@sagentix-inc/evidence-collector 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +478 -464
- package/apps/sos-app/src/data/checks/prowler_azure.json +137 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_gcp.json +99 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +75 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +69 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +2 -2
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +1 -1
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: AWS (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"arn:aws:iam::aws:policy/SecurityAudit",
|
|
6
6
|
"arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
|
|
@@ -8,7 +8,7 @@
|
|
|
8
8
|
],
|
|
9
9
|
"engine": {
|
|
10
10
|
"name": "Prowler",
|
|
11
|
-
"version": "5.
|
|
11
|
+
"version": "5.47.0",
|
|
12
12
|
"licence": "Apache-2.0",
|
|
13
13
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
14
14
|
},
|
|
@@ -17,3234 +17,3248 @@
|
|
|
17
17
|
{
|
|
18
18
|
"id": "prowler.aws.accessanalyzer_enabled",
|
|
19
19
|
"title": "IAM Access Analyzer is enabled",
|
|
20
|
-
"scope": "Prowler 5.
|
|
20
|
+
"scope": "Prowler 5.47.0 check accessanalyzer_enabled (AWS accessanalyzer, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
21
21
|
"evidenceType": "Configuration",
|
|
22
22
|
"severity": "low"
|
|
23
23
|
},
|
|
24
24
|
{
|
|
25
25
|
"id": "prowler.aws.accessanalyzer_enabled_without_findings",
|
|
26
26
|
"title": "IAM Access Analyzer analyzer is active and has no active findings",
|
|
27
|
-
"scope": "Prowler 5.
|
|
27
|
+
"scope": "Prowler 5.47.0 check accessanalyzer_enabled_without_findings (AWS accessanalyzer, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
28
28
|
"evidenceType": "Configuration",
|
|
29
29
|
"severity": "low"
|
|
30
30
|
},
|
|
31
31
|
{
|
|
32
32
|
"id": "prowler.aws.acm_certificates_expiration_check",
|
|
33
33
|
"title": "ACM certificate expires in more than the configured threshold of days",
|
|
34
|
-
"scope": "Prowler 5.
|
|
34
|
+
"scope": "Prowler 5.47.0 check acm_certificates_expiration_check (AWS acm, resource type AwsCertificateManagerCertificate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
35
35
|
"evidenceType": "Configuration",
|
|
36
36
|
"severity": "high"
|
|
37
37
|
},
|
|
38
38
|
{
|
|
39
39
|
"id": "prowler.aws.amplify_app_no_secrets_in_environment",
|
|
40
40
|
"title": "Amplify app has no sensitive credentials in environment variables or build settings",
|
|
41
|
-
"scope": "Prowler 5.
|
|
41
|
+
"scope": "Prowler 5.47.0 check amplify_app_no_secrets_in_environment (AWS amplify, resource type AwsAmplifyApp): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
42
42
|
"evidenceType": "Configuration",
|
|
43
43
|
"severity": "high"
|
|
44
44
|
},
|
|
45
45
|
{
|
|
46
46
|
"id": "prowler.aws.apigateway_domain_name_pqc_tls_enabled",
|
|
47
47
|
"title": "API Gateway custom domain names use a post-quantum TLS security policy",
|
|
48
|
-
"scope": "Prowler 5.
|
|
48
|
+
"scope": "Prowler 5.47.0 check apigateway_domain_name_pqc_tls_enabled (AWS apigateway, resource type AwsApiGatewayDomainName): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
49
49
|
"evidenceType": "Configuration",
|
|
50
50
|
"severity": "low"
|
|
51
51
|
},
|
|
52
52
|
{
|
|
53
53
|
"id": "prowler.aws.apigateway_restapi_authorizers_enabled",
|
|
54
54
|
"title": "API Gateway REST API has an authorizer at API level or all methods are authorized",
|
|
55
|
-
"scope": "Prowler 5.
|
|
55
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_authorizers_enabled (AWS apigateway, resource type AwsApiGatewayRestApi): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
56
56
|
"evidenceType": "Configuration",
|
|
57
57
|
"severity": "medium"
|
|
58
58
|
},
|
|
59
59
|
{
|
|
60
60
|
"id": "prowler.aws.apigateway_restapi_cache_encrypted",
|
|
61
61
|
"title": "API Gateway REST API stage cache data is encrypted at rest",
|
|
62
|
-
"scope": "Prowler 5.
