CNS Policies

Back to home

CNS Policies

AWS Knowledge Base

AWS Knowledge Base

Security checks and vulnerability fixes for AWS.

Amazon EKS

EKS Secrets Not Encrypted

EKS Security Groups Insecure Open Ports

EKS Security Groups Not Configured

EKS Kubernetes Version Deprecated Or Outdated

EKS Private Endpoint Disabled

EKS Logging Disabled

See more

Amazon RDS

RDS IAM Database Authentication Disabled

RDS DocumentDB Minor Version Upgrade Disabled

RDS Automated Backups Disabled

RDS Snapshot Encryption Disabled

RDS Logging Disabled

RDS Multiple AZ Disabled

RDS Publicly Accessible

RDS Encryption At Rest Disabled

RDS Deletion Protection Disabled

RDS Transport Encryption Disabled

RDS low encryption

See more

Amazon Kinesis

Firehose Delivery Streams Using Default KMS Key

Firehose Delivery Streams Encryption Disabled

Kinesis KMS Encryption Disabled

AWS Kinesis Using Default KMS key For Server-Side Encryption

AWS Organizations

AWS Organizations All Features Not Enabled

AWS Organizations Not In Use

AWS Organization Pending Invites

Amazon SQS (Simple Queue Service)

SQS Queue Unprocessed Messages

SQS Cross-Account Access

SQS Default KMS Key

SQS Not Encrypted

SQS Public Access

SQS Missing Dead Letter Queue

See more

AWS Cloudtrail

CloudTrail Delivery Failing

CloudTrail Logging Disabled

CloudTrail Incorrect S3 Bucket Configuration

CloudTrail Bucket Delete Policy Disabled

CloudTrail Not Logging Global API Calls

CloudTrail Bucket Having Public Access

CloudTrail Data Events Disabled

CloudTrail Bucket Access Logging Disabled

CloudTrail CloudWatch Integration Disabled

CloudTrail Global Services Logging Duplicated

CloudTrail Encryption Disabled

CloudTrail Management Events Disabled

CloudTrail Log File Validation Disabled

See more

AWS Certificate Manager

ACM Expired Certificates

ACM Certificate Without Validation Options

ACM Certificate DNS Validation Check

ACM Certificate Validation Failure

ACM Certificate Renew Eligibility Check

Upcoming ACM Certificates Expiry

See more

AWS IAM

Root Account In Use

Insecure Password Reuse Prevention

Root MFA Disabled

Weak Password Policy - 'Minimum Password Length'

Insecure Role Policies

Directly Attached User IAM Policies

Access Keys Not Rotated

Users MFA Disabled

Extra User Admins

Unused Access Keys

Users Active Password And Access Keys

Root Access Keys Exist

Password Policy Missing - 'Require Lowercase'

Extra Users

Root Account With Active Signing Certificates

Cross-Account Access External ID and MFA With Roles

Unused Roles

Extra Access Keys

Group With Inline Policies

Password Policy Missing- 'Require Uppercase'

Missing Hardware MFA For Root Account

Password Policy Missing 'Require Numbers'

Password Policy Not Set

Groups Without Users

Insecure Password Expiration

Password Policy Missing- 'Require Symbols'

Fetch AWS Access Key's Last Used Detail

See more

AWS Workspaces

Workspaces IP Access Control Too Open

Workspaces IP Access Control Disabled

WorkSpaces User Volume Encryption Disabled

WorkSpaces Root Volume Encryption Disabled

Amazon S3

S3 Bucket Versioning Disabled

S3 Buckets With Logging Disabled

S3 DNS Compliant Bucket Names

S3 Transfer Acceleration Disabled

S3 Bucket MFA Delete Disabled

S3 Bucket Lifecycle Configuration

S3 Buckets with global ACL

One To Many S3 Bucket CloudFront Mapping

S3 Bucket Insecure Write Access

S3 Buckets With Global Policy

S3 Bucket Insecure Read Access

See more

AWS Systems Manager (AWS SSM)

