![Screenshot 2024-03-12 at 11.34.19 AM.png]](https://cloud-kb.sentinelone.com/hs-fs/hubfs/Screenshot%202024-03-12%20at%2011.34.19%20AM.png?height=40&name=Screenshot%202024-03-12%20at%2011.34.19%20AM.png){kind=small}
AWS Knowledge Base
Security checks and vulnerability fixes for AWS.
Amazon EKS
Amazon RDS
- RDS IAM Database Authentication Disabled
- RDS DocumentDB Minor Version Upgrade Disabled
- RDS Automated Backups Disabled
- RDS Snapshot Encryption Disabled
- RDS Logging Disabled
- RDS Multiple AZ Disabled
- RDS Publicly Accessible
- RDS Encryption At Rest Disabled
- RDS Deletion Protection Disabled
- RDS Transport Encryption Disabled
- RDS low encryption
Amazon Kinesis
AWS Organizations
Amazon SQS (Simple Queue Service)
AWS Cloudtrail
- CloudTrail Delivery Failing
- CloudTrail Logging Disabled
- CloudTrail Incorrect S3 Bucket Configuration
- CloudTrail Bucket Delete Policy Disabled
- CloudTrail Not Logging Global API Calls
- CloudTrail Bucket Having Public Access
- CloudTrail Data Events Disabled
- CloudTrail Bucket Access Logging Disabled
- CloudTrail CloudWatch Integration Disabled
- CloudTrail Global Services Logging Duplicated
- CloudTrail Encryption Disabled
- CloudTrail Management Events Disabled
- CloudTrail Log File Validation Disabled
AWS Certificate Manager
AWS IAM
- Fetch AWS Access Key's Last Used Detail
- Root Account In Use
- Insecure Password Reuse Prevention
- Root MFA Disabled
- Weak Password Policy - 'Minimum Password Length'
- Insecure Role Policies
- Directly Attached User IAM Policies
- Access Keys Not Rotated
- Users MFA Disabled
- Extra User Admins
- Unused Access Keys
- Users Active Password And Access Keys
- Root Access Keys Exist
- Password Policy Missing - 'Require Lowercase'
- Extra Users
- Root Account With Active Signing Certificates
- Cross-Account Access External ID and MFA With Roles
- Unused Roles
- Extra Access Keys
- Group With Inline Policies
- Password Policy Missing- 'Require Uppercase'
- Missing Hardware MFA For Root Account
- Password Policy Missing 'Require Numbers'
- Password Policy Not Set
- Groups Without Users
- Insecure Password Expiration
- Password Policy Missing- 'Require Symbols'
AWS Workspaces
Amazon S3
- S3 Bucket Versioning Disabled
- S3 Buckets With Logging Disabled
- S3 DNS Compliant Bucket Names
- S3 Transfer Acceleration Disabled
- S3 Bucket MFA Delete Disabled
- S3 Bucket Lifecycle Configuration
- S3 Buckets with global ACL
- One To Many S3 Bucket CloudFront Mapping
- S3 Bucket Insecure Write Access
- S3 Buckets With Global Policy
- S3 Bucket Insecure Read Access
AWS Systems Manager (AWS SSM)
Amazon EC2
- EC2 Instances Vulnerable To SSRF Attack
- Public NetBIOS
- Elastic Block Store Volumes Too Old Snapshots
- Unused VPC Internet Gateways
- Elastic Block Store Volume Snapshot Private
- App-Tier/Web-Tier EC2 Instance IAM Role Without Policy
- Public Elasticsearch
- Unused Amazon Machine Images
- Public MySQL
- Unrestricted public access in security groups
- Elastic Block Store Backup Disabled
- Unused Security Groups
- VPC Endpoint Cross-Account Access
- Unencrypted AMIs
- Unused Elastic Network Interfaces
- Open Hadoop HDFS NameNode Metadata Service
- Public SQL Server
- Default VPC In Use
- Open Kibana
- Public IP Address Attached To EC2 Instances
- VPC Subnet Instances Present
- Elastic Block Store Unencrypted Snapshots
- Public DNS
- Elastic Block Store Volume Snapshot Public
- VPC Multiple Subnets
- Elastic Block Store Unencrypted Volumes
- Public AMI
- Default VPC Exists
- Elastic IP Limit Breach
- Elastic Block Store Volume Default Encryption Disabled
- VPC Flow Logs Not Enabled
- Instance vCPU On-Demand Limit
- VPC Elastic IP Limit Breach
- Overlapping Security Groups
- Public SSH
- NAT Multiple AZ Not Configured
- Instance Limit Breach
- Open Salt
- Instances Without IAM Role
- Public RPC
- Public Telnet
- Unused VPC Egress Only Internet Gateways
- Public VNC Client