|
|
62
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_cache_encrypted (AWS apigateway, resource type AwsApiGatewayStage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
63
63
|
"evidenceType": "Configuration",
|
|
64
64
|
"severity": "medium"
|
|
65
65
|
},
|
|
66
66
|
{
|
|
67
67
|
"id": "prowler.aws.apigateway_restapi_client_certificate_enabled",
|
|
68
68
|
"title": "API Gateway REST API stage has client certificate enabled",
|
|
69
|
-
"scope": "Prowler 5.
|
|
69
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_client_certificate_enabled (AWS apigateway, resource type AwsApiGatewayStage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
70
70
|
"evidenceType": "Configuration",
|
|
71
71
|
"severity": "medium"
|
|
72
72
|
},
|
|
73
73
|
{
|
|
74
74
|
"id": "prowler.aws.apigateway_restapi_logging_enabled",
|
|
75
75
|
"title": "API Gateway REST API stage has logging enabled",
|
|
76
|
-
"scope": "Prowler 5.
|
|
76
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_logging_enabled (AWS apigateway, resource type AwsApiGatewayStage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
77
77
|
"evidenceType": "Configuration",
|
|
78
78
|
"severity": "medium"
|
|
79
79
|
},
|
|
80
80
|
{
|
|
81
81
|
"id": "prowler.aws.apigateway_restapi_no_secrets_in_stage_variables",
|
|
82
82
|
"title": "API Gateway REST API stage variables should not contain secrets",
|
|
83
|
-
"scope": "Prowler 5.
|
|
83
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_no_secrets_in_stage_variables (AWS apigateway, resource type AwsApiGatewayStage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
84
84
|
"evidenceType": "Configuration",
|
|
85
85
|
"severity": "high"
|
|
86
86
|
},
|
|
87
87
|
{
|
|
88
88
|
"id": "prowler.aws.apigateway_restapi_public",
|
|
89
89
|
"title": "API Gateway REST API endpoint is private",
|
|
90
|
-
"scope": "Prowler 5.
|
|
90
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_public (AWS apigateway, resource type AwsApiGatewayRestApi): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
91
91
|
"evidenceType": "Configuration",
|
|
92
92
|
"severity": "medium"
|
|
93
93
|
},
|
|
94
94
|
{
|
|
95
95
|
"id": "prowler.aws.apigateway_restapi_waf_acl_attached",
|
|
96
96
|
"title": "API Gateway stage has a WAF Web ACL attached",
|
|
97
|
-
"scope": "Prowler 5.
|
|
97
|
+
"scope": "Prowler 5.47.0 check apigateway_restapi_waf_acl_attached (AWS apigateway, resource type AwsApiGatewayStage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
98
98
|
"evidenceType": "Configuration",
|
|
99
99
|
"severity": "medium"
|
|
100
100
|
},
|
|
101
101
|
{
|
|
102
102
|
"id": "prowler.aws.apigatewayv2_api_access_logging_enabled",
|
|
103
103
|
"title": "API Gateway V2 API stage has access logging enabled",
|
|
104
|
-
"scope": "Prowler 5.
|
|
104
|
+
"scope": "Prowler 5.47.0 check apigatewayv2_api_access_logging_enabled (AWS apigatewayv2, resource type AwsApiGatewayV2Stage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
105
105
|
"evidenceType": "Configuration",
|
|
106
106
|
"severity": "medium"
|
|
107
107
|
},
|
|
108
108
|
{
|
|
109
109
|
"id": "prowler.aws.apigatewayv2_api_authorizers_enabled",
|
|
110
110
|
"title": "API Gateway V2 API has an authorizer configured",
|
|
111
|
-
"scope": "Prowler 5.
|
|
111
|
+
"scope": "Prowler 5.47.0 check apigatewayv2_api_authorizers_enabled (AWS apigatewayv2, resource type AwsApiGatewayV2Api): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
112
112
|
"evidenceType": "Configuration",
|
|
113
113
|
"severity": "medium"
|
|
114
114
|
},
|
|
115
115
|
{
|
|
116
116
|
"id": "prowler.aws.appstream_fleet_default_internet_access_disabled",
|
|
117
117
|
"title": "AppStream fleet has default internet access disabled",
|
|
118
|
-
"scope": "Prowler 5.
