARD_LIMITStringECS_TASK_DEFINITION_MEMORY_HARD_LIMITstringECS_TASK_DEFINITION_MEMORY_HARD_LIMIT*stringstatic#

Checks if Amazon Elastic Container Service (ECS) task definitions have a set memory limit for its container definitions.

ECS_TASK_DEFINITION_NONROOT_USERstringecs_task_definition_nonroot_userstrECS_TASK_DEFINITION_NONROOT_USERStringECS_TASK_DEFINITION_NONROOT_USERstringECS_TASK_DEFINITION_NONROOT_USER*stringstatic#

Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on.

ECS_TASK_DEFINITION_PID_MODE_CHECKstringecs_task_definition_pid_mode_checkstrECS_TASK_DEFINITION_PID_MODE_CHECKStringECS_TASK_DEFINITION_PID_MODE_CHECKstringECS_TASK_DEFINITION_PID_MODE_CHECK*stringstatic#

Checks if ECSTaskDefinitions are configured to share a host’s process namespace with its Amazon Elastic Container Service (Amazon ECS) containers.

EFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORYstringefs_access_point_enforce_root_directorystrEFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORYStringEFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORYstringEFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORY*stringstatic#

Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory.

EFS_ACCESS_POINT_ENFORCE_USER_IDENTITYstringefs_access_point_enforce_user_identitystrEFS_ACCESS_POINT_ENFORCE_USER_IDENTITYStringEFS_ACCESS_POINT_ENFORCE_USER_IDENTITYstringEFS_ACCESS_POINT_ENFORCE_USER_IDENTITY*stringstatic#

Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity.

EFS_ENCRYPTED_CHECKstringefs_encrypted_checkstrEFS_ENCRYPTED_CHECKStringEFS_ENCRYPTED_CHECKstringEFS_ENCRYPTED_CHECK*stringstatic#

hecks whether Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS).

EFS_IN_BACKUP_PLANstringefs_in_backup_planstrEFS_IN_BACKUP_PLANStringEFS_IN_BACKUP_PLANstringEFS_IN_BACKUP_PLAN*stringstatic#

Checks whether Amazon Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup.

EFS_LAST_BACKUP_RECOVERY_POINT_CREATEDstringefs_last_backup_recovery_point_createdstrEFS_LAST_BACKUP_RECOVERY_POINT_CREATEDStringEFS_LAST_BACKUP_RECOVERY_POINT_CREATEDstringEFS_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon Elastic File System (Amazon EFS) File Systems.

EFS_RESOURCES_PROTECTED_BY_BACKUP_PLANstringefs_resources_protected_by_backup_planstrEFS_RESOURCES_PROTECTED_BY_BACKUP_PLANStringEFS_RESOURCES_PROTECTED_BY_BACKUP_PLANstringEFS_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon Elastic File System (Amazon EFS) File Systems are protected by a backup plan.

EIP_ATTACHEDstringeip_attachedstrEIP_ATTACHEDStringEIP_ATTACHEDstringEIP_ATTACHED*stringstatic#

Checks whether all Elastic IP addresses that are allocated to a VPC are attached to EC2 instances or in-use elastic network interfaces (ENIs).

EKS_CLUSTER_OLDEST_SUPPORTED_VERSIONstringeks_cluster_oldest_supported_versionstrEKS_CLUSTER_OLDEST_SUPPORTED_VERSIONStringEKS_CLUSTER_OLDEST_SUPPORTED_VERSIONstringEKS_CLUSTER_OLDEST_SUPPORTED_VERSION*stringstatic#

Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running the oldest supported version.

EKS_CLUSTER_SUPPORTED_VERSIONstringeks_cluster_supported_versionstrEKS_CLUSTER_SUPPORTED_VERSIONStringEKS_CLUSTER_SUPPORTED_VERSIONstringEKS_CLUSTER_SUPPORTED_VERSION*stringstatic#

Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running a supported Kubernetes version.

EKS_ENDPOINT_NO_PUBLIC_ACCESSstringeks_endpoint_no_public_accessstrEKS_ENDPOINT_NO_PUBLIC_ACCESSStringEKS_ENDPOINT_NO_PUBLIC_ACCESSstringEKS_ENDPOINT_NO_PUBLIC_ACCESS*stringstatic#

Checks whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible.

EKS_SECRETS_ENCRYPTEDstringeks_secrets_encryptedstrEKS_SECRETS_ENCRYPTEDStringEKS_SECRETS_ENCRYPTEDstringEKS_SECRETS_ENCRYPTED*stringstatic#

Checks whether Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys.

ELASTIC_BEANSTALK_MANAGED_UPDATES_ENABLEDstringelastic_beanstalk_managed_updates_enabledstrELASTIC_BEANSTALK_MANAGED_UPDATES_ENABLEDStringELASTIC_BEANSTALK_MANAGED_UPDATES_ENABLEDstringELASTIC_BEANSTALK_MANAGED_UPDATES_ENABLED*stringstatic#

Checks if managed platform updates in an AWS Elastic Beanstalk environment is enabled.

ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECKstringelasticache_redis_cluster_automatic_backup_checkstrELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECKStringELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECKstringELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK*stringstatic#

Check if the Amazon ElastiCache Redis clusters have automatic backup turned on.

ELASTICSEARCH_ENCRYPTED_AT_RESTstringelasticsearch_encrypted_at_reststrELASTICSEARCH_ENCRYPTED_AT_RESTStringELASTICSEARCH_ENCRYPTED_AT_RESTstringELASTICSEARCH_ENCRYPTED_AT_REST*stringstatic#

Checks whether Amazon Elasticsearch Service (Amazon ES) domains have encryption at rest configuration enabled.

ELASTICSEARCH_IN_VPC_ONLYstringelasticsearch_in_vpc_onlystrELASTICSEARCH_IN_VPC_ONLYStringELASTICSEARCH_IN_VPC_ONLYstringELASTICSEARCH_IN_VPC_ONLY*stringstatic#

Checks whether Amazon Elasticsearch Service (Amazon ES) domains are in Amazon Virtual Private Cloud (Amazon VPC).

ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECKstringelasticsearch_node_to_node_encryption_checkstrELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECKStringELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECKstringELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK*stringstatic#

Check that Amazon ElasticSearch Service nodes are encrypted end to end.

ELB_ACM_CERTIFICATE_REQUIREDstringelb_acm_certificate_requiredstrELB_ACM_CERTIFICATE_REQUIREDStringELB_ACM_CERTIFICATE_REQUIREDstringELB_ACM_CERTIFICATE_REQUIRED*stringstatic#

Checks whether the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager.

ELB_CROSS_ZONE_LOAD_BALANCING_ENABLEDstringelb_cross_zone_load_balancing_enabledstrELB_CROSS_ZONE_LOAD_BALANCING_ENABLEDStringELB_CROSS_ZONE_LOAD_BALANCING_ENABLEDstringELB_CROSS_ZONE_LOAD_BALANCING_ENABLED*stringstatic#

Checks if cross-zone load balancing is enabled for the Classic Load Balancers (CLBs).

ELB_CUSTOM_SECURITY_POLICY_SSL_CHECKstringelb_custom_security_policy_ssl_checkstrELB_CUSTOM_SECURITY_POLICY_SSL_CHECKStringELB_CUSTOM_SECURITY_POLICY_SSL_CHECKstringELB_CUSTOM_SECURITY_POLICY_SSL_CHECK*stringstatic#

Checks whether your Classic Load Balancer SSL listeners are using a custom policy.