- Public Oracle
- Down VPN Tunnels
- Public FTP
- Open Oracle Auto Data Warehouse
- Open Hadoop HDFS NameNode WebUI
- Detect EC2 Classic Instances
- Open Docker
- Public VNC Server
- EC2 LaunchWizard Security Groups
- Public RDP
- Default Security Groups In Use
- Unused Virtual Private Gateway
- Cross Organization VPC Peering Connections
- Unused Elastic Block Store Volumes
- Unassociated Elastic IP Addresses
- EC2 Max Instances
- Public SMBoTCP
- Managed NAT Gateway Not In Use
- Public CIFS
- Public PostgreSQL
- Unrestricted Network ACL Outbound Traffic
- VPC Elastic IP Limit Breach
- Public SMTP
- VPC Endpoint Exposed
- Restricted Ports Open to Public
Amazon Redshift
- Redshift Cluster Audit Logging Disabled
- Redshift Cluster Version Upgrade Disabled
- Redshift Cluster Default Port
- Redshift Cluster Default Master Username
- Redshift Nodes Count Exceeded
- Redshift User Activity Logging Enabled
- Redshift Automated Snapshot Retention Period Not Set
- Redshift Publicly Accessible
- Redshift Cluster Encryption Key Missing
- Redshift Parameter Group SSL Required
- Redshift Encryption With Default KMS Key
- Redshift Undesired Node Type
- Redshift Encryption Disabled
- Redshift Cluster Not In VPC
Amazon EMR
Amazon CloudFront
- CloudFront Origin Uses Insecure Match-Viewer
- Insecure CloudFront Distribution Protocols
- Insecure CloudFront Origin Protocol
- CloudFront Logging Disabled
- CloudFront Instance Takeover: Missing Origin S3 Bucket
- CloudFront Not Using HTTPS
- Public S3 CloudFront Origin
- CloudFront WAF Disabled
- CloudFront Instance Takeover: Missing Origin Elastic Beanstalk Instance
- CloudFront Origin Uses Insecure HTTP
Amazon DynamoDB
Amazon Managed Workflows for Apache Airflow (MWAA)
Amazon Route 53
- Domain Transfer Lock Not Enabled
- Public Subdomain Takeover: Missing Origin S3 Bucket
- Private Subdomain Takeover: Missing Origin Elastic Beanstalk Instance
- Domains About To Expire
- Route 53 Expired Domain
- Domain Auto Renew Not Enabled
- Private Subdomain Takeover: Missing Origin S3 Bucket
- Public Subdomain Takeover: Missing Origin Elastic Beanstalk Instance
- Private Subdomain Takeover: Missing Origin IP Address
- Missing Valid Sender Policy Framework(SPF) Entry
- Public Subdomain Takeover: Missing Origin IP Address
AWS Key Management Service (KMS)
Amazon CloudWatch
Amazon ElasticSearch
AWS Database Migration Service
AWS Config
AWS X-Ray
Amazon API Gateway
- CloudWatch Logs Missing For API Gateway
- API Gateway Certificate About to Expire
- API Gateway Public Endpoints
- API Gateway Certificate Expired
- API Gateway Missing Detailed CloudWatch Metrics
- API Gateway Tracing Disabled
- API Gateway Missing Private Endpoints
- Missing API Gateway Client Certificate
- API Gateway WAF Disabled
- API Gateway Content-Encoding Disabled
Amazon Athena
Amazon SageMaker
AWS Elastic Load Balancing (ELB)
- ELB Without Security Policy
- Network Load Balancer With Insecure Listeners
- ELBv2 Minimum Number of EC2 Target Instances
- ELB Without SSL Termination
- ELB Deregistration Delay Not Configured
- ELB Cross-Zone Load Balancing Disabled
- ELB Deletion Protection Not Configured
- ELB Logging Disabled
- ELB WAF Disabled
- ELB Non HTTPS Listeners
- ELB Connection Draining Disabled
- ELB Without Backbone Servers
- Classic Load Balancers In Use
AWS Lambda
AWS Auto Scaling
- Auto Scaling Groups ELB Health Check Inactive
- Auto Scaling Groups Not Referencing Active Load Balancers
- AutoScaling ELB Same Availability Zone
- App-Tier/ Web-Tier ASG Launch Configurations Using Unapproved AMIs
- AutoScaling Groups With Suspended Processes
- Auto Scaling Groups Multiple Availability Zones Not Enabled
- Launch Configuration Referencing Inactive Security Groups
- App-Tier/ Web-Tier Launch Configurations Without IAM Roles
- Auto Scaling Notifications Not Active
- App-Tier/Web-Tier Auto Scaling Group CloudWatch Logs Disabled
- Empty AutoScaling Groups