|
|
118
|
+
"scope": "Prowler 5.47.0 check appstream_fleet_default_internet_access_disabled (AWS appstream, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
119
119
|
"evidenceType": "Configuration",
|
|
120
120
|
"severity": "medium"
|
|
121
121
|
},
|
|
122
122
|
{
|
|
123
123
|
"id": "prowler.aws.appsync_field_level_logging_enabled",
|
|
124
124
|
"title": "AWS AppSync API has field-level logging set to ALL or ERROR",
|
|
125
|
-
"scope": "Prowler 5.
|
|
125
|
+
"scope": "Prowler 5.47.0 check appsync_field_level_logging_enabled (AWS appsync, resource type AwsAppSyncGraphQLApi): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
126
126
|
"evidenceType": "Configuration",
|
|
127
127
|
"severity": "medium"
|
|
128
128
|
},
|
|
129
129
|
{
|
|
130
130
|
"id": "prowler.aws.appsync_graphql_api_no_api_key_authentication",
|
|
131
131
|
"title": "AWS AppSync GraphQL API does not use API key authentication",
|
|
132
|
-
"scope": "Prowler 5.
|
|
132
|
+
"scope": "Prowler 5.47.0 check appsync_graphql_api_no_api_key_authentication (AWS appsync, resource type AwsAppSyncGraphQLApi): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
133
133
|
"evidenceType": "Configuration",
|
|
134
134
|
"severity": "high"
|
|
135
135
|
},
|
|
136
136
|
{
|
|
137
137
|
"id": "prowler.aws.athena_workgroup_encryption",
|
|
138
138
|
"title": "Athena workgroup encrypts query results in S3 with server-side encryption",
|
|
139
|
-
"scope": "Prowler 5.
|
|
139
|
+
"scope": "Prowler 5.47.0 check athena_workgroup_encryption (AWS athena, resource type AwsAthenaWorkGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
140
140
|
"evidenceType": "Configuration",
|
|
141
141
|
"severity": "medium"
|
|
142
142
|
},
|
|
143
143
|
{
|
|
144
144
|
"id": "prowler.aws.athena_workgroup_logging_enabled",
|
|
145
145
|
"title": "Amazon Athena workgroup has CloudWatch logging enabled",
|
|
146
|
-
"scope": "Prowler 5.
|
|
146
|
+
"scope": "Prowler 5.47.0 check athena_workgroup_logging_enabled (AWS athena, resource type AwsAthenaWorkGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
147
147
|
"evidenceType": "Configuration",
|
|
148
148
|
"severity": "medium"
|
|
149
149
|
},
|
|
150
150
|
{
|
|
151
151
|
"id": "prowler.aws.autoscaling_group_capacity_rebalance_enabled",
|
|
152
152
|
"title": "Amazon EC2 Auto Scaling group has Capacity Rebalancing enabled",
|
|
153
|
-
"scope": "Prowler 5.
|
|
153
|
+
"scope": "Prowler 5.47.0 check autoscaling_group_capacity_rebalance_enabled (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
154
154
|
"evidenceType": "Configuration",
|
|
155
155
|
"severity": "medium"
|
|
156
156
|
},
|
|
157
157
|
{
|
|
158
158
|
"id": "prowler.aws.autoscaling_group_elb_health_check_enabled",
|
|
159
159
|
"title": "Auto Scaling group associated with a load balancer has ELB health checks enabled",
|
|
160
|
-
"scope": "Prowler 5.
|
|
160
|
+
"scope": "Prowler 5.47.0 check autoscaling_group_elb_health_check_enabled (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
161
161
|
"evidenceType": "Configuration",
|
|
162
162
|
"severity": "low"
|
|
163
163
|
},
|
|
164
164
|
{
|
|
165
165
|
"id": "prowler.aws.autoscaling_group_launch_configuration_no_public_ip",
|
|
166
166
|
"title": "Auto Scaling group associated launch configuration does not assign a public IP address",
|
|
167
|
-
"scope": "Prowler 5.