ELB_DELETION_PROTECTION_ENABLEDstringelb_deletion_protection_enabledstrELB_DELETION_PROTECTION_ENABLEDStringELB_DELETION_PROTECTION_ENABLEDstringELB_DELETION_PROTECTION_ENABLED*stringstatic#

Checks whether Elastic Load Balancing has deletion protection enabled.

ELB_LOGGING_ENABLEDstringelb_logging_enabledstrELB_LOGGING_ENABLEDStringELB_LOGGING_ENABLEDstringELB_LOGGING_ENABLED*stringstatic#

Checks whether the Application Load Balancer and the Classic Load Balancer have logging enabled.

ELB_PREDEFINED_SECURITY_POLICY_SSL_CHECKstringelb_predefined_security_policy_ssl_checkstrELB_PREDEFINED_SECURITY_POLICY_SSL_CHECKStringELB_PREDEFINED_SECURITY_POLICY_SSL_CHECKstringELB_PREDEFINED_SECURITY_POLICY_SSL_CHECK*stringstatic#

Checks whether your Classic Load Balancer SSL listeners are using a predefined policy.

ELB_TLS_HTTPS_LISTENERS_ONLYstringelb_tls_https_listeners_onlystrELB_TLS_HTTPS_LISTENERS_ONLYStringELB_TLS_HTTPS_LISTENERS_ONLYstringELB_TLS_HTTPS_LISTENERS_ONLY*stringstatic#

Checks whether your Classic Load Balancer is configured with SSL or HTTPS listeners.

ELBV2_ACM_CERTIFICATE_REQUIREDstringelbv2_acm_certificate_requiredstrELBV2_ACM_CERTIFICATE_REQUIREDStringELBV2_ACM_CERTIFICATE_REQUIREDstringELBV2_ACM_CERTIFICATE_REQUIRED*stringstatic#

Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM).

ELBV2_MULTIPLE_AZstringelbv2_multiple_azstrELBV2_MULTIPLE_AZStringELBV2_MULTIPLE_AZstringELBV2_MULTIPLE_AZ*stringstatic#

Checks if an Elastic Load Balancer V2 (Application, Network, or Gateway Load Balancer) has registered instances from multiple Availability Zones (AZ's).

EMR_KERBEROS_ENABLEDstringemr_kerberos_enabledstrEMR_KERBEROS_ENABLEDStringEMR_KERBEROS_ENABLEDstringEMR_KERBEROS_ENABLED*stringstatic#

Checks that Amazon EMR clusters have Kerberos enabled.

EMR_MASTER_NO_PUBLIC_IPstringemr_master_no_public_ipstrEMR_MASTER_NO_PUBLIC_IPStringEMR_MASTER_NO_PUBLIC_IPstringEMR_MASTER_NO_PUBLIC_IP*stringstatic#

Checks whether Amazon Elastic MapReduce (EMR) clusters' master nodes have public IPs.

FMS_SECURITY_GROUP_AUDIT_POLICY_CHECKstringfms_security_group_audit_policy_checkstrFMS_SECURITY_GROUP_AUDIT_POLICY_CHECKStringFMS_SECURITY_GROUP_AUDIT_POLICY_CHECKstringFMS_SECURITY_GROUP_AUDIT_POLICY_CHECK*stringstaticdeprecated#

Inactive managed rule

FMS_SECURITY_GROUP_CONTENT_CHECKstringfms_security_group_content_checkstrFMS_SECURITY_GROUP_CONTENT_CHECKStringFMS_SECURITY_GROUP_CONTENT_CHECKstringFMS_SECURITY_GROUP_CONTENT_CHECK*stringstaticdeprecated#

Inactive managed rule

FMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECKstringfms_security_group_resource_association_checkstrFMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECKStringFMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECKstringFMS_SECURITY_GROUP_RESOURCE_ASSOCIATION_CHECK*stringstaticdeprecated#

Inactive managed rule

FMS_SHIELD_RESOURCE_POLICY_CHECKstringfms_shield_resource_policy_checkstrFMS_SHIELD_RESOURCE_POLICY_CHECKStringFMS_SHIELD_RESOURCE_POLICY_CHECKstringFMS_SHIELD_RESOURCE_POLICY_CHECK*stringstatic#

Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection.

FMS_WEBACL_RESOURCE_POLICY_CHECKstringfms_webacl_resource_policy_checkstrFMS_WEBACL_RESOURCE_POLICY_CHECKStringFMS_WEBACL_RESOURCE_POLICY_CHECKstringFMS_WEBACL_RESOURCE_POLICY_CHECK*stringstatic#

Checks whether the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions.

FMS_WEBACL_RULEGROUP_ASSOCIATION_CHECKstringfms_webacl_rulegroup_association_checkstrFMS_WEBACL_RULEGROUP_ASSOCIATION_CHECKStringFMS_WEBACL_RULEGROUP_ASSOCIATION_CHECKstringFMS_WEBACL_RULEGROUP_ASSOCIATION_CHECK*stringstatic#

Checks that the rule groups associate with the web ACL at the correct priority.

The correct priority is decided by the rank of the rule groups in the ruleGroups parameter.

FSX_LAST_BACKUP_RECOVERY_POINT_CREATEDstringfsx_last_backup_recovery_point_createdstrFSX_LAST_BACKUP_RECOVERY_POINT_CREATEDStringFSX_LAST_BACKUP_RECOVERY_POINT_CREATEDstringFSX_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon FSx File Systems.

FSX_RESOURCES_PROTECTED_BY_BACKUP_PLANstringfsx_resources_protected_by_backup_planstrFSX_RESOURCES_PROTECTED_BY_BACKUP_PLANStringFSX_RESOURCES_PROTECTED_BY_BACKUP_PLANstringFSX_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon FSx File Systems are protected by a backup plan.

GUARDDUTY_ENABLED_CENTRALIZEDstringguardduty_enabled_centralizedstrGUARDDUTY_ENABLED_CENTRALIZEDStringGUARDDUTY_ENABLED_CENTRALIZEDstringGUARDDUTY_ENABLED_CENTRALIZED*stringstatic#

Checks whether Amazon GuardDuty is enabled in your AWS account and region.

If you provide an AWS account for centralization, the rule evaluates the Amazon GuardDuty results in the centralized account.

GUARDDUTY_NON_ARCHIVED_FINDINGSstringguardduty_non_archived_findingsstrGUARDDUTY_NON_ARCHIVED_FINDINGSStringGUARDDUTY_NON_ARCHIVED_FINDINGSstringGUARDDUTY_NON_ARCHIVED_FINDINGS*stringstatic#

Checks whether the Amazon GuardDuty has findings that are non archived.

IAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONSstringiam_customer_policy_blocked_kms_actionsstrIAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONSStringIAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONSstringIAM_CUSTOMER_POLICY_BLOCKED_KMS_ACTIONS*stringstatic#

Checks that the managed AWS Identity and Access Management policies that you create do not allow blocked actions on all AWS AWS KMS keys.

IAM_GROUP_HAS_USERS_CHECKstringiam_group_has_users_checkstrIAM_GROUP_HAS_USERS_CHECKStringIAM_GROUP_HAS_USERS_CHECKstringIAM_GROUP_HAS_USERS_CHECK*stringstatic#

Checks whether IAM groups have at least one IAM user.

