Regional limits on Security Hub CSPM controls

[ElastiCache.4] ElastiCache replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[RDS.31] RDS DB security groups should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.177] EC2 traffic mirror sessions should be tagged

[EC2.179] EC2 traffic mirror targets should be tagged

[ECR.4] ECR public repositories should be tagged

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.5] MSK connectors should have logging enabled

[RDS.1] RDS snapshot should be private

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.5] MSK connectors should have logging enabled

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[Account.2] AWS accounts should be part of an AWS Organizations organization

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppConfig.1] AWS AppConfig applications should be tagged

[AppConfig.2] AWS AppConfig configuration profiles should be tagged

[AppConfig.3] AWS AppConfig environments should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.4] AWS Backup report plans should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Cognito.2] Cognito identity pools should not allow unauthenticated identities

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[Detective.1] Detective behavior graphs should be tagged

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis OSS should have TLS enabled

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.175] EC2 launch templates should be tagged

[EC2.177] EC2 traffic mirror sessions should be tagged

[EC2.179] EC2 traffic mirror targets should be tagged

[EC2.180] EC2 network interfaces should have source/destination checking enabled

[ECR.4] ECR public repositories should be tagged

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

[GuardDuty.2] GuardDuty filters should be tagged

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.8] Unused IAM user credentials should be removed

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[Inspector.1] Amazon Inspector EC2 scanning should be enabled

[Inspector.2] Amazon Inspector ECR scanning should be enabled

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[Inspector.4] Amazon Inspector Lambda standard scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.4] MSK clusters should have public access disabled

[MSK.5] MSK connectors should have logging enabled

[MSK.6] MSK clusters should disable unauthenticated access

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.6] S3 general purpose bucket policies should restrict access to other AWS accounts

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.5] SageMaker models should have network isolation enabled

[SageMaker.6] SageMaker app image configurations should be tagged

[SageMaker.7] SageMaker images should be tagged

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SQS.3] SQS queue access policies should not allow public access

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[SSM.6] SSM Automation should have CloudWatch logging enabled

[SSM.7] SSM documents should have the block public sharing setting enabled

[Transfer.3] Transfer Family connectors should have logging enabled

[Transfer.4] Transfer Family agreements should be tagged

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] AWS WAF web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[Account.2] AWS accounts should be part of an AWS Organizations organization

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.4] AWS Backup report plans should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[Detective.1] Detective behavior graphs should be tagged

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis OSS should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.177] EC2 traffic mirror sessions should be tagged

[EC2.179] EC2 traffic mirror targets should be tagged

[ECR.4] ECR public repositories should be tagged

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[GuardDuty.2] GuardDuty filters should be tagged

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.5] MSK connectors should have logging enabled

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.31] RDS DB security groups should be tagged

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.11] S3 general purpose buckets should have event notifications enabled

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SQS.3] SQS queue access policies should not allow public access

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] AWS WAF web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[Account.1] Security contact information should be provided for an AWS account

[Account.2] AWS accounts should be part of an AWS Organizations organization

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppConfig.1] AWS AppConfig applications should be tagged

[AppConfig.2] AWS AppConfig configuration profiles should be tagged

[AppConfig.3] AWS AppConfig environments should be tagged

[AppConfig.4] AWS AppConfig extension associations should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.2] AWS AppSync should have field-level logging enabled

[AppSync.4] AWS AppSync GraphQL APIs should be tagged

[AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[Athena.4] Athena workgroups should have logging enabled

[AutoScaling.2] Amazon EC2 Auto Scaling group should cover multiple Availability Zones

[AutoScaling.3] Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

[AutoScaling.6] Auto Scaling groups should use multiple instance types in multiple Availability Zones

[AutoScaling.9] Amazon EC2 Auto Scaling groups should use Amazon EC2 launch templates

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.2] AWS Backup recovery points should be tagged

[Backup.3] AWS Backup vaults should be tagged

[Backup.4] AWS Backup report plans should be tagged

[Backup.5] AWS Backup backup plans should be tagged

[Batch.1] Batch job queues should be tagged

[Batch.2] Batch scheduling policies should be tagged

[Batch.3] Batch compute environments should be tagged

[Batch.4] Compute resources properties in managed Batch compute environments should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CloudTrail.10] CloudTrail Lake event data stores should be encrypted with customer managed AWS KMS keys

[CloudWatch.17] CloudWatch alarm actions should be activated

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration

[CodeBuild.7] CodeBuild report group exports should be encrypted at rest

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Cognito.2] Cognito identity pools should not allow unauthenticated identities

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DataSync.1] DataSync tasks should have logging enabled

[DataSync.2] DataSync tasks should be tagged

[Detective.1] Detective behavior graphs should be tagged

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis OSS should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.6] DynamoDB tables should have deletion protection enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.33] EC2 transit gateway attachments should be tagged

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports

[EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports

[EC2.55] VPCs should be configured with an interface endpoint for ECR API

[EC2.56] VPCs should be configured with an interface endpoint for Docker Registry

[EC2.57] VPCs should be configured with an interface endpoint for Systems Manager

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.171] EC2 VPN connections should have logging enabled

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.174] EC2 DHCP option sets should be tagged

[EC2.175] EC2 launch templates should be tagged

[EC2.176] EC2 prefix lists should be tagged

[EC2.177] EC2 traffic mirror sessions should be tagged

[EC2.178] EC2 traffic mirror filters should be tagged

[EC2.179] EC2 traffic mirror targets should be tagged

[EC2.180] EC2 network interfaces should have source/destination checking enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECR.5] ECR repositories should be encrypted with customer managed AWS KMS keys

[ECS.3] ECS task definitions should not share the host's process namespace

[ECS.4] ECS containers should run as non-privileged

[ECS.5] ECS containers should be limited to read-only access to root filesystems

[ECS.8] Secrets should not be passed as container environment variables

[ECS.9] ECS task definitions should have a logging configuration

[ECS.10] ECS Fargate services should run on the latest Fargate platform version

[ECS.12] ECS clusters should use Container Insights

[ECS.16] ECS task sets should not automatically assign public IP addresses

[ECS.17] ECS task definitions should not use host network mode

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with subnets that assign public IP addresses on launch

[EFS.7] EFS file systems should have automatic backups enabled

[EFS.8] EFS file systems should be encrypted at rest

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EKS.6] EKS clusters should be tagged