|
|
167
|
+
"scope": "Prowler 5.47.0 check autoscaling_group_launch_configuration_no_public_ip (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
168
168
|
"evidenceType": "Configuration",
|
|
169
169
|
"severity": "high"
|
|
170
170
|
},
|
|
171
171
|
{
|
|
172
172
|
"id": "prowler.aws.autoscaling_group_multiple_az",
|
|
173
173
|
"title": "Auto Scaling group uses multiple Availability Zones",
|
|
174
|
-
"scope": "Prowler 5.
|
|
174
|
+
"scope": "Prowler 5.47.0 check autoscaling_group_multiple_az (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
175
175
|
"evidenceType": "Configuration",
|
|
176
176
|
"severity": "medium"
|
|
177
177
|
},
|
|
178
178
|
{
|
|
179
179
|
"id": "prowler.aws.autoscaling_group_multiple_instance_types",
|
|
180
180
|
"title": "Auto Scaling group spans multiple Availability Zones and has multiple instance types per Availability Zone",
|
|
181
|
-
"scope": "Prowler 5.
|
|
181
|
+
"scope": "Prowler 5.47.0 check autoscaling_group_multiple_instance_types (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
182
182
|
"evidenceType": "Configuration",
|
|
183
183
|
"severity": "medium"
|
|
184
184
|
},
|
|
185
185
|
{
|
|
186
186
|
"id": "prowler.aws.autoscaling_group_using_ec2_launch_template",
|
|
187
187
|
"title": "Amazon EC2 Auto Scaling group uses an EC2 launch template",
|
|
188
|
-
"scope": "Prowler 5.
|
|
188
|
+
"scope": "Prowler 5.47.0 check autoscaling_group_using_ec2_launch_template (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
189
189
|
"evidenceType": "Configuration",
|
|
190
190
|
"severity": "medium"
|
|
191
191
|
},
|
|
192
192
|
{
|
|
193
193
|
"id": "prowler.aws.awslambda_function_env_vars_not_encrypted_with_cmk",
|
|
194
194
|
"title": "Lambda function environment variables are encrypted with a customer-managed KMS key",
|
|
195
|
-
"scope": "Prowler 5.
|
|
195
|
+
"scope": "Prowler 5.47.0 check awslambda_function_env_vars_not_encrypted_with_cmk (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
196
196
|
"evidenceType": "Configuration",
|
|
197
197
|
"severity": "medium"
|
|
198
198
|
},
|
|
199
199
|
{
|
|
200
200
|
"id": "prowler.aws.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled",
|
|
201
201
|
"title": "Lambda function Invoke API calls are recorded by CloudTrail",
|
|
202
|
-
"scope": "Prowler 5.
|
|
202
|
+
"scope": "Prowler 5.47.0 check awslambda_function_invoke_api_operations_cloudtrail_logging_enabled (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
203
203
|
"evidenceType": "Configuration",
|
|
204
204
|
"severity": "low"
|
|
205
205
|
},
|
|
206
206
|
{
|
|
207
207
|
"id": "prowler.aws.awslambda_function_no_secrets_in_code",
|
|
208
208
|
"title": "Lambda function code contains no hardcoded secrets",
|
|
209
|
-
"scope": "Prowler 5.
|
|
209
|
+
"scope": "Prowler 5.47.0 check awslambda_function_no_secrets_in_code (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
210
210
|
"evidenceType": "Configuration",
|
|
211
211
|
"severity": "critical"
|
|
212
212
|
},
|
|
213
213
|
{
|
|
214
214
|
"id": "prowler.aws.awslambda_function_no_secrets_in_variables",
|
|
215
215
|
"title": "Lambda function environment variables do not contain secrets",
|
|
216
|
-
"scope": "Prowler 5.
|
|
216
|
+
"scope": "Prowler 5.47.0 check awslambda_function_no_secrets_in_variables (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
217
217
|
"evidenceType": "Configuration",
|
|
218
218
|
"severity": "critical"
|
|
219
219
|
},
|
|
220
220
|
{
|
|
221
221
|
"id": "prowler.aws.awslambda_function_not_publicly_accessible",
|
|
222
222
|
"title": "Lambda function resource-based policy does not allow public access",
|
|
223
|
-
"scope": "Prowler 5.