IAM_INLINE_POLICY_BLOCKED_KMS_ACTIONSstringiam_inline_policy_blocked_kms_actionsstrIAM_INLINE_POLICY_BLOCKED_KMS_ACTIONSStringIAM_INLINE_POLICY_BLOCKED_KMS_ACTIONSstringIAM_INLINE_POLICY_BLOCKED_KMS_ACTIONS*stringstatic#

Checks that the inline policies attached to your AWS Identity and Access Management users, roles, and groups do not allow blocked actions on all AWS Key Management Service keys.

IAM_NO_INLINE_POLICY_CHECKstringiam_no_inline_policy_checkstrIAM_NO_INLINE_POLICY_CHECKStringIAM_NO_INLINE_POLICY_CHECKstringIAM_NO_INLINE_POLICY_CHECK*stringstatic#

Checks that inline policy feature is not in use.

IAM_PASSWORD_POLICYstringiam_password_policystrIAM_PASSWORD_POLICYStringIAM_PASSWORD_POLICYstringIAM_PASSWORD_POLICY*stringstatic#

Checks whether the account password policy for IAM users meets the specified requirements indicated in the parameters.

IAM_POLICY_BLOCKED_CHECKstringiam_policy_blocked_checkstrIAM_POLICY_BLOCKED_CHECKStringIAM_POLICY_BLOCKED_CHECKstringIAM_POLICY_BLOCKED_CHECK*stringstatic#

Checks whether for each IAM resource, a policy ARN in the input parameter is attached to the IAM resource.

IAM_POLICY_IN_USEstringiam_policy_in_usestrIAM_POLICY_IN_USEStringIAM_POLICY_IN_USEstringIAM_POLICY_IN_USE*stringstatic#

Checks whether the IAM policy ARN is attached to an IAM user, or an IAM group with one or more IAM users, or an IAM role with one or more trusted entity.

IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESSstringiam_policy_no_statements_with_admin_accessstrIAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESSStringIAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESSstringIAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS*stringstatic#

Checks the IAM policies that you create for Allow statements that grant permissions to all actions on all resources.

IAM_POLICY_NO_STATEMENTS_WITH_FULL_ACCESSstringiam_policy_no_statements_with_full_accessstrIAM_POLICY_NO_STATEMENTS_WITH_FULL_ACCESSStringIAM_POLICY_NO_STATEMENTS_WITH_FULL_ACCESSstringIAM_POLICY_NO_STATEMENTS_WITH_FULL_ACCESS*stringstatic#

Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources.

IAM_ROLE_MANAGED_POLICY_CHECKstringiam_role_managed_policy_checkstrIAM_ROLE_MANAGED_POLICY_CHECKStringIAM_ROLE_MANAGED_POLICY_CHECKstringIAM_ROLE_MANAGED_POLICY_CHECK*stringstatic#

Checks that AWS Identity and Access Management (IAM) policies in a list of policies are attached to all AWS roles.

IAM_ROOT_ACCESS_KEY_CHECKstringiam_root_access_key_checkstrIAM_ROOT_ACCESS_KEY_CHECKStringIAM_ROOT_ACCESS_KEY_CHECKstringIAM_ROOT_ACCESS_KEY_CHECK*stringstatic#

Checks whether the root user access key is available.

IAM_USER_GROUP_MEMBERSHIP_CHECKstringiam_user_group_membership_checkstrIAM_USER_GROUP_MEMBERSHIP_CHECKStringIAM_USER_GROUP_MEMBERSHIP_CHECKstringIAM_USER_GROUP_MEMBERSHIP_CHECK*stringstatic#

Checks whether IAM users are members of at least one IAM group.

IAM_USER_MFA_ENABLEDstringiam_user_mfa_enabledstrIAM_USER_MFA_ENABLEDStringIAM_USER_MFA_ENABLEDstringIAM_USER_MFA_ENABLED*stringstatic#

Checks whether the AWS Identity and Access Management users have multi-factor authentication (MFA) enabled.

IAM_USER_NO_POLICIES_CHECKstringiam_user_no_policies_checkstrIAM_USER_NO_POLICIES_CHECKStringIAM_USER_NO_POLICIES_CHECKstringIAM_USER_NO_POLICIES_CHECK*stringstatic#

Checks that none of your IAM users have policies attached.

IAM users must inherit permissions from IAM groups or roles.

IAM_USER_UNUSED_CREDENTIALS_CHECKstringiam_user_unused_credentials_checkstrIAM_USER_UNUSED_CREDENTIALS_CHECKStringIAM_USER_UNUSED_CREDENTIALS_CHECKstringIAM_USER_UNUSED_CREDENTIALS_CHECK*stringstatic#

Checks whether your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided.

INTERNET_GATEWAY_AUTHORIZED_VPC_ONLYstringinternet_gateway_authorized_vpc_onlystrINTERNET_GATEWAY_AUTHORIZED_VPC_ONLYStringINTERNET_GATEWAY_AUTHORIZED_VPC_ONLYstringINTERNET_GATEWAY_AUTHORIZED_VPC_ONLY*stringstatic#

Checks that Internet gateways (IGWs) are only attached to an authorized Amazon Virtual Private Cloud (VPCs).

KINESIS_STREAM_ENCRYPTEDstringkinesis_stream_encryptedstrKINESIS_STREAM_ENCRYPTEDStringKINESIS_STREAM_ENCRYPTEDstringKINESIS_STREAM_ENCRYPTED*stringstatic#

Checks if Amazon Kinesis streams are encrypted at rest with server-side encryption.

KMS_CMK_NOT_SCHEDULED_FOR_DELETIONstringkms_cmk_not_scheduled_for_deletionstrKMS_CMK_NOT_SCHEDULED_FOR_DELETIONStringKMS_CMK_NOT_SCHEDULED_FOR_DELETIONstringKMS_CMK_NOT_SCHEDULED_FOR_DELETION*stringstatic#

Checks whether customer master keys (CMKs) are not scheduled for deletion in AWS Key Management Service (KMS).

LAMBDA_CONCURRENCY_CHECKstringlambda_concurrency_checkstrLAMBDA_CONCURRENCY_CHECKStringLAMBDA_CONCURRENCY_CHECKstringLAMBDA_CONCURRENCY_CHECK*stringstatic#

Checks whether the AWS Lambda function is configured with function-level concurrent execution limit.

LAMBDA_DLQ_CHECKstringlambda_dlq_checkstrLAMBDA_DLQ_CHECKStringLAMBDA_DLQ_CHECKstringLAMBDA_DLQ_CHECK*stringstatic#

Checks whether an AWS Lambda function is configured with a dead-letter queue.

LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITEDstringlambda_function_public_access_prohibitedstrLAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITEDStringLAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITEDstringLAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED*stringstatic#

Checks whether the AWS Lambda function policy attached to the Lambda resource prohibits public access.

LAMBDA_FUNCTION_SETTINGS_CHECKstringlambda_function_settings_checkstrLAMBDA_FUNCTION_SETTINGS_CHECKStringLAMBDA_FUNCTION_SETTINGS_CHECKstringLAMBDA_FUNCTION_SETTINGS_CHECK*stringstatic#

Checks that the lambda function settings for runtime, role, timeout, and memory size match the expected values.

LAMBDA_INSIDE_VPCstringlambda_inside_vpcstrLAMBDA_INSIDE_VPCStringLAMBDA_INSIDE_VPCstringLAMBDA_INSIDE_VPC*stringstatic#

Checks whether an AWS Lambda function is in an Amazon Virtual Private Cloud.