[EKS.7] EKS identity provider configurations should be tagged

[EKS.8] EKS clusters should have audit logging enabled

[ELB.10] Classic Load Balancer should span multiple Availability Zones

[ELB.12] Application Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled

[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled

[ElastiCache.4] ElastiCache replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[EMR.2] Amazon EMR block public access setting should be enabled

[EMR.3] Amazon EMR security configurations should be encrypted at rest

[EMR.4] Amazon EMR security configurations should be encrypted in transit

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[ES.9] Elasticsearch domains should be tagged

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[FSx.3] FSx for OpenZFS file systems should be configured for Multi-AZ deployment

[FSx.4] FSx for NetApp ONTAP file systems should be configured for Multi-AZ deployment

[FSx.5] FSx for Windows File Server file systems should be configured for Multi-AZ deployment

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] AWS Glue jobs should be tagged

[Glue.3] AWS Glue machine learning transforms should be encrypted at rest

[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[GuardDuty.5] GuardDuty EKS Audit Log Monitoring should be enabled

[GuardDuty.6] GuardDuty Lambda Protection should be enabled

[GuardDuty.7] GuardDuty EKS Runtime Monitoring should be enabled

[GuardDuty.8] GuardDuty Malware Protection for EC2 should be enabled

[GuardDuty.9] GuardDuty RDS Protection should be enabled

[GuardDuty.10] GuardDuty S3 Protection should be enabled

[GuardDuty.11] GuardDuty Runtime Monitoring should be enabled

[GuardDuty.12] GuardDuty ECS Runtime Monitoring should be enabled

[GuardDuty.13] GuardDuty EC2 Runtime Monitoring should be enabled

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.4] IAM root user access key should not exist

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.7] Password policies for IAM users should have strong configurations

[IAM.8] Unused IAM user credentials should be removed

[IAM.9] MFA should be enabled for the root user

[IAM.10] Password policies for IAM users should have strong configurations

[IAM.11] Ensure IAM password policy requires at least one uppercase letter

[IAM.12] Ensure IAM password policy requires at least one lowercase letter

[IAM.13] Ensure IAM password policy requires at least one symbol

[IAM.14] Ensure IAM password policy requires at least one number

[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater

[IAM.16] Ensure IAM password policy prevents password reuse

[IAM.17] Ensure IAM password policy expires passwords within 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.23] IAM Access Analyzer analyzers should be tagged

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IAM.28] IAM Access Analyzer external access analyzer should be enabled

[Inspector.1] Amazon Inspector EC2 scanning should be enabled

[Inspector.2] Amazon Inspector ECR scanning should be enabled

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[Inspector.4] Amazon Inspector Lambda standard scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[Kinesis.2] Kinesis streams should be tagged

[Kinesis.3] Kinesis streams should have an adequate data retention period

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[KMS.5] KMS keys should not be publicly accessible

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.4] MSK clusters should have public access disabled

[MSK.5] MSK connectors should have logging enabled

[MSK.6] MSK clusters should disable unauthenticated access

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[NetworkFirewall.10] Network Firewall firewalls should have subnet change protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[PCA.1] AWS Private CA root certificate authority should be disabled

[PCA.2] AWS Private CA certificate authorities should be tagged

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.18] RDS instances should be deployed in a VPC

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.25] RDS database instances should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.31] RDS DB security groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[RDS.36] RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs

[RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

[RDS.38] RDS for PostgreSQL DB instances should be encrypted in transit

[RDS.39] RDS for MySQL DB instances should be encrypted in transit

[RDS.40] RDS for SQL Server DB instances should publish logs to CloudWatch Logs

[RDS.41] RDS for SQL Server DB instances should be encrypted in transit

[RDS.42] RDS for MariaDB DB instances should publish logs to CloudWatch Logs

[RDS.44] RDS for MariaDB DB instances should be encrypted in transit

[RDS.45] Aurora MySQL DB clusters should have audit logging enabled

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled

[Redshift.8] Amazon Redshift clusters should not use the default Admin username

[Redshift.9] Redshift clusters should not use the default database name

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.11] Redshift clusters should be tagged

[Redshift.13] Redshift cluster snapshots should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Redshift.16] Redshift cluster subnet groups should have subnets from multiple Availability Zones

[Redshift.17] Redshift cluster parameter groups should be tagged

[Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.7] S3 general purpose buckets should use cross-Region replication

[S3.10] S3 general purpose buckets with versioning enabled should have Lifecycle configurations

[S3.11] S3 general purpose buckets should have event notifications enabled

[S3.12] ACLs should not be used to manage user access to S3 general purpose buckets

[S3.13] S3 general purpose buckets should have Lifecycle configurations

[S3.19] S3 access points should have block public access settings enabled

[S3.20] S3 general purpose buckets should have MFA delete enabled

[S3.22] S3 general purpose buckets should log object-level write events

[S3.23] S3 general purpose buckets should log object-level read events

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SageMaker.5] SageMaker models should have network isolation enabled

[SageMaker.6] SageMaker app image configurations should be tagged

[SageMaker.7] SageMaker images should be tagged

[SageMaker.8] SageMaker notebook instances should run on supported platforms

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only

[SNS.4] SNS topic access policies should not allow public access

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SQS.3] SQS queue access policies should not allow public access

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[SSM.4] SSM documents should not be public

[SSM.5] SSM documents should be tagged

[SSM.6] SSM Automation should have CloudWatch logging enabled

[SSM.7] SSM documents should have the block public sharing setting enabled

[StepFunctions.1] Step Functions state machines should have logging turned on

[StepFunctions.2] Step Functions activities should be tagged

[Transfer.1] AWS Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[Transfer.3] Transfer Family connectors should have logging enabled

[Transfer.4] Transfer Family agreements should be tagged

[Transfer.5] Transfer Family certificates should be tagged

[Transfer.6] Transfer Family connectors should be tagged

[Transfer.7] Transfer Family profiles should be tagged

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.2] AWS WAF Classic Regional rules should have at least one condition

[WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

[WAF.4] AWS WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] AWS WAF web ACLs should have at least one rule or rule group

[WAF.12] AWS WAF rules should have CloudWatch metrics enabled

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.2] AWS AppSync should have field-level logging enabled

[AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.4] AWS Backup report plans should be tagged

[Batch.1] Batch job queues should be tagged

[Batch.3] Batch compute environments should be tagged

[Batch.4] Compute resources properties in managed Batch compute environments should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[Detective.1] Detective behavior graphs should be tagged

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis OSS should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.175] EC2 launch templates should be tagged