|
|
223
|
+
"scope": "Prowler 5.47.0 check awslambda_function_not_publicly_accessible (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
224
224
|
"evidenceType": "Configuration",
|
|
225
225
|
"severity": "critical"
|
|
226
226
|
},
|
|
227
227
|
{
|
|
228
228
|
"id": "prowler.aws.awslambda_function_url_public",
|
|
229
229
|
"title": "Lambda function URL is not publicly accessible",
|
|
230
|
-
"scope": "Prowler 5.
|
|
230
|
+
"scope": "Prowler 5.47.0 check awslambda_function_url_public (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
231
231
|
"evidenceType": "Configuration",
|
|
232
232
|
"severity": "high"
|
|
233
233
|
},
|
|
234
234
|
{
|
|
235
235
|
"id": "prowler.aws.awslambda_function_using_cross_account_layers",
|
|
236
236
|
"title": "Lambda function does not use cross-account layers",
|
|
237
|
-
"scope": "Prowler 5.
|
|
237
|
+
"scope": "Prowler 5.47.0 check awslambda_function_using_cross_account_layers (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
238
238
|
"evidenceType": "Configuration",
|
|
239
239
|
"severity": "high"
|
|
240
240
|
},
|
|
241
241
|
{
|
|
242
242
|
"id": "prowler.aws.awslambda_function_using_supported_runtimes",
|
|
243
243
|
"title": "Lambda function uses a supported runtime",
|
|
244
|
-
"scope": "Prowler 5.
|
|
244
|
+
"scope": "Prowler 5.47.0 check awslambda_function_using_supported_runtimes (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
245
245
|
"evidenceType": "Configuration",
|
|
246
246
|
"severity": "medium"
|
|
247
247
|
},
|
|
248
248
|
{
|
|
249
249
|
"id": "prowler.aws.awslambda_function_vpc_multi_az",
|
|
250
250
|
"title": "Lambda function is configured with VPC subnets in at least two Availability Zones",
|
|
251
|
-
"scope": "Prowler 5.
|
|
251
|
+
"scope": "Prowler 5.47.0 check awslambda_function_vpc_multi_az (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
252
252
|
"evidenceType": "Configuration",
|
|
253
253
|
"severity": "medium"
|
|
254
254
|
},
|
|
255
255
|
{
|
|
256
256
|
"id": "prowler.aws.awslambda_layer_no_secrets_in_content",
|
|
257
257
|
"title": "Lambda layer content contains no hardcoded secrets",
|
|
258
|
-
"scope": "Prowler 5.
|
|
258
|
+
"scope": "Prowler 5.47.0 check awslambda_layer_no_secrets_in_content (AWS awslambda, resource type AwsLambdaLayerVersion): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
259
259
|
"evidenceType": "Configuration",
|
|
260
260
|
"severity": "high"
|
|
261
261
|
},
|
|
262
262
|
{
|
|
263
263
|
"id": "prowler.aws.backup_plans_exist",
|
|
264
264
|
"title": "At least one AWS Backup plan exists",
|
|
265
|
-
"scope": "Prowler 5.
|
|
265
|
+
"scope": "Prowler 5.47.0 check backup_plans_exist (AWS backup, resource type AwsBackupBackupPlan): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
266
266
|
"evidenceType": "Configuration",
|
|
267
267
|
"severity": "low"
|
|
268
268
|
},
|
|
269
269
|
{
|
|
270
270
|
"id": "prowler.aws.backup_recovery_point_encrypted",
|
|
271
271
|
"title": "AWS Backup recovery point is encrypted at rest",
|
|
272
|
-
"scope": "Prowler 5.
|
|
272
|
+
"scope": "Prowler 5.47.0 check backup_recovery_point_encrypted (AWS backup, resource type AwsBackupRecoveryPoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
273
273
|
"evidenceType": "Configuration",
|
|
274
274
|
"severity": "medium"
|
|
275
275
|
},
|
|
276
276
|
{
|
|
277
277
|
"id": "prowler.aws.backup_reportplans_exist",
|
|
278
278
|
"title": "At least one AWS Backup report plan exists",
|
|
279
|
-
"scope": "Prowler 5.
|
|
279
|
+
"scope": "Prowler 5.47.0 check backup_reportplans_exist (AWS backup, resource type AwsBackupBackupPlan): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
280
280
|
"evidenceType": "Configuration",
|
|
281
281
|
"severity": "low"
|
|
282
282
|
},
|
|
283
283
|
{
|
|
284
284
|
"id": "prowler.aws.backup_vaults_encrypted",
|
|
285
285
|
"title": "AWS Backup vault is encrypted at rest",
|
|
286
|
-
"scope": "Prowler 5.