LAMBDA_VPC_MULTI_AZ_CHECKstringlambda_vpc_multi_az_checkstrLAMBDA_VPC_MULTI_AZ_CHECKStringLAMBDA_VPC_MULTI_AZ_CHECKstringLAMBDA_VPC_MULTI_AZ_CHECK*stringstatic#

Checks if Lambda has more than 1 availability zone associated.

MFA_ENABLED_FOR_IAM_CONSOLE_ACCESSstringmfa_enabled_for_iam_console_accessstrMFA_ENABLED_FOR_IAM_CONSOLE_ACCESSStringMFA_ENABLED_FOR_IAM_CONSOLE_ACCESSstringMFA_ENABLED_FOR_IAM_CONSOLE_ACCESS*stringstatic#

Checks whether AWS Multi-Factor Authentication (MFA) is enabled for all IAM users that use a console password.

NACL_NO_UNRESTRICTED_SSH_RDPstringnacl_no_unrestricted_ssh_rdpstrNACL_NO_UNRESTRICTED_SSH_RDPStringNACL_NO_UNRESTRICTED_SSH_RDPstringNACL_NO_UNRESTRICTED_SSH_RDP*stringstatic#

Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted.

NETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETSstringnetfw_policy_default_action_fragment_packetsstrNETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETSStringNETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETSstringNETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETS*stringstatic#

Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets.

NETFW_POLICY_DEFAULT_ACTION_FULL_PACKETSstringnetfw_policy_default_action_full_packetsstrNETFW_POLICY_DEFAULT_ACTION_FULL_PACKETSStringNETFW_POLICY_DEFAULT_ACTION_FULL_PACKETSstringNETFW_POLICY_DEFAULT_ACTION_FULL_PACKETS*stringstatic#

Checks if an AWS Network Firewall policy is configured with a user defined default stateless action for full packets.

NETFW_POLICY_RULE_GROUP_ASSOCIATEDstringnetfw_policy_rule_group_associatedstrNETFW_POLICY_RULE_GROUP_ASSOCIATEDStringNETFW_POLICY_RULE_GROUP_ASSOCIATEDstringNETFW_POLICY_RULE_GROUP_ASSOCIATED*stringstatic#

Check AWS Network Firewall policy is associated with stateful OR stateless rule groups.

NETFW_STATELESS_RULE_GROUP_NOT_EMPTYstringnetfw_stateless_rule_group_not_emptystrNETFW_STATELESS_RULE_GROUP_NOT_EMPTYStringNETFW_STATELESS_RULE_GROUP_NOT_EMPTYstringNETFW_STATELESS_RULE_GROUP_NOT_EMPTY*stringstatic#

Checks if a Stateless Network Firewall Rule Group contains rules.

NLB_CROSS_ZONE_LOAD_BALANCING_ENABLEDstringnlb_cross_zone_load_balancing_enabledstrNLB_CROSS_ZONE_LOAD_BALANCING_ENABLEDStringNLB_CROSS_ZONE_LOAD_BALANCING_ENABLEDstringNLB_CROSS_ZONE_LOAD_BALANCING_ENABLED*stringstatic#

Checks if cross-zone load balancing is enabled on Network Load Balancers (NLBs).

OPENSEARCH_ACCESS_CONTROL_ENABLEDstringopensearch_access_control_enabledstrOPENSEARCH_ACCESS_CONTROL_ENABLEDStringOPENSEARCH_ACCESS_CONTROL_ENABLEDstringOPENSEARCH_ACCESS_CONTROL_ENABLED*stringstatic#

Checks if Amazon OpenSearch Service domains have fine-grained access control enabled.

OPENSEARCH_AUDIT_LOGGING_ENABLEDstringopensearch_audit_logging_enabledstrOPENSEARCH_AUDIT_LOGGING_ENABLEDStringOPENSEARCH_AUDIT_LOGGING_ENABLEDstringOPENSEARCH_AUDIT_LOGGING_ENABLED*stringstatic#

Checks if Amazon OpenSearch Service domains have audit logging enabled.

OPENSEARCH_DATA_NODE_FAULT_TOLERANCEstringopensearch_data_node_fault_tolerancestrOPENSEARCH_DATA_NODE_FAULT_TOLERANCEStringOPENSEARCH_DATA_NODE_FAULT_TOLERANCEstringOPENSEARCH_DATA_NODE_FAULT_TOLERANCE*stringstatic#

Checks if Amazon OpenSearch Service domains are configured with at least three data nodes and zoneAwarenessEnabled is true.

OPENSEARCH_ENCRYPTED_AT_RESTstringopensearch_encrypted_at_reststrOPENSEARCH_ENCRYPTED_AT_RESTStringOPENSEARCH_ENCRYPTED_AT_RESTstringOPENSEARCH_ENCRYPTED_AT_REST*stringstatic#

Checks if Amazon OpenSearch Service domains have encryption at rest configuration enabled.

OPENSEARCH_HTTPS_REQUIREDstringopensearch_https_requiredstrOPENSEARCH_HTTPS_REQUIREDStringOPENSEARCH_HTTPS_REQUIREDstringOPENSEARCH_HTTPS_REQUIRED*stringstatic#

Checks whether connections to OpenSearch domains are using HTTPS.

OPENSEARCH_IN_VPC_ONLYstringopensearch_in_vpc_onlystrOPENSEARCH_IN_VPC_ONLYStringOPENSEARCH_IN_VPC_ONLYstringOPENSEARCH_IN_VPC_ONLY*stringstatic#

Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC).

OPENSEARCH_LOGS_TO_CLOUDWATCHstringopensearch_logs_to_cloudwatchstrOPENSEARCH_LOGS_TO_CLOUDWATCHStringOPENSEARCH_LOGS_TO_CLOUDWATCHstringOPENSEARCH_LOGS_TO_CLOUDWATCH*stringstatic#

Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs.

OPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECKstringopensearch_node_to_node_encryption_checkstrOPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECKStringOPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECKstringOPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK*stringstatic#

Check if Amazon OpenSearch Service nodes are encrypted end to end.

RDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLEDstringrds_automatic_minor_version_upgrade_enabledstrRDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLEDStringRDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLEDstringRDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLED*stringstatic#

Checks if Amazon Relational Database Service (RDS) database instances are configured for automatic minor version upgrades.

RDS_CLUSTER_DEFAULT_ADMIN_CHECKstringrds_cluster_default_admin_checkstrRDS_CLUSTER_DEFAULT_ADMIN_CHECKStringRDS_CLUSTER_DEFAULT_ADMIN_CHECKstringRDS_CLUSTER_DEFAULT_ADMIN_CHECK*stringstatic#

Checks if an Amazon Relational Database Service (Amazon RDS) database cluster has changed the admin username from its default value.

RDS_CLUSTER_DELETION_PROTECTION_ENABLEDstringrds_cluster_deletion_protection_enabledstrRDS_CLUSTER_DELETION_PROTECTION_ENABLEDStringRDS_CLUSTER_DELETION_PROTECTION_ENABLEDstringRDS_CLUSTER_DELETION_PROTECTION_ENABLED*stringstatic#

Checks if an Amazon Relational Database Service (Amazon RDS) cluster has deletion protection enabled.