Non-SecureString SSM Parameters present

SSM Parameters Poorly Encrypted

Amazon EC2

EC2 Instances Vulnerable To SSRF Attack

Public NetBIOS

Elastic Block Store Volumes Too Old Snapshots

Unused VPC Internet Gateways

Elastic Block Store Volume Snapshot Private

App-Tier/Web-Tier EC2 Instance IAM Role Without Policy

Public Elasticsearch

Unused Amazon Machine Images

Public MySQL

Unrestricted public access in security groups

Elastic Block Store Backup Disabled

Unused Security Groups

VPC Endpoint Cross-Account Access

Unencrypted AMIs

Unused Elastic Network Interfaces

Open Hadoop HDFS NameNode Metadata Service

Public SQL Server

Default VPC In Use

Open Kibana

Public IP Address Attached To EC2 Instances

VPC Subnet Instances Present

Elastic Block Store Unencrypted Snapshots

Public DNS

Elastic Block Store Volume Snapshot Public

VPC Multiple Subnets

Elastic Block Store Unencrypted Volumes

Public AMI

Default VPC Exists

Elastic IP Limit Breach

Elastic Block Store Volume Default Encryption Disabled

VPC Flow Logs Not Enabled

Instance vCPU On-Demand Limit

VPC Elastic IP Limit Breach

Overlapping Security Groups

Public SSH

NAT Multiple AZ Not Configured

Instance Limit Breach

Open Salt

Instances Without IAM Role

Public RPC

Public Telnet

Unused VPC Egress Only Internet Gateways

Public VNC Client

Public Oracle

Down VPN Tunnels

Public FTP

Open Oracle Auto Data Warehouse

Open Hadoop HDFS NameNode WebUI

Detect EC2 Classic Instances

Open Docker

Public VNC Server

EC2 LaunchWizard Security Groups

Public RDP

Default Security Groups In Use

Unused Virtual Private Gateway

Cross Organization VPC Peering Connections

Unused Elastic Block Store Volumes

Unassociated Elastic IP Addresses

EC2 Max Instances

Public SMBoTCP

Managed NAT Gateway Not In Use

Public CIFS

Public PostgreSQL

Unrestricted Network ACL Outbound Traffic

VPC Elastic IP Limit Breach

Public SMTP

VPC Endpoint Exposed

Restricted Ports Open to Public

See more

Amazon Redshift

Redshift Cluster Audit Logging Disabled

Redshift Cluster Version Upgrade Disabled

Redshift Cluster Default Port

Redshift Cluster Default Master Username

Redshift Nodes Count Exceeded

Redshift User Activity Logging Enabled

Redshift Automated Snapshot Retention Period Not Set

Redshift Publicly Accessible

Redshift Cluster Encryption Key Missing

Redshift Parameter Group SSL Required

Redshift Encryption With Default KMS Key

Redshift Undesired Node Type

Redshift Encryption Disabled

Redshift Cluster Not In VPC

See more

Amazon EMR

AWS EMR Encryption In Transit Disabled

EMR Encryption At Rest Disabled

AWS EMR Cluster Logging Disabled

Amazon CloudFront

CloudFront Origin Uses Insecure Match-Viewer

Insecure CloudFront Distribution Protocols

Insecure CloudFront Origin Protocol

CloudFront Logging Disabled

CloudFront Instance Takeover: Missing Origin S3 Bucket

CloudFront Not Using HTTPS

Public S3 CloudFront Origin

CloudFront WAF Disabled

CloudFront Instance Takeover: Missing Origin Elastic Beanstalk Instance

CloudFront Origin Uses Insecure HTTP

See more

Amazon DynamoDB

DynamoDB Accelerator Cluster Encryption Not Enabled

DynamoDB Missing KMS Encryption

DynamoDB Continuous Backups

Amazon Managed Workflows for Apache Airflow (MWAA)

Environment Admin Privileges

Web Server Public Access

Amazon Route 53

Domain Transfer Lock Not Enabled

Public Subdomain Takeover: Missing Origin S3 Bucket

Private Subdomain Takeover: Missing Origin Elastic Beanstalk Instance

Domains About To Expire

Route 53 Expired Domain

Domain Auto Renew Not Enabled

Private Subdomain Takeover: Missing Origin S3 Bucket

Public Subdomain Takeover: Missing Origin Elastic Beanstalk Instance

Private Subdomain Takeover: Missing Origin IP Address

Missing Valid Sender Policy Framework(SPF) Entry

Public Subdomain Takeover: Missing Origin IP Address

See more

AWS Key Management Service (KMS)