|
|
286
|
+
"scope": "Prowler 5.47.0 check backup_vaults_encrypted (AWS backup, resource type AwsBackupBackupVault): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
287
287
|
"evidenceType": "Configuration",
|
|
288
288
|
"severity": "medium"
|
|
289
289
|
},
|
|
290
290
|
{
|
|
291
291
|
"id": "prowler.aws.backup_vaults_exist",
|
|
292
292
|
"title": "At least one AWS Backup vault exists",
|
|
293
|
-
"scope": "Prowler 5.
|
|
293
|
+
"scope": "Prowler 5.47.0 check backup_vaults_exist (AWS backup, resource type AwsBackupBackupVault): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
294
294
|
"evidenceType": "Configuration",
|
|
295
295
|
"severity": "low"
|
|
296
296
|
},
|
|
297
297
|
{
|
|
298
298
|
"id": "prowler.aws.batch_job_definition_no_secrets",
|
|
299
299
|
"title": "AWS Batch job definitions have no secrets in environment variables or command parameters",
|
|
300
|
-
"scope": "Prowler 5.
|
|
300
|
+
"scope": "Prowler 5.47.0 check batch_job_definition_no_secrets (AWS batch, resource type AwsBatchJobDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
301
301
|
"evidenceType": "Configuration",
|
|
302
302
|
"severity": "high"
|
|
303
303
|
},
|
|
304
304
|
{
|
|
305
305
|
"id": "prowler.aws.bedrock_agent_role_least_privilege",
|
|
306
306
|
"title": "Amazon Bedrock agent execution role follows least privilege",
|
|
307
|
-
"scope": "Prowler 5.
|
|
307
|
+
"scope": "Prowler 5.47.0 check bedrock_agent_role_least_privilege (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
308
308
|
"evidenceType": "Configuration",
|
|
309
309
|
"severity": "high"
|
|
310
310
|
},
|
|
311
311
|
{
|
|
312
312
|
"id": "prowler.aws.bedrock_agent_role_not_shared_across_agents",
|
|
313
313
|
"title": "Bedrock Agent has a dedicated execution role",
|
|
314
|
-
"scope": "Prowler 5.
|
|
314
|
+
"scope": "Prowler 5.47.0 check bedrock_agent_role_not_shared_across_agents (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
315
315
|
"evidenceType": "Configuration",
|
|
316
316
|
"severity": "high"
|
|
317
317
|
},
|
|
318
318
|
{
|
|
319
319
|
"id": "prowler.aws.bedrock_api_key_no_administrative_privileges",
|
|
320
320
|
"title": "Amazon Bedrock API key does not have administrative privileges, privilege escalation paths, or full Bedrock service access",
|
|
321
|
-
"scope": "Prowler 5.
|
|
321
|
+
"scope": "Prowler 5.47.0 check bedrock_api_key_no_administrative_privileges (AWS bedrock, resource type AwsIamAccessKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
322
322
|
"evidenceType": "Configuration",
|
|
323
323
|
"severity": "high"
|
|
324
324
|
},
|
|
325
325
|
{
|
|
326
326
|
"id": "prowler.aws.bedrock_api_key_no_long_term_credentials",
|
|
327
327
|
"title": "Amazon Bedrock long-term API key has expired",
|
|
328
|
-
"scope": "Prowler 5.
|
|
328
|
+
"scope": "Prowler 5.47.0 check bedrock_api_key_no_long_term_credentials (AWS bedrock, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
329
329
|
"evidenceType": "Configuration",
|
|
330
330
|
"severity": "high"
|
|
331
331
|
},
|
|
332
332
|
{
|
|
333
333
|
"id": "prowler.aws.bedrock_custom_model_encrypted_with_cmk",
|
|
334
334
|
"title": "Bedrock custom model is encrypted with a customer-managed KMS key",
|
|
335
|
-
"scope": "Prowler 5.