RDS_CLUSTER_IAM_AUTHENTICATION_ENABLEDstringrds_cluster_iam_authentication_enabledstrRDS_CLUSTER_IAM_AUTHENTICATION_ENABLEDStringRDS_CLUSTER_IAM_AUTHENTICATION_ENABLEDstringRDS_CLUSTER_IAM_AUTHENTICATION_ENABLED*stringstatic#

Checks if an Amazon RDS Cluster has AWS Identity and Access Management (IAM) authentication enabled.

RDS_CLUSTER_MULTI_AZ_ENABLEDstringrds_cluster_multi_az_enabledstrRDS_CLUSTER_MULTI_AZ_ENABLEDStringRDS_CLUSTER_MULTI_AZ_ENABLEDstringRDS_CLUSTER_MULTI_AZ_ENABLED*stringstatic#

Checks if Multi-AZ replication is enabled on Amazon Aurora and Hermes clusters managed by Amazon Relational Database Service (Amazon RDS).

RDS_DB_INSTANCE_BACKUP_ENABLEDstringrds_db_instance_backup_enabledstrRDS_DB_INSTANCE_BACKUP_ENABLEDStringRDS_DB_INSTANCE_BACKUP_ENABLEDstringRDS_DB_INSTANCE_BACKUP_ENABLED*stringstatic#

Checks whether RDS DB instances have backups enabled.

RDS_DB_SECURITY_GROUP_NOT_ALLOWEDstringrds_db_security_group_not_allowedstrRDS_DB_SECURITY_GROUP_NOT_ALLOWEDStringRDS_DB_SECURITY_GROUP_NOT_ALLOWEDstringRDS_DB_SECURITY_GROUP_NOT_ALLOWED*stringstatic#

Checks if there are any Amazon Relational Database Service (RDS) DB security groups that are not the default DB security group.

RDS_ENHANCED_MONITORING_ENABLEDstringrds_enhanced_monitoring_enabledstrRDS_ENHANCED_MONITORING_ENABLEDStringRDS_ENHANCED_MONITORING_ENABLEDstringRDS_ENHANCED_MONITORING_ENABLED*stringstatic#

Checks whether enhanced monitoring is enabled for Amazon Relational Database Service (Amazon RDS) instances.

RDS_IN_BACKUP_PLANstringrds_in_backup_planstrRDS_IN_BACKUP_PLANStringRDS_IN_BACKUP_PLANstringRDS_IN_BACKUP_PLAN*stringstatic#

Checks whether Amazon RDS database is present in back plans of AWS Backup.

RDS_INSTANCE_DEFAULT_ADMIN_CHECKstringrds_instance_default_admin_checkstrRDS_INSTANCE_DEFAULT_ADMIN_CHECKStringRDS_INSTANCE_DEFAULT_ADMIN_CHECKstringRDS_INSTANCE_DEFAULT_ADMIN_CHECK*stringstatic#

Checks if an Amazon Relational Database Service (Amazon RDS) database has changed the admin username from its default value.

RDS_INSTANCE_DELETION_PROTECTION_ENABLEDstringrds_instance_deletion_protection_enabledstrRDS_INSTANCE_DELETION_PROTECTION_ENABLEDStringRDS_INSTANCE_DELETION_PROTECTION_ENABLEDstringRDS_INSTANCE_DELETION_PROTECTION_ENABLED*stringstatic#

Checks if an Amazon Relational Database Service (Amazon RDS) instance has deletion protection enabled.

RDS_INSTANCE_IAM_AUTHENTICATION_ENABLEDstringrds_instance_iam_authentication_enabledstrRDS_INSTANCE_IAM_AUTHENTICATION_ENABLEDStringRDS_INSTANCE_IAM_AUTHENTICATION_ENABLEDstringRDS_INSTANCE_IAM_AUTHENTICATION_ENABLED*stringstatic#

Checks if an Amazon RDS instance has AWS Identity and Access Management (IAM) authentication enabled.

RDS_INSTANCE_PUBLIC_ACCESS_CHECKstringrds_instance_public_access_checkstrRDS_INSTANCE_PUBLIC_ACCESS_CHECKStringRDS_INSTANCE_PUBLIC_ACCESS_CHECKstringRDS_INSTANCE_PUBLIC_ACCESS_CHECK*stringstatic#

Check whether the Amazon Relational Database Service instances are not publicly accessible.

RDS_LAST_BACKUP_RECOVERY_POINT_CREATEDstringrds_last_backup_recovery_point_createdstrRDS_LAST_BACKUP_RECOVERY_POINT_CREATEDStringRDS_LAST_BACKUP_RECOVERY_POINT_CREATEDstringRDS_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon Relational Database Service (Amazon RDS).

RDS_LOGGING_ENABLEDstringrds_logging_enabledstrRDS_LOGGING_ENABLEDStringRDS_LOGGING_ENABLEDstringRDS_LOGGING_ENABLED*stringstatic#

Checks that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled.

RDS_MULTI_AZ_SUPPORTstringrds_multi_az_supportstrRDS_MULTI_AZ_SUPPORTStringRDS_MULTI_AZ_SUPPORTstringRDS_MULTI_AZ_SUPPORT*stringstatic#

Checks whether high availability is enabled for your RDS DB instances.

RDS_RESOURCES_PROTECTED_BY_BACKUP_PLANstringrds_resources_protected_by_backup_planstrRDS_RESOURCES_PROTECTED_BY_BACKUP_PLANStringRDS_RESOURCES_PROTECTED_BY_BACKUP_PLANstringRDS_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon Relational Database Service (Amazon RDS) instances are protected by a backup plan.

RDS_SNAPSHOT_ENCRYPTEDstringrds_snapshot_encryptedstrRDS_SNAPSHOT_ENCRYPTEDStringRDS_SNAPSHOT_ENCRYPTEDstringRDS_SNAPSHOT_ENCRYPTED*stringstatic#

Checks whether Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted.

RDS_SNAPSHOTS_PUBLIC_PROHIBITEDstringrds_snapshots_public_prohibitedstrRDS_SNAPSHOTS_PUBLIC_PROHIBITEDStringRDS_SNAPSHOTS_PUBLIC_PROHIBITEDstringRDS_SNAPSHOTS_PUBLIC_PROHIBITED*stringstatic#

Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public.

RDS_STORAGE_ENCRYPTEDstringrds_storage_encryptedstrRDS_STORAGE_ENCRYPTEDStringRDS_STORAGE_ENCRYPTEDstringRDS_STORAGE_ENCRYPTED*stringstatic#

Checks whether storage encryption is enabled for your RDS DB instances.

REDSHIFT_AUDIT_LOGGING_ENABLEDstringredshift_audit_logging_enabledstrREDSHIFT_AUDIT_LOGGING_ENABLEDStringREDSHIFT_AUDIT_LOGGING_ENABLEDstringREDSHIFT_AUDIT_LOGGING_ENABLED*stringstatic#

Checks if Amazon Redshift clusters are logging audits to a specific bucket.

REDSHIFT_BACKUP_ENABLEDstringredshift_backup_enabledstrREDSHIFT_BACKUP_ENABLEDStringREDSHIFT_BACKUP_ENABLEDstringREDSHIFT_BACKUP_ENABLED*stringstatic#

Checks that Amazon Redshift automated snapshots are enabled for clusters.

REDSHIFT_CLUSTER_CONFIGURATION_CHECKstringredshift_cluster_configuration_checkstrREDSHIFT_CLUSTER_CONFIGURATION_CHECKStringREDSHIFT_CLUSTER_CONFIGURATION_CHECKstringREDSHIFT_CLUSTER_CONFIGURATION_CHECK*stringstatic#

Checks whether Amazon Redshift clusters have the specified settings.