[ECR.4] ECR public repositories should be tagged

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled

[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled

[ElastiCache.4] ElastiCache replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.3] FSx for OpenZFS file systems should be configured for Multi-AZ deployment

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

[GuardDuty.2] GuardDuty filters should be tagged

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.8] Unused IAM user credentials should be removed

[IAM.10] Password policies for IAM users should have strong configurations

[IAM.11] Ensure IAM password policy requires at least one uppercase letter

[IAM.12] Ensure IAM password policy requires at least one lowercase letter

[IAM.13] Ensure IAM password policy requires at least one symbol

[IAM.14] Ensure IAM password policy requires at least one number

[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater

[IAM.16] Ensure IAM password policy prevents password reuse

[IAM.17] Ensure IAM password policy expires passwords within 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[Inspector.1] Amazon Inspector EC2 scanning should be enabled

[Inspector.2] Amazon Inspector ECR scanning should be enabled

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[Inspector.4] Amazon Inspector Lambda standard scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.5] MSK connectors should have logging enabled

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[RDS.1] RDS snapshot should be private

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.15] RDS DB clusters should be configured for multiple Availability Zones

[RDS.31] RDS DB security groups should be tagged

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.5] SageMaker models should have network isolation enabled

[SageMaker.6] SageMaker app image configurations should be tagged

[SageMaker.7] SageMaker images should be tagged

[SageMaker.8] SageMaker notebook instances should run on supported platforms

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SQS.3] SQS queue access policies should not allow public access

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[SSM.4] SSM documents should not be public

[SSM.7] SSM documents should have the block public sharing setting enabled

[StepFunctions.1] Step Functions state machines should have logging turned on

[Transfer.3] Transfer Family connectors should have logging enabled

[Transfer.4] Transfer Family agreements should be tagged

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[RDS.31] RDS DB security groups should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.4] AWS Backup report plans should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[Detective.1] Detective behavior graphs should be tagged

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

[EC2.20] Both VPN tunnels for an AWS Site-to-Site VPN connection should be up

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.55] VPCs should be configured with an interface endpoint for ECR API

[EC2.56] VPCs should be configured with an interface endpoint for Docker Registry

[EC2.57] VPCs should be configured with an interface endpoint for Systems Manager

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager

[ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination

[ELB.4] Application Load Balancer should be configured to drop invalid http headers

[ELB.6] Application, Gateway, and Network Load Balancers should have deletion protection enabled

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong AWS Configuration

[ELB.16] Application Load Balancers should be associated with an AWS WAF web ACL

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.4] IAM root user access key should not exist

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.5] MSK connectors should have logging enabled

[RDS.31] RDS DB security groups should be tagged

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] AWS WAF web ACLs should have at least one rule or rule group

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.2] Cognito identity pools should not allow unauthenticated identities

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.180] EC2 network interfaces should have source/destination checking enabled

[ECR.4] ECR public repositories should be tagged

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled

[MSK.4] MSK clusters should have public access disabled

[MSK.5] MSK connectors should have logging enabled

[MSK.6] MSK clusters should disable unauthenticated access

[RDS.31] RDS DB security groups should be tagged

[Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SSM.6] SSM Automation should have CloudWatch logging enabled

[SSM.7] SSM documents should have the block public sharing setting enabled

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[ACM.3] ACM certificates should be tagged

[Account.1] Security contact information should be provided for an AWS account

[Account.2] AWS accounts should be part of an AWS Organizations organization

[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

[APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

[APIGateway.3] API Gateway REST API stages should have AWS X-Ray tracing enabled

[APIGateway.4] API Gateway should be associated with a WAF Web ACL

[APIGateway.5] API Gateway REST API cache data should be encrypted at rest

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppConfig.1] AWS AppConfig applications should be tagged

[AppConfig.2] AWS AppConfig configuration profiles should be tagged

[AppConfig.3] AWS AppConfig environments should be tagged

[AppConfig.4] AWS AppConfig extension associations should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.2] AWS AppSync should have field-level logging enabled

[AppSync.4] AWS AppSync GraphQL APIs should be tagged

[AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[Athena.4] Athena workgroups should have logging enabled

[AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks

[AutoScaling.2] Amazon EC2 Auto Scaling group should cover multiple Availability Zones

[AutoScaling.3] Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

[AutoScaling.6] Auto Scaling groups should use multiple instance types in multiple Availability Zones

[AutoScaling.9] Amazon EC2 Auto Scaling groups should use Amazon EC2 launch templates

[AutoScaling.10] EC2 Auto Scaling groups should be tagged

[Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.2] AWS Backup recovery points should be tagged

[Backup.3] AWS Backup vaults should be tagged

[Backup.4] AWS Backup report plans should be tagged

[Backup.5] AWS Backup backup plans should be tagged

[Batch.1] Batch job queues should be tagged

[Batch.2] Batch scheduling policies should be tagged

[Batch.3] Batch compute environments should be tagged

[Batch.4] Compute resources properties in managed Batch compute environments should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CloudTrail.9] CloudTrail trails should be tagged

[CloudTrail.10] CloudTrail Lake event data stores should be encrypted with customer managed AWS KMS keys

[CloudWatch.17] CloudWatch alarm actions should be activated

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration

[CodeBuild.7] CodeBuild report group exports should be encrypted at rest

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Cognito.2] Cognito identity pools should not allow unauthenticated identities

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DataSync.1] DataSync tasks should have logging enabled

[DataSync.2] DataSync tasks should be tagged

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis OSS should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.5] DynamoDB tables should be tagged

[DynamoDB.6] DynamoDB tables should have deletion protection enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service

[EC2.19] Security groups should not allow unrestricted access to ports with high risk

[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.33] EC2 transit gateway attachments should be tagged

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.35] EC2 network interfaces should be tagged

[EC2.36] EC2 customer gateways should be tagged

[EC2.37] EC2 Elastic IP addresses should be tagged

[EC2.38] EC2 instances should be tagged

[EC2.39] EC2 internet gateways should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.41] EC2 network ACLs should be tagged

[EC2.42] EC2 route tables should be tagged

[EC2.43] EC2 security groups should be tagged

[EC2.44] EC2 subnets should be tagged

[EC2.45] EC2 volumes should be tagged

[EC2.46] Amazon VPCs should be tagged

[EC2.47] Amazon VPC endpoint services should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.49] Amazon VPC peering connections should be tagged

[EC2.50] EC2 VPN gateways should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports

[EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports

[EC2.55] VPCs should be configured with an interface endpoint for ECR API

[EC2.56] VPCs should be configured with an interface endpoint for Docker Registry