App-Tier KMS Customer Master Key (CMK) Missing

KMS Key Policy Globally Accessible

AWS Unused KMS Key

KMS Key Rotation Disabled

Amazon CloudWatch

CloudWatch Monitoring Metrics Not Enabled For Region

Low CloudWatch Log Retention Period

Important CloudWatch Monitoring Metrics Missing

Amazon ElasticSearch

ElasticSearch Global Access

ElasticSearch Logging Disabled

ElasticSearch Domains Without VPC

ElasticSearch Access From Unauthorized IP Addresses

ElasticSearch Node To Node Encryption Disabled

ElasticSearch Domains Not Encrypted

ElasticSearch HTTPS Only Disabled

ElasticSearch Upgrade Available

See more

AWS Database Migration Service

DMS Instance Using Default KMS Key

DMS No Multi-AZ

DMS Encryption Using Non Existent KMS Key

DMS Public Replication Instance

AWS Config

Config Service Not Enabled

Config Service Global Monitoring

Config Service Delivery Failing

Config Service Delivery Bucket Missing

Config Service Not Recording

See more

AWS X-Ray

XRay Encryption Disabled

Amazon API Gateway

CloudWatch Logs Missing For API Gateway

API Gateway Certificate About to Expire

API Gateway Public Endpoints

API Gateway Certificate Expired

API Gateway Missing Detailed CloudWatch Metrics

API Gateway Tracing Disabled

API Gateway Missing Private Endpoints

Missing API Gateway Client Certificate

API Gateway WAF Disabled

API Gateway Content-Encoding Disabled

See more

Amazon Athena

Workgroup Configuration Not Enforced

Workgroups Not Encrypted

Amazon SageMaker

Notebook Instance Publicly Accessible

Notebook Encryption Disabled

AWS Elastic Load Balancing (ELB)

ELB Without Security Policy

Network Load Balancer With Insecure Listeners

ELBv2 Minimum Number of EC2 Target Instances

ELB Without SSL Termination

ELB Deregistration Delay Not Configured

ELB Cross-Zone Load Balancing Disabled

ELB Deletion Protection Not Configured

ELB Logging Disabled

ELB WAF Disabled

ELB Non HTTPS Listeners

ELB Connection Draining Disabled

ELB Without Backbone Servers

Classic Load Balancers In Use

See more

AWS Lambda

Lambda With Invalid IAM Roles

Lambda Function Public Access

Lambda Missing Log Groups

Lambda Old Runtimes

Lambda Admin Privileges

Lambda Tracing Disabled

Lambda Environment Variables In-Transit Encryption Missing

Lambda Without IAM Roles

Lambda Without VPC (Virtual Private Cloud)

See more

AWS Auto Scaling

Auto Scaling Groups ELB Health Check Inactive

Auto Scaling Groups Not Referencing Active Load Balancers

AutoScaling ELB Same Availability Zone

App-Tier/ Web-Tier ASG Launch Configurations Using Unapproved AMIs

AutoScaling Groups With Suspended Processes

Auto Scaling Groups Multiple Availability Zones Not Enabled

Launch Configuration Referencing Inactive Security Groups

App-Tier/ Web-Tier Launch Configurations Without IAM Roles

Auto Scaling Notifications Not Active

App-Tier/Web-Tier Auto Scaling Group CloudWatch Logs Disabled

Empty AutoScaling Groups

See more

Amazon GuardDuty

Amazon GuardDuty Master Account Missing

Amazon GuardDuty Disabled

Amazon GuardDuty Detector Suspended

Amazon Elastic File System (Amazon EFS)

EFS systems Referencing Deleted KMS Key

EFS Encryption Disabled

EFS Encryption Using Default KMS Keys

Amazon Elastic Container Registry (Amazon ECR)

AWS ECR Repository Policy - ECR Check Cross-Account Principal

ECR Repository Tag Immutability

AWS ECR Repository Policy - ECR Check Global Principal

AWS Glue

AWS Glue S3 Encryption Disabled

AWS Glue Data Catalog Encryption Disabled

AWS Glue CloudWatch Logs Not Encrypted

AWS Glue Job Bookmark Encryption Disabled

Amazon Simple Notification Service (SNS)

SNS Cross-Account Access

SNS Topic Global Policies

SNS Topic Not Encrypted

SNS Topic CMK Encryption

AWS Elastic Beanstalk

AWS ElasticBeanstalk Managed Platform Updates Not Configured

AWS CodeBuild

CodeBuild Blacklisted Source Providers

AWS Secrets Manager

Secrets Manager Weakly Encrypted Secrets

Secrets Manager Secret Rotation Disabled

Secrets Manager Small Rotation Window

AWS Transfer Family

Transfer Logging Disabled

Publicly accessible SFTP Server Endpoints

Amazon Access Analyzer

IAM Access Analyzer Disabled