REDSHIFT_CLUSTER_KMS_ENABLEDstringredshift_cluster_kms_enabledstrREDSHIFT_CLUSTER_KMS_ENABLEDStringREDSHIFT_CLUSTER_KMS_ENABLEDstringREDSHIFT_CLUSTER_KMS_ENABLED*stringstatic#

Checks if Amazon Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption.

REDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECKstringredshift_cluster_maintenance_settings_checkstrREDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECKStringREDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECKstringREDSHIFT_CLUSTER_MAINTENANCE_SETTINGS_CHECK*stringstatic#

Checks whether Amazon Redshift clusters have the specified maintenance settings.

REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECKstringredshift_cluster_public_access_checkstrREDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECKStringREDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECKstringREDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK*stringstatic#

Checks whether Amazon Redshift clusters are not publicly accessible.

REDSHIFT_DEFAULT_ADMIN_CHECKstringredshift_default_admin_checkstrREDSHIFT_DEFAULT_ADMIN_CHECKStringREDSHIFT_DEFAULT_ADMIN_CHECKstringREDSHIFT_DEFAULT_ADMIN_CHECK*stringstatic#

Checks if an Amazon Redshift cluster has changed the admin username from its default value.

REDSHIFT_DEFAULT_DB_NAME_CHECKstringredshift_default_db_name_checkstrREDSHIFT_DEFAULT_DB_NAME_CHECKStringREDSHIFT_DEFAULT_DB_NAME_CHECKstringREDSHIFT_DEFAULT_DB_NAME_CHECK*stringstatic#

Checks if a Redshift cluster has changed its database name from the default value.

REDSHIFT_ENHANCED_VPC_ROUTING_ENABLEDstringredshift_enhanced_vpc_routing_enabledstrREDSHIFT_ENHANCED_VPC_ROUTING_ENABLEDStringREDSHIFT_ENHANCED_VPC_ROUTING_ENABLEDstringREDSHIFT_ENHANCED_VPC_ROUTING_ENABLED*stringstatic#

Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled.

REDSHIFT_REQUIRE_TLS_SSLstringredshift_require_tls_sslstrREDSHIFT_REQUIRE_TLS_SSLStringREDSHIFT_REQUIRE_TLS_SSLstringREDSHIFT_REQUIRE_TLS_SSL*stringstatic#

Checks whether Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients.

REQUIRED_TAGSstringrequired_tagsstrREQUIRED_TAGSStringREQUIRED_TAGSstringREQUIRED_TAGS*stringstatic#

Checks whether your resources have the tags that you specify.

For example, you can check whether your Amazon EC2 instances have the CostCenter tag.

ROOT_ACCOUNT_HARDWARE_MFA_ENABLEDstringroot_account_hardware_mfa_enabledstrROOT_ACCOUNT_HARDWARE_MFA_ENABLEDStringROOT_ACCOUNT_HARDWARE_MFA_ENABLEDstringROOT_ACCOUNT_HARDWARE_MFA_ENABLED*stringstatic#

Checks whether your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials.

ROOT_ACCOUNT_MFA_ENABLEDstringroot_account_mfa_enabledstrROOT_ACCOUNT_MFA_ENABLEDStringROOT_ACCOUNT_MFA_ENABLEDstringROOT_ACCOUNT_MFA_ENABLED*stringstatic#

Checks whether users of your AWS account require a multi-factor authentication (MFA) device to sign in with root credentials.

S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKSstrings3_account_level_public_access_blocksstrS3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKSStringS3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKSstringS3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS*stringstatic#

Checks whether the required public access block settings are configured from account level.

S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODICstrings3_account_level_public_access_blocks_periodicstrS3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODICStringS3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODICstringS3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC*stringstatic#

Checks if the required public access block settings are configured from account level.

S3_BUCKET_ACL_PROHIBITEDstrings3_bucket_acl_prohibitedstrS3_BUCKET_ACL_PROHIBITEDStringS3_BUCKET_ACL_PROHIBITEDstringS3_BUCKET_ACL_PROHIBITED*stringstatic#

Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs).

S3_BUCKET_BLOCKED_ACTIONS_PROHIBITEDstrings3_bucket_blocked_actions_prohibitedstrS3_BUCKET_BLOCKED_ACTIONS_PROHIBITEDStringS3_BUCKET_BLOCKED_ACTIONS_PROHIBITEDstringS3_BUCKET_BLOCKED_ACTIONS_PROHIBITED*stringstatic#

Checks if the Amazon Simple Storage Service bucket policy does not allow blacklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts.

S3_BUCKET_DEFAULT_LOCK_ENABLEDstrings3_bucket_default_lock_enabledstrS3_BUCKET_DEFAULT_LOCK_ENABLEDStringS3_BUCKET_DEFAULT_LOCK_ENABLEDstringS3_BUCKET_DEFAULT_LOCK_ENABLED*stringstatic#

Checks whether Amazon Simple Storage Service (Amazon S3) bucket has lock enabled, by default.

S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITEDstrings3_bucket_level_public_access_prohibitedstrS3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITEDStringS3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITEDstringS3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED*stringstatic#

Checks if Amazon Simple Storage Service (Amazon S3) buckets are publicly accessible.

S3_BUCKET_LOGGING_ENABLEDstrings3_bucket_logging_enabledstrS3_BUCKET_LOGGING_ENABLEDStringS3_BUCKET_LOGGING_ENABLEDstringS3_BUCKET_LOGGING_ENABLED*stringstatic#

Checks whether logging is enabled for your S3 buckets.

S3_BUCKET_POLICY_GRANTEE_CHECKstrings3_bucket_policy_grantee_checkstrS3_BUCKET_POLICY_GRANTEE_CHECKStringS3_BUCKET_POLICY_GRANTEE_CHECKstringS3_BUCKET_POLICY_GRANTEE_CHECK*stringstatic#

Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide.

S3_BUCKET_POLICY_NOT_MORE_PERMISSIVEstrings3_bucket_policy_not_more_permissivestrS3_BUCKET_POLICY_NOT_MORE_PERMISSIVEStringS3_BUCKET_POLICY_NOT_MORE_PERMISSIVEstringS3_BUCKET_POLICY_NOT_MORE_PERMISSIVE*stringstatic#

Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide.

S3_BUCKET_PUBLIC_READ_PROHIBITEDstrings3_bucket_public_read_prohibitedstrS3_BUCKET_PUBLIC_READ_PROHIBITEDStringS3_BUCKET_PUBLIC_READ_PROHIBITEDstringS3_BUCKET_PUBLIC_READ_PROHIBITED*stringstatic#

Checks if your Amazon S3 buckets do not allow public read access.

S3_BUCKET_PUBLIC_WRITE_PROHIBITEDstrings3_bucket_public_write_prohibitedstrS3_BUCKET_PUBLIC_WRITE_PROHIBITEDStringS3_BUCKET_PUBLIC_WRITE_PROHIBITEDstringS3_BUCKET_PUBLIC_WRITE_PROHIBITED*stringstatic#

Checks that your Amazon S3 buckets do not allow public write access.