|
|
335
|
+
"scope": "Prowler 5.47.0 check bedrock_custom_model_encrypted_with_cmk (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
336
336
|
"evidenceType": "Configuration",
|
|
337
337
|
"severity": "critical"
|
|
338
338
|
},
|
|
339
339
|
{
|
|
340
340
|
"id": "prowler.aws.bedrock_full_access_policy_attached",
|
|
341
341
|
"title": "IAM role does not have AmazonBedrockFullAccess managed policy attached",
|
|
342
|
-
"scope": "Prowler 5.
|
|
342
|
+
"scope": "Prowler 5.47.0 check bedrock_full_access_policy_attached (AWS bedrock, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
343
343
|
"evidenceType": "Configuration",
|
|
344
344
|
"severity": "high"
|
|
345
345
|
},
|
|
346
346
|
{
|
|
347
347
|
"id": "prowler.aws.bedrock_knowledge_base_encrypted_with_cmk",
|
|
348
348
|
"title": "Bedrock knowledge base data source is encrypted with a customer-managed KMS key",
|
|
349
|
-
"scope": "Prowler 5.
|
|
349
|
+
"scope": "Prowler 5.47.0 check bedrock_knowledge_base_encrypted_with_cmk (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
350
350
|
"evidenceType": "Configuration",
|
|
351
351
|
"severity": "high"
|
|
352
352
|
},
|
|
353
353
|
{
|
|
354
354
|
"id": "prowler.aws.bedrock_model_invocation_logging_enabled",
|
|
355
355
|
"title": "Amazon Bedrock model invocation logging is enabled",
|
|
356
|
-
"scope": "Prowler 5.
|
|
356
|
+
"scope": "Prowler 5.47.0 check bedrock_model_invocation_logging_enabled (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
357
357
|
"evidenceType": "Configuration",
|
|
358
358
|
"severity": "medium"
|
|
359
359
|
},
|
|
360
360
|
{
|
|
361
361
|
"id": "prowler.aws.bedrock_prompt_encrypted_with_cmk",
|
|
362
362
|
"title": "Amazon Bedrock prompt is encrypted at rest with a customer-managed KMS key",
|
|
363
|
-
"scope": "Prowler 5.
|
|
363
|
+
"scope": "Prowler 5.47.0 check bedrock_prompt_encrypted_with_cmk (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
364
364
|
"evidenceType": "Configuration",
|
|
365
365
|
"severity": "medium"
|
|
366
366
|
},
|
|
367
367
|
{
|
|
368
368
|
"id": "prowler.aws.cloudformation_stack_outputs_find_secrets",
|
|
369
369
|
"title": "CloudFormation stack outputs do not contain secrets",
|
|
370
|
-
"scope": "Prowler 5.
|
|
370
|
+
"scope": "Prowler 5.47.0 check cloudformation_stack_outputs_find_secrets (AWS cloudformation, resource type AwsCloudFormationStack): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
371
371
|
"evidenceType": "Configuration",
|
|
372
372
|
"severity": "critical"
|
|
373
373
|
},
|
|
374
374
|
{
|
|
375
375
|
"id": "prowler.aws.cloudfront_distributions_field_level_encryption_enabled",
|
|
376
376
|
"title": "CloudFront distribution has Field Level Encryption enabled",
|
|
377
|
-
"scope": "Prowler 5.
|
|
377
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_field_level_encryption_enabled (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
378
378
|
"evidenceType": "Configuration",
|
|
379
379
|
"severity": "low"
|
|
380
380
|
},
|
|
381
381
|
{
|
|
382
382
|
"id": "prowler.aws.cloudfront_distributions_https_enabled",
|
|
383
383
|
"title": "CloudFront distribution has viewer protocol policy set to HTTPS only or redirect to HTTPS",
|
|
384
|
-
"scope": "Prowler 5.
|
|
384
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_https_enabled (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
385
385
|
"evidenceType": "Configuration",
|
|
386
386
|
"severity": "medium"
|
|
387
387
|
},
|
|
388
388
|
{
|
|
389
389
|
"id": "prowler.aws.cloudfront_distributions_logging_enabled",
|
|
390
390
|
"title": "CloudFront distribution has logging enabled",
|
|
391
|
-
"scope": "Prowler 5.
|
|
391
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_logging_enabled (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
392
392
|
"evidenceType": "Configuration",
|
|
393
393
|
"severity": "medium"
|