[EC2.57] VPCs should be configured with an interface endpoint for Systems Manager

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.171] EC2 VPN connections should have logging enabled

[EC2.172] EC2 VPC Block Public Access settings should block internet gateway traffic

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.174] EC2 DHCP option sets should be tagged

[EC2.175] EC2 launch templates should be tagged

[EC2.176] EC2 prefix lists should be tagged

[EC2.177] EC2 traffic mirror sessions should be tagged

[EC2.178] EC2 traffic mirror filters should be tagged

[EC2.179] EC2 traffic mirror targets should be tagged

[EC2.180] EC2 network interfaces should have source/destination checking enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECR.5] ECR repositories should be encrypted with customer managed AWS KMS keys

[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions

[ECS.2] ECS services should not have public IP addresses assigned to them automatically

[ECS.3] ECS task definitions should not share the host's process namespace

[ECS.4] ECS containers should run as non-privileged

[ECS.5] ECS containers should be limited to read-only access to root filesystems

[ECS.8] Secrets should not be passed as container environment variables

[ECS.9] ECS task definitions should have a logging configuration

[ECS.10] ECS Fargate services should run on the latest Fargate platform version

[ECS.12] ECS clusters should use Container Insights

[ECS.13] ECS services should be tagged

[ECS.14] ECS clusters should be tagged

[ECS.15] ECS task definitions should be tagged

[ECS.16] ECS task sets should not automatically assign public IP addresses

[ECS.17] ECS task definitions should not use host network mode

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with subnets that assign public IP addresses on launch

[EFS.7] EFS file systems should have automatic backups enabled

[EFS.8] EFS file systems should be encrypted at rest

[EKS.1] EKS cluster endpoints should not be publicly accessible

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EKS.6] EKS clusters should be tagged

[EKS.7] EKS identity provider configurations should be tagged

[EKS.8] EKS clusters should have audit logging enabled

[ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager

[ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination

[ELB.7] Classic Load Balancers should have connection draining enabled

[ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong AWS Configuration

[ELB.10] Classic Load Balancer should span multiple Availability Zones

[ELB.12] Application Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.16] Application Load Balancers should be associated with an AWS WAF web ACL

[ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled

[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled

[ElastiCache.4] ElastiCache replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[EMR.2] Amazon EMR block public access setting should be enabled

[EMR.3] Amazon EMR security configurations should be encrypted at rest

[EMR.4] Amazon EMR security configurations should be encrypted in transit

[ES.1] Elasticsearch domains should have encryption at-rest enabled

[ES.2] Elasticsearch domains should not be publicly accessible

[ES.3] Elasticsearch domains should encrypt data sent between nodes

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[ES.5] Elasticsearch domains should have audit logging enabled

[ES.6] Elasticsearch domains should have at least three data nodes

[ES.7] Elasticsearch domains should be configured with at least three dedicated master nodes

[ES.8] Connections to Elasticsearch domains should be encrypted using the latest TLS security policy

[ES.9] Elasticsearch domains should be tagged

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[FSx.3] FSx for OpenZFS file systems should be configured for Multi-AZ deployment

[FSx.4] FSx for NetApp ONTAP file systems should be configured for Multi-AZ deployment

[FSx.5] FSx for Windows File Server file systems should be configured for Multi-AZ deployment

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] AWS Glue jobs should be tagged

[Glue.3] AWS Glue machine learning transforms should be encrypted at rest

[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

[GuardDuty.1] GuardDuty should be enabled

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[GuardDuty.5] GuardDuty EKS Audit Log Monitoring should be enabled

[GuardDuty.6] GuardDuty Lambda Protection should be enabled

[GuardDuty.7] GuardDuty EKS Runtime Monitoring should be enabled

[GuardDuty.8] GuardDuty Malware Protection for EC2 should be enabled

[GuardDuty.9] GuardDuty RDS Protection should be enabled

[GuardDuty.10] GuardDuty S3 Protection should be enabled

[GuardDuty.11] GuardDuty Runtime Monitoring should be enabled

[GuardDuty.12] GuardDuty ECS Runtime Monitoring should be enabled

[GuardDuty.13] GuardDuty EC2 Runtime Monitoring should be enabled

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.4] IAM root user access key should not exist

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.7] Password policies for IAM users should have strong configurations

[IAM.8] Unused IAM user credentials should be removed

[IAM.9] MFA should be enabled for the root user

[IAM.10] Password policies for IAM users should have strong configurations

[IAM.11] Ensure IAM password policy requires at least one uppercase letter

[IAM.12] Ensure IAM password policy requires at least one lowercase letter

[IAM.13] Ensure IAM password policy requires at least one symbol

[IAM.14] Ensure IAM password policy requires at least one number

[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater

[IAM.16] Ensure IAM password policy prevents password reuse

[IAM.17] Ensure IAM password policy expires passwords within 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.23] IAM Access Analyzer analyzers should be tagged

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IAM.28] IAM Access Analyzer external access analyzer should be enabled

[Inspector.1] Amazon Inspector EC2 scanning should be enabled

[Inspector.2] Amazon Inspector ECR scanning should be enabled

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[Inspector.4] Amazon Inspector Lambda standard scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[Kinesis.2] Kinesis streams should be tagged

[Kinesis.3] Kinesis streams should have an adequate data retention period

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[KMS.3] AWS KMS keys should not be deleted unintentionally

[KMS.5] KMS keys should not be publicly accessible

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Lambda.6] Lambda functions should be tagged

[Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.4] MSK clusters should have public access disabled

[MSK.5] MSK connectors should have logging enabled

[MSK.6] MSK clusters should disable unauthenticated access

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.7] Network Firewall firewalls should be tagged

[NetworkFirewall.8] Network Firewall firewall policies should be tagged

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[NetworkFirewall.10] Network Firewall firewalls should have subnet change protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[PCA.1] AWS Private CA root certificate authority should be disabled

[PCA.2] AWS Private CA certificate authorities should be tagged

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.16] Aurora DB clusters should be configured to copy tags to DB snapshots

[RDS.17] RDS DB instances should be configured to copy tags to snapshots

[RDS.18] RDS instances should be deployed in a VPC

[RDS.19] Existing RDS event notification subscriptions should be configured for critical cluster events

[RDS.20] Existing RDS event notification subscriptions should be configured for critical database instance events

[RDS.21] An RDS event notifications subscription should be configured for critical database parameter group events

[RDS.22] An RDS event notifications subscription should be configured for critical database security group events

[RDS.23] RDS instances should not use a database engine default port

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.25] RDS database instances should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.28] RDS DB clusters should be tagged

[RDS.29] RDS DB cluster snapshots should be tagged

[RDS.30] RDS DB instances should be tagged

[RDS.31] RDS DB security groups should be tagged

[RDS.32] RDS DB snapshots should be tagged

[RDS.33] RDS DB subnet groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[RDS.36] RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs

[RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

[RDS.38] RDS for PostgreSQL DB instances should be encrypted in transit

[RDS.39] RDS for MySQL DB instances should be encrypted in transit

[RDS.40] RDS for SQL Server DB instances should publish logs to CloudWatch Logs

[RDS.41] RDS for SQL Server DB instances should be encrypted in transit

[RDS.42] RDS for MariaDB DB instances should publish logs to CloudWatch Logs

[RDS.44] RDS for MariaDB DB instances should be encrypted in transit

[RDS.45] Aurora MySQL DB clusters should have audit logging enabled

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.4] Amazon Redshift clusters should have audit logging enabled

[Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.8] Amazon Redshift clusters should not use the default Admin username

[Redshift.9] Redshift clusters should not use the default database name

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.11] Redshift clusters should be tagged

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.13] Redshift cluster snapshots should be tagged

[Redshift.14] Redshift cluster subnet groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Redshift.16] Redshift cluster subnet groups should have subnets from multiple Availability Zones

[Redshift.17] Redshift cluster parameter groups should be tagged

[Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.7] S3 general purpose buckets should use cross-Region replication

[S3.10] S3 general purpose buckets with versioning enabled should have Lifecycle configurations

[S3.11] S3 general purpose buckets should have event notifications enabled

[S3.12] ACLs should not be used to manage user access to S3 general purpose buckets

[S3.13] S3 general purpose buckets should have Lifecycle configurations

[S3.17] S3 general purpose buckets should be encrypted at rest with AWS KMS keys

[S3.19] S3 access points should have block public access settings enabled

[S3.20] S3 general purpose buckets should have MFA delete enabled

[S3.22] S3 general purpose buckets should log object-level write events

[S3.23] S3 general purpose buckets should log object-level read events

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SageMaker.5] SageMaker models should have network isolation enabled

[SageMaker.6] SageMaker app image configurations should be tagged

[SageMaker.7] SageMaker images should be tagged

[SageMaker.8] SageMaker notebook instances should run on supported platforms

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[SecretsManager.1] Secrets Manager secrets should have automatic rotation enabled

[SecretsManager.2] Secrets Manager secrets configured with automatic rotation should rotate successfully

[SecretsManager.3] Remove unused Secrets Manager secrets

[SecretsManager.4] Secrets Manager secrets should be rotated within a specified number of days

[SecretsManager.5] Secrets Manager secrets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only

[SNS.3] SNS topics should be tagged

[SNS.4] SNS topic access policies should not allow public access

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SQS.3] SQS queue access policies should not allow public access

[SSM.1] Amazon EC2 instances should be managed by AWS Systems Manager

[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[SSM.4] SSM documents should not be public

[SSM.5] SSM documents should be tagged

[SSM.6] SSM Automation should have CloudWatch logging enabled

[SSM.7] SSM documents should have the block public sharing setting enabled

[StepFunctions.1] Step Functions state machines should have logging turned on

[StepFunctions.2] Step Functions activities should be tagged

[Transfer.1] AWS Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[Transfer.3] Transfer Family connectors should have logging enabled

[Transfer.4] Transfer Family agreements should be tagged

[Transfer.5] Transfer Family certificates should be tagged

[Transfer.6] Transfer Family connectors should be tagged

[Transfer.7] Transfer Family profiles should be tagged

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.2] AWS WAF Classic Regional rules should have at least one condition

[WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

[WAF.4] AWS WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] AWS WAF web ACLs should have at least one rule or rule group

[WAF.11] AWS WAF web ACL logging should be enabled

[WAF.12] AWS WAF rules should have CloudWatch metrics enabled

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[Account.1] Security contact information should be provided for an AWS account

[Account.2] AWS accounts should be part of an AWS Organizations organization

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppConfig.1] AWS AppConfig applications should be tagged

[AppConfig.2] AWS AppConfig configuration profiles should be tagged

[AppConfig.3] AWS AppConfig environments should be tagged

[AppConfig.4] AWS AppConfig extension associations should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.2] AWS AppSync should have field-level logging enabled

[AppSync.4] AWS AppSync GraphQL APIs should be tagged

[AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Athena.2] Athena data catalogs should be tagged

[Athena.3] Athena workgroups should be tagged

[Athena.4] Athena workgroups should have logging enabled

[AutoScaling.2] Amazon EC2 Auto Scaling group should cover multiple Availability Zones

[AutoScaling.3] Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

[AutoScaling.6] Auto Scaling groups should use multiple instance types in multiple Availability Zones

[AutoScaling.9] Amazon EC2 Auto Scaling groups should use Amazon EC2 launch templates

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.2] AWS Backup recovery points should be tagged

[Backup.3] AWS Backup vaults should be tagged

[Backup.4] AWS Backup report plans should be tagged

[Backup.5] AWS Backup backup plans should be tagged

[Batch.1] Batch job queues should be tagged

[Batch.2] Batch scheduling policies should be tagged

[Batch.3] Batch compute environments should be tagged

[Batch.4] Compute resources properties in managed Batch compute environments should be tagged

[CloudFormation.2] CloudFormation stacks should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CloudTrail.10] CloudTrail Lake event data stores should be encrypted with customer managed AWS KMS keys

[CloudWatch.17] CloudWatch alarm actions should be activated

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration

[CodeBuild.7] CodeBuild report group exports should be encrypted at rest

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Cognito.2] Cognito identity pools should not allow unauthenticated identities

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled

[DataFirehose.1] Firehose delivery streams should be encrypted at rest

[DataSync.1] DataSync tasks should have logging enabled

[DataSync.2] DataSync tasks should be tagged

[Detective.1] Detective behavior graphs should be tagged

[DMS.1] Database Migration Service replication instances should not be public

[DMS.2] DMS certificates should be tagged

[DMS.3] DMS event subscriptions should be tagged

[DMS.4] DMS replication instances should be tagged

[DMS.5] DMS replication subnet groups should be tagged

[DMS.6] DMS replication instances should have automatic minor version upgrade enabled

[DMS.7] DMS replication tasks for the target database should have logging enabled

[DMS.8] DMS replication tasks for the source database should have logging enabled

[DMS.9] DMS endpoints should use SSL

[DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

[DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

[DMS.12] DMS endpoints for Redis OSS should have TLS enabled

[DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

[DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

[DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

[DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.4] DynamoDB tables should be present in a backup plan

[DynamoDB.6] DynamoDB tables should have deletion protection enabled

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.4] Stopped EC2 instances should be removed after a specified time period

[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389

[EC2.22] Unused Amazon EC2 security groups should be removed

[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

[EC2.28] EBS volumes should be covered by a backup plan

[EC2.33] EC2 transit gateway attachments should be tagged

[EC2.34] EC2 transit gateway route tables should be tagged

[EC2.40] EC2 NAT gateways should be tagged

[EC2.48] Amazon VPC flow logs should be tagged

[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

[EC2.52] EC2 transit gateways should be tagged

[EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports

[EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports

[EC2.55] VPCs should be configured with an interface endpoint for ECR API

[EC2.56] VPCs should be configured with an interface endpoint for Docker Registry

[EC2.57] VPCs should be configured with an interface endpoint for Systems Manager

[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts

[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager

[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

[EC2.171] EC2 VPN connections should have logging enabled

[EC2.172] EC2 VPC Block Public Access settings should block internet gateway traffic

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[EC2.174] EC2 DHCP option sets should be tagged

[EC2.175] EC2 launch templates should be tagged

[EC2.176] EC2 prefix lists should be tagged

[EC2.177] EC2 traffic mirror sessions should be tagged

[EC2.178] EC2 traffic mirror filters should be tagged

[EC2.179] EC2 traffic mirror targets should be tagged

[EC2.180] EC2 network interfaces should have source/destination checking enabled

[ECR.1] ECR private repositories should have image scanning configured

[ECR.2] ECR private repositories should have tag immutability configured

[ECR.3] ECR repositories should have at least one lifecycle policy configured

[ECR.4] ECR public repositories should be tagged

[ECR.5] ECR repositories should be encrypted with customer managed AWS KMS keys

[ECS.3] ECS task definitions should not share the host's process namespace

[ECS.4] ECS containers should run as non-privileged

[ECS.5] ECS containers should be limited to read-only access to root filesystems

[ECS.8] Secrets should not be passed as container environment variables

[ECS.9] ECS task definitions should have a logging configuration

[ECS.10] ECS Fargate services should run on the latest Fargate platform version

[ECS.12] ECS clusters should use Container Insights

[ECS.16] ECS task sets should not automatically assign public IP addresses

[ECS.17] ECS task definitions should not use host network mode

[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

[EFS.2] Amazon EFS volumes should be in backup plans

[EFS.3] EFS access points should enforce a root directory

[EFS.4] EFS access points should enforce a user identity

[EFS.5] EFS access points should be tagged

[EFS.6] EFS mount targets should not be associated with subnets that assign public IP addresses on launch

[EFS.7] EFS file systems should have automatic backups enabled

[EFS.8] EFS file systems should be encrypted at rest

[EKS.2] EKS clusters should run on a supported Kubernetes version

[EKS.3] EKS clusters should use encrypted Kubernetes secrets

[EKS.6] EKS clusters should be tagged

[EKS.7] EKS identity provider configurations should be tagged

[EKS.8] EKS clusters should have audit logging enabled

[ELB.10] Classic Load Balancer should span multiple Availability Zones

[ELB.12] Application Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

[ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

[ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

[ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled

[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled

[ElastiCache.4] ElastiCache replication groups should be encrypted at rest

[ElastiCache.5] ElastiCache replication groups should be encrypted in transit

[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

[ElastiCache.7] ElastiCache clusters should not use the default subnet group

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

[EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

[EMR.2] Amazon EMR block public access setting should be enabled

[EMR.3] Amazon EMR security configurations should be encrypted at rest

[EMR.4] Amazon EMR security configurations should be encrypted in transit

[ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

[ES.9] Elasticsearch domains should be tagged

[EventBridge.2] EventBridge event buses should be tagged

[EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

[EventBridge.4] EventBridge global endpoints should have event replication enabled

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

[FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

[FSx.3] FSx for OpenZFS file systems should be configured for Multi-AZ deployment

[FSx.4] FSx for NetApp ONTAP file systems should be configured for Multi-AZ deployment

[FSx.5] FSx for Windows File Server file systems should be configured for Multi-AZ deployment

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[Glue.1] AWS Glue jobs should be tagged

[Glue.3] AWS Glue machine learning transforms should be encrypted at rest

[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

[GuardDuty.1] GuardDuty should be enabled

[GuardDuty.2] GuardDuty filters should be tagged

[GuardDuty.3] GuardDuty IPSets should be tagged

[GuardDuty.4] GuardDuty detectors should be tagged

[GuardDuty.5] GuardDuty EKS Audit Log Monitoring should be enabled

[GuardDuty.6] GuardDuty Lambda Protection should be enabled

[GuardDuty.7] GuardDuty EKS Runtime Monitoring should be enabled

[GuardDuty.8] GuardDuty Malware Protection for EC2 should be enabled

[GuardDuty.9] GuardDuty RDS Protection should be enabled

[GuardDuty.10] GuardDuty S3 Protection should be enabled

[GuardDuty.11] GuardDuty Runtime Monitoring should be enabled

[GuardDuty.12] GuardDuty ECS Runtime Monitoring should be enabled

[GuardDuty.13] GuardDuty EC2 Runtime Monitoring should be enabled

[IAM.1] IAM policies should not allow full "*" administrative privileges

[IAM.2] IAM users should not have IAM policies attached

[IAM.3] IAM users' access keys should be rotated every 90 days or less

[IAM.4] IAM root user access key should not exist

[IAM.5] MFA should be enabled for all IAM users that have a console password

[IAM.6] Hardware MFA should be enabled for the root user

[IAM.7] Password policies for IAM users should have strong configurations

[IAM.8] Unused IAM user credentials should be removed

[IAM.9] MFA should be enabled for the root user

[IAM.10] Password policies for IAM users should have strong configurations

[IAM.11] Ensure IAM password policy requires at least one uppercase letter

[IAM.12] Ensure IAM password policy requires at least one lowercase letter

[IAM.13] Ensure IAM password policy requires at least one symbol

[IAM.14] Ensure IAM password policy requires at least one number

[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater

[IAM.16] Ensure IAM password policy prevents password reuse

[IAM.17] Ensure IAM password policy expires passwords within 90 days or less

[IAM.18] Ensure a support role has been created to manage incidents with AWS Support

[IAM.19] MFA should be enabled for all IAM users

[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

[IAM.22] IAM user credentials unused for 45 days should be removed

[IAM.23] IAM Access Analyzer analyzers should be tagged

[IAM.24] IAM roles should be tagged

[IAM.25] IAM users should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

[IAM.28] IAM Access Analyzer external access analyzer should be enabled

[Inspector.1] Amazon Inspector EC2 scanning should be enabled

[Inspector.2] Amazon Inspector ECR scanning should be enabled

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[Inspector.4] Amazon Inspector Lambda standard scanning should be enabled

[IoT.1] AWS IoT Device Defender security profiles should be tagged

[IoT.2] AWS IoT Core mitigation actions should be tagged

[IoT.3] AWS IoT Core dimensions should be tagged

[IoT.4] AWS IoT Core authorizers should be tagged

[IoT.5] AWS IoT Core role aliases should be tagged

[IoT.6] AWS IoT Core policies should be tagged

[IoTEvents.1] AWS IoT Events inputs should be tagged

[IoTEvents.2] AWS IoT Events detector models should be tagged

[IoTEvents.3] AWS IoT Events alarm models should be tagged

[IoTSiteWise.1] AWS IoT SiteWise asset models should be tagged

[IoTSiteWise.2] AWS IoT SiteWise dashboards should be tagged

[IoTSiteWise.3] AWS IoT SiteWise gateways should be tagged

[IoTSiteWise.4] AWS IoT SiteWise portals should be tagged

[IoTSiteWise.5] AWS IoT SiteWise projects should be tagged

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

[Kinesis.1] Kinesis streams should be encrypted at rest

[Kinesis.2] Kinesis streams should be tagged

[Kinesis.3] Kinesis streams should have an adequate data retention period

[KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

[KMS.5] KMS keys should not be publicly accessible

[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

[Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled

[Macie.1] Amazon Macie should be enabled

[Macie.2] Macie automated sensitive data discovery should be enabled

[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled

[MQ.4] Amazon MQ brokers should be tagged

[MQ.5] ActiveMQ brokers should use active/standby deployment mode

[MQ.6] RabbitMQ brokers should use cluster deployment mode

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

[MSK.2] MSK clusters should have enhanced monitoring configured

[MSK.3] MSK Connect connectors should be encrypted in transit

[MSK.4] MSK clusters should have public access disabled

[MSK.5] MSK connectors should have logging enabled

[MSK.6] MSK clusters should disable unauthenticated access

[Neptune.1] Neptune DB clusters should be encrypted at rest

[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

[Neptune.3] Neptune DB cluster snapshots should not be public

[Neptune.4] Neptune DB clusters should have deletion protection enabled

[Neptune.5] Neptune DB clusters should have automated backups enabled

[Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

[Neptune.7] Neptune DB clusters should have IAM database authentication enabled

[Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

[Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

[NetworkFirewall.2] Network Firewall logging should be enabled

[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

[NetworkFirewall.10] Network Firewall firewalls should have subnet change protection enabled

[Opensearch.1] OpenSearch domains should have encryption at rest enabled

[Opensearch.2] OpenSearch domains should not be publicly accessible

[Opensearch.3] OpenSearch domains should encrypt data sent between nodes

[Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

[Opensearch.5] OpenSearch domains should have audit logging enabled

[Opensearch.6] OpenSearch domains should have at least three data nodes

[Opensearch.7] OpenSearch domains should have fine-grained access control enabled

[Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

[Opensearch.9] OpenSearch domains should be tagged

[Opensearch.10] OpenSearch domains should have the latest software update installed

[Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

[PCA.1] AWS Private CA root certificate authority should be disabled

[PCA.2] AWS Private CA certificate authorities should be tagged

[RDS.14] Amazon Aurora clusters should have backtracking enabled

[RDS.18] RDS instances should be deployed in a VPC

[RDS.24] RDS Database clusters should use a custom administrator username

[RDS.25] RDS database instances should use a custom administrator username

[RDS.26] RDS DB instances should be protected by a backup plan

[RDS.27] RDS DB clusters should be encrypted at rest

[RDS.31] RDS DB security groups should be tagged

[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

[RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

[RDS.36] RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs

[RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

[RDS.38] RDS for PostgreSQL DB instances should be encrypted in transit

[RDS.39] RDS for MySQL DB instances should be encrypted in transit

[RDS.40] RDS for SQL Server DB instances should publish logs to CloudWatch Logs

[RDS.41] RDS for SQL Server DB instances should be encrypted in transit

[RDS.42] RDS for MariaDB DB instances should publish logs to CloudWatch Logs

[RDS.44] RDS for MariaDB DB instances should be encrypted in transit

[RDS.45] Aurora MySQL DB clusters should have audit logging enabled

[Redshift.1] Amazon Redshift clusters should prohibit public access

[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

[Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

[Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled

[Redshift.7] Redshift clusters should use enhanced VPC routing

[Redshift.8] Amazon Redshift clusters should not use the default Admin username

[Redshift.9] Redshift clusters should not use the default database name

[Redshift.10] Redshift clusters should be encrypted at rest

[Redshift.11] Redshift clusters should be tagged

[Redshift.12] Redshift event notification subscriptions should be tagged

[Redshift.13] Redshift cluster snapshots should be tagged

[Redshift.14] Redshift cluster subnet groups should be tagged

[Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

[Redshift.16] Redshift cluster subnet groups should have subnets from multiple Availability Zones

[Redshift.17] Redshift cluster parameter groups should be tagged

[Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

[RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

[RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

[RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

[RedshiftServerless.4] Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

[RedshiftServerless.5] Redshift Serverless namespaces should not use the default admin username

[RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

[RedshiftServerless.7] Redshift Serverless namespaces should not use the default database name

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.7] S3 general purpose buckets should use cross-Region replication

[S3.10] S3 general purpose buckets with versioning enabled should have Lifecycle configurations

[S3.11] S3 general purpose buckets should have event notifications enabled

[S3.12] ACLs should not be used to manage user access to S3 general purpose buckets

[S3.13] S3 general purpose buckets should have Lifecycle configurations

[S3.19] S3 access points should have block public access settings enabled

[S3.20] S3 general purpose buckets should have MFA delete enabled

[S3.22] S3 general purpose buckets should log object-level write events

[S3.23] S3 general purpose buckets should log object-level read events

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

[SageMaker.3] Users should not have root access to SageMaker notebook instances

[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

[SageMaker.5] SageMaker models should have network isolation enabled

[SageMaker.6] SageMaker app image configurations should be tagged

[SageMaker.7] SageMaker images should be tagged

[SageMaker.8] SageMaker notebook instances should run on supported platforms

[SES.1] SES contact lists should be tagged

[SES.2] SES configuration sets should be tagged

[ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only

[SNS.4] SNS topic access policies should not allow public access

[SQS.1] Amazon SQS queues should be encrypted at rest

[SQS.2] SQS queues should be tagged

[SQS.3] SQS queue access policies should not allow public access

[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

[SSM.4] SSM documents should not be public

[SSM.5] SSM documents should be tagged

[SSM.6] SSM Automation should have CloudWatch logging enabled

[SSM.7] SSM documents should have the block public sharing setting enabled

[StepFunctions.1] Step Functions state machines should have logging turned on

[StepFunctions.2] Step Functions activities should be tagged

[Transfer.1] AWS Transfer Family workflows should be tagged

[Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

[Transfer.3] Transfer Family connectors should have logging enabled

[Transfer.4] Transfer Family agreements should be tagged

[Transfer.5] Transfer Family certificates should be tagged

[Transfer.6] Transfer Family connectors should be tagged

[Transfer.7] Transfer Family profiles should be tagged

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.2] AWS WAF Classic Regional rules should have at least one condition

[WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

[WAF.4] AWS WAF Classic Regional web ACLs should have at least one rule or rule group

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[WAF.10] AWS WAF web ACLs should have at least one rule or rule group

[WAF.11] AWS WAF web ACL logging should be enabled

[WAF.12] AWS WAF rules should have CloudWatch metrics enabled

[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

[DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

[EC2.24] Amazon EC2 paravirtual instance types should not be used

[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

[ECR.4] ECR public repositories should be tagged

[FraudDetector.1] Amazon Fraud Detector entity types should be tagged

[FraudDetector.2] Amazon Fraud Detector labels should be tagged

[FraudDetector.3] Amazon Fraud Detector outcomes should be tagged

[FraudDetector.4] Amazon Fraud Detector variables should be tagged

[GlobalAccelerator.1] Global Accelerator accelerators should be tagged

[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

[Inspector.3] Amazon Inspector Lambda code scanning should be enabled

[IoTTwinMaker.1] AWS IoT TwinMaker sync jobs should be tagged

[IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

[IoTTwinMaker.3] AWS IoT TwinMaker scenes should be tagged

[IoTTwinMaker.4] AWS IoT TwinMaker entities should be tagged

[IoTWireless.1] AWS IoT Wireless multicast groups should be tagged

[IoTWireless.2] AWS IoT Wireless service profiles should be tagged

[IoTWireless.3] AWS IoT FUOTA tasks should be tagged

[IVS.1] IVS playback key pairs should be tagged

[IVS.2] IVS recording configurations should be tagged

[IVS.3] IVS channels should be tagged

[Kinesis.3] Kinesis streams should have an adequate data retention period

[RDS.31] RDS DB security groups should be tagged

[Route53.1] Route 53 health checks should be tagged

[Route53.2] Route 53 public hosted zones should log DNS queries

[S3.24] S3 Multi-Region Access Points should have block public access settings enabled

[S3.25] S3 directory buckets should have lifecycle configurations

[WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

[WAF.6] AWS WAF Classic global rules should have at least one condition

[WAF.7] AWS WAF Classic global rule groups should have at least one rule

[WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

[Account.1] Security contact information should be provided for an AWS account

[Account.2] AWS accounts should be part of an AWS Organizations organization

[APIGateway.8] API Gateway routes should specify an authorization type

[APIGateway.9] Access logging should be configured for API Gateway V2 Stages

[Amplify.1] Amplify apps should be tagged

[Amplify.2] Amplify branches should be tagged

[AppConfig.1] AWS AppConfig applications should be tagged

[AppConfig.2] AWS AppConfig configuration profiles should be tagged

[AppConfig.3] AWS AppConfig environments should be tagged

[AppConfig.4] AWS AppConfig extension associations should be tagged

[AppFlow.1] Amazon AppFlow flows should be tagged

[AppRunner.1] App Runner services should be tagged

[AppRunner.2] App Runner VPC connectors should be tagged

[AppSync.1] AWS AppSync API caches should be encrypted at rest

[AppSync.2] AWS AppSync should have field-level logging enabled

[AppSync.4] AWS AppSync GraphQL APIs should be tagged

[AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys

[AppSync.6] AWS AppSync API caches should be encrypted in transit

[Athena.4] Athena workgroups should have logging enabled

[AutoScaling.2] Amazon EC2 Auto Scaling group should cover multiple Availability Zones

[AutoScaling.3] Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

[AutoScaling.6] Auto Scaling groups should use multiple instance types in multiple Availability Zones

[AutoScaling.9] Amazon EC2 Auto Scaling groups should use Amazon EC2 launch templates

[Backup.1] AWS Backup recovery points should be encrypted at rest

[Backup.4] AWS Backup report plans should be tagged

[Batch.1] Batch job queues should be tagged

[Batch.3] Batch compute environments should be tagged

[Batch.4] Compute resources properties in managed Batch compute environments should be tagged

[CloudFront.1] CloudFront distributions should have a default root object configured

[CloudFront.3] CloudFront distributions should require encryption in transit

[CloudFront.4] CloudFront distributions should have origin failover configured

[CloudFront.5] CloudFront distributions should have logging enabled

[CloudFront.6] CloudFront distributions should have WAF enabled

[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

[CloudFront.13] CloudFront distributions should use origin access control

[CloudFront.14] CloudFront distributions should be tagged

[CloudFront.15] CloudFront distributions should use the recommended TLS security policy

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

[CloudTrail.10] CloudTrail Lake event data stores should be encrypted with customer managed AWS KMS keys

[CloudWatch.17] CloudWatch alarm actions should be activated

[CodeArtifact.1]CodeArtifact repositories should be tagged

[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

[CodeBuild.3] CodeBuild S3 logs should be encrypted

[CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration

[CodeBuild.7] CodeBuild report group exports should be encrypted at rest

[CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

[CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

[Cognito.1] Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

[Cognito.2] Cognito identity pools should not allow unauthenticated identities

[Connect.1] Amazon Connect Customer Profiles object types should be tagged

[Connect.2] Amazon Connect instances should have CloudWatch logging enabled