S3_BUCKET_REPLICATION_ENABLEDstrings3_bucket_replication_enabledstrS3_BUCKET_REPLICATION_ENABLEDStringS3_BUCKET_REPLICATION_ENABLEDstringS3_BUCKET_REPLICATION_ENABLED*stringstatic#

Checks whether S3 buckets have cross-region replication enabled.

S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLEDstrings3_bucket_server_side_encryption_enabledstrS3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLEDStringS3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLEDstringS3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED*stringstatic#

Checks that your Amazon S3 bucket either has Amazon S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service.

S3_BUCKET_SSL_REQUESTS_ONLYstrings3_bucket_ssl_requests_onlystrS3_BUCKET_SSL_REQUESTS_ONLYStringS3_BUCKET_SSL_REQUESTS_ONLYstringS3_BUCKET_SSL_REQUESTS_ONLY*stringstatic#

Checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL).

S3_BUCKET_VERSIONING_ENABLEDstrings3_bucket_versioning_enabledstrS3_BUCKET_VERSIONING_ENABLEDStringS3_BUCKET_VERSIONING_ENABLEDstringS3_BUCKET_VERSIONING_ENABLED*stringstatic#

Checks whether versioning is enabled for your S3 buckets.

S3_DEFAULT_ENCRYPTION_KMSstrings3_default_encryption_kmsstrS3_DEFAULT_ENCRYPTION_KMSStringS3_DEFAULT_ENCRYPTION_KMSstringS3_DEFAULT_ENCRYPTION_KMS*stringstatic#

Checks whether the Amazon Simple Storage Service (Amazon S3) buckets are encrypted with AWS Key Management Service (AWS KMS).

S3_EVENT_NOTIFICATIONS_ENABLEDstrings3_event_notifications_enabledstrS3_EVENT_NOTIFICATIONS_ENABLEDStringS3_EVENT_NOTIFICATIONS_ENABLEDstringS3_EVENT_NOTIFICATIONS_ENABLED*stringstatic#

Checks if Amazon S3 Events Notifications are enabled on an S3 bucket.

S3_LAST_BACKUP_RECOVERY_POINT_CREATEDstrings3_last_backup_recovery_point_createdstrS3_LAST_BACKUP_RECOVERY_POINT_CREATEDStringS3_LAST_BACKUP_RECOVERY_POINT_CREATEDstringS3_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for Amazon Simple Storage Service (Amazon S3).

S3_LIFECYCLE_POLICY_CHECKstrings3_lifecycle_policy_checkstrS3_LIFECYCLE_POLICY_CHECKStringS3_LIFECYCLE_POLICY_CHECKstringS3_LIFECYCLE_POLICY_CHECK*stringstatic#

Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket.

S3_RESOURCES_PROTECTED_BY_BACKUP_PLANstrings3_resources_protected_by_backup_planstrS3_RESOURCES_PROTECTED_BY_BACKUP_PLANStringS3_RESOURCES_PROTECTED_BY_BACKUP_PLANstringS3_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if Amazon Simple Storage Service (Amazon S3) buckets are protected by a backup plan.

S3_VERSION_LIFECYCLE_POLICY_CHECKstrings3_version_lifecycle_policy_checkstrS3_VERSION_LIFECYCLE_POLICY_CHECKStringS3_VERSION_LIFECYCLE_POLICY_CHECKstringS3_VERSION_LIFECYCLE_POLICY_CHECK*stringstatic#

Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured.

SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGUREDstringsagemaker_endpoint_configuration_kms_key_configuredstrSAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGUREDStringSAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGUREDstringSAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED*stringstatic#

Checks whether AWS Key Management Service (KMS) key is configured for an Amazon SageMaker endpoint configuration.

SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGUREDstringsagemaker_notebook_instance_kms_key_configuredstrSAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGUREDStringSAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGUREDstringSAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED*stringstatic#

Check whether an AWS Key Management Service (KMS) key is configured for SageMaker notebook instance.

SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESSstringsagemaker_notebook_no_direct_internet_accessstrSAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESSStringSAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESSstringSAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS*stringstatic#

Checks whether direct internet access is disabled for an Amazon SageMaker notebook instance.

SECRETSMANAGER_ROTATION_ENABLED_CHECKstringsecretsmanager_rotation_enabled_checkstrSECRETSMANAGER_ROTATION_ENABLED_CHECKStringSECRETSMANAGER_ROTATION_ENABLED_CHECKstringSECRETSMANAGER_ROTATION_ENABLED_CHECK*stringstatic#

Checks whether AWS Secrets Manager secret has rotation enabled.

SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECKstringsecretsmanager_scheduled_rotation_success_checkstrSECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECKStringSECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECKstringSECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK*stringstatic#

Checks whether AWS Secrets Manager secret rotation has rotated successfully as per the rotation schedule.

SECRETSMANAGER_SECRET_PERIODIC_ROTATIONstringsecretsmanager_secret_periodic_rotationstrSECRETSMANAGER_SECRET_PERIODIC_ROTATIONStringSECRETSMANAGER_SECRET_PERIODIC_ROTATIONstringSECRETSMANAGER_SECRET_PERIODIC_ROTATION*stringstatic#

Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days.

SECRETSMANAGER_SECRET_UNUSEDstringsecretsmanager_secret_unusedstrSECRETSMANAGER_SECRET_UNUSEDStringSECRETSMANAGER_SECRET_UNUSEDstringSECRETSMANAGER_SECRET_UNUSED*stringstatic#

Checks if AWS Secrets Manager secrets have been accessed within a specified number of days.

SECRETSMANAGER_USING_CMKstringsecretsmanager_using_cmkstrSECRETSMANAGER_USING_CMKStringSECRETSMANAGER_USING_CMKstringSECRETSMANAGER_USING_CMK*stringstatic#

Checks if all secrets in AWS Secrets Manager are encrypted using the AWS managed key (aws/secretsmanager) or a customer managed key that was created in AWS Key Management Service (AWS KMS).

SECURITYHUB_ENABLEDstringsecurityhub_enabledstrSECURITYHUB_ENABLEDStringSECURITYHUB_ENABLEDstringSECURITYHUB_ENABLED*stringstatic#

Checks that AWS Security Hub is enabled for an AWS account.

SERVICE_VPC_ENDPOINT_ENABLEDstringservice_vpc_endpoint_enabledstrSERVICE_VPC_ENDPOINT_ENABLEDStringSERVICE_VPC_ENDPOINT_ENABLEDstringSERVICE_VPC_ENDPOINT_ENABLED*stringstatic#

Checks whether Service Endpoint for the service provided in rule parameter is created for each Amazon VPC.

SHIELD_ADVANCED_ENABLED_AUTO_RENEWstringshield_advanced_enabled_auto_renewstrSHIELD_ADVANCED_ENABLED_AUTO_RENEWStringSHIELD_ADVANCED_ENABLED_AUTO_RENEWstringSHIELD_ADVANCED_ENABLED_AUTO_RENEW*stringstatic#

Checks whether EBS volumes are attached to EC2 instances.

SHIELD_DRT_ACCESSstringshield_drt_accessstrSHIELD_DRT_ACCESSStringSHIELD_DRT_ACCESSstringSHIELD_DRT_ACCESS*stringstatic#

Verify that DDoS response team (DRT) can access AWS account.

SSM_DOCUMENT_NOT_PUBLICstringssm_document_not_publicstrSSM_DOCUMENT_NOT_PUBLICStringSSM_DOCUMENT_NOT_PUBLICstringSSM_DOCUMENT_NOT_PUBLIC*stringstatic#

Checks if AWS Systems Manager documents owned by the account are public.

STORAGEGATEWAY_LAST_BACKUP_RECOVERY_POINT_CREATEDstringstoragegateway_last_backup_recovery_point_createdstrSTORAGEGATEWAY_LAST_BACKUP_RECOVERY_POINT_CREATEDStringSTORAGEGATEWAY_LAST_BACKUP_RECOVERY_POINT_CREATEDstringSTORAGEGATEWAY_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for AWS Storage Gateway volumes.

SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLEDstringsubnet_auto_assign_public_ip_disabledstrSUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLEDStringSUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLEDstringSUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED*stringstatic#

hecks if Amazon Virtual Private Cloud (Amazon VPC) subnets are assigned a public IP address.

VIRTUALMACHINE_LAST_BACKUP_RECOVERY_POINT_CREATEDstringvirtualmachine_last_backup_recovery_point_createdstrVIRTUALMACHINE_LAST_BACKUP_RECOVERY_POINT_CREATEDStringVIRTUALMACHINE_LAST_BACKUP_RECOVERY_POINT_CREATEDstringVIRTUALMACHINE_LAST_BACKUP_RECOVERY_POINT_CREATED*stringstatic#

Checks if a recovery point was created for AWS Backup-Gateway VirtualMachines.

VIRTUALMACHINE_RESOURCES_PROTECTED_BY_BACKUP_PLANstringvirtualmachine_resources_protected_by_backup_planstrVIRTUALMACHINE_RESOURCES_PROTECTED_BY_BACKUP_PLANStringVIRTUALMACHINE_RESOURCES_PROTECTED_BY_BACKUP_PLANstringVIRTUALMACHINE_RESOURCES_PROTECTED_BY_BACKUP_PLAN*stringstatic#

Checks if AWS Backup-Gateway VirtualMachines are protected by a backup plan.

VPC_DEFAULT_SECURITY_GROUP_CLOSEDstringvpc_default_security_group_closedstrVPC_DEFAULT_SECURITY_GROUP_CLOSEDStringVPC_DEFAULT_SECURITY_GROUP_CLOSEDstringVPC_DEFAULT_SECURITY_GROUP_CLOSED*stringstatic#

Checks that the default security group of any Amazon Virtual Private Cloud (VPC) does not allow inbound or outbound traffic.

The rule returns NOT_APPLICABLE if the security group is not default.

VPC_FLOW_LOGS_ENABLEDstringvpc_flow_logs_enabledstrVPC_FLOW_LOGS_ENABLEDStringVPC_FLOW_LOGS_ENABLEDstringVPC_FLOW_LOGS_ENABLED*stringstatic#

Checks whether Amazon Virtual Private Cloud flow logs are found and enabled for Amazon VPC.

VPC_NETWORK_ACL_UNUSED_CHECKstringvpc_network_acl_unused_checkstrVPC_NETWORK_ACL_UNUSED_CHECKStringVPC_NETWORK_ACL_UNUSED_CHECKstringVPC_NETWORK_ACL_UNUSED_CHECK*stringstatic#

Checks if there are unused network access control lists (network ACLs).

VPC_PEERING_DNS_RESOLUTION_CHECKstringvpc_peering_dns_resolution_checkstrVPC_PEERING_DNS_RESOLUTION_CHECKStringVPC_PEERING_DNS_RESOLUTION_CHECKstringVPC_PEERING_DNS_RESOLUTION_CHECK*stringstatic#

Checks if DNS resolution from accepter/requester VPC to private IP is enabled.

VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTSstringvpc_sg_open_only_to_authorized_portsstrVPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTSStringVPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTSstringVPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS*stringstatic#

Checks whether the security group with 0.0.0.0/0 of any Amazon Virtual Private Cloud (Amazon VPC) allows only specific inbound TCP or UDP traffic.

VPC_VPN_2_TUNNELS_UPstringvpc_vpn_2_tunnels_upstrVPC_VPN_2_TUNNELS_UPStringVPC_VPN_2_TUNNELS_UPstringVPC_VPN_2_TUNNELS_UP*stringstatic#

Checks that both AWS Virtual Private Network tunnels provided by AWS Site-to-Site VPN are in UP status.

WAF_CLASSIC_LOGGING_ENABLEDstringwaf_classic_logging_enabledstrWAF_CLASSIC_LOGGING_ENABLEDStringWAF_CLASSIC_LOGGING_ENABLEDstringWAF_CLASSIC_LOGGING_ENABLED*stringstatic#

Checks if logging is enabled on AWS Web Application Firewall (WAF) classic global web ACLs.

WAF_GLOBAL_RULE_NOT_EMPTYstringwaf_global_rule_not_emptystrWAF_GLOBAL_RULE_NOT_EMPTYStringWAF_GLOBAL_RULE_NOT_EMPTYstringWAF_GLOBAL_RULE_NOT_EMPTY*stringstatic#

Checks if an AWS WAF global rule contains any conditions.

WAF_GLOBAL_RULEGROUP_NOT_EMPTYstringwaf_global_rulegroup_not_emptystrWAF_GLOBAL_RULEGROUP_NOT_EMPTYStringWAF_GLOBAL_RULEGROUP_NOT_EMPTYstringWAF_GLOBAL_RULEGROUP_NOT_EMPTY*stringstatic#

Checks if an AWS WAF Classic rule group contains any rules.

WAF_GLOBAL_WEBACL_NOT_EMPTYstringwaf_global_webacl_not_emptystrWAF_GLOBAL_WEBACL_NOT_EMPTYStringWAF_GLOBAL_WEBACL_NOT_EMPTYstringWAF_GLOBAL_WEBACL_NOT_EMPTY*stringstatic#

Checks whether a WAF Global Web ACL contains any WAF rules or rule groups.

WAF_REGIONAL_RULE_NOT_EMPTYstringwaf_regional_rule_not_emptystrWAF_REGIONAL_RULE_NOT_EMPTYStringWAF_REGIONAL_RULE_NOT_EMPTYstringWAF_REGIONAL_RULE_NOT_EMPTY*stringstatic#

Checks whether WAF regional rule contains conditions.

WAF_REGIONAL_RULEGROUP_NOT_EMPTYstringwaf_regional_rulegroup_not_emptystrWAF_REGIONAL_RULEGROUP_NOT_EMPTYStringWAF_REGIONAL_RULEGROUP_NOT_EMPTYstringWAF_REGIONAL_RULEGROUP_NOT_EMPTY*stringstatic#

Checks if WAF Regional rule groups contain any rules.

WAF_REGIONAL_WEBACL_NOT_EMPTYstringwaf_regional_webacl_not_emptystrWAF_REGIONAL_WEBACL_NOT_EMPTYStringWAF_REGIONAL_WEBACL_NOT_EMPTYstringWAF_REGIONAL_WEBACL_NOT_EMPTY*stringstatic#

Checks if a WAF regional Web ACL contains any WAF rules or rule groups.

WAFV2_LOGGING_ENABLEDstringwafv2_logging_enabledstrWAFV2_LOGGING_ENABLEDStringWAFV2_LOGGING_ENABLEDstringWAFV2_LOGGING_ENABLED*stringstatic#

Checks whether logging is enabled on AWS Web Application Firewall (WAFV2) regional and global web access control list (ACLs).

ManagedRuleIdentifiers Class ​

Example ​

Properties ​

ManagedRuleIdentifiers Class

Example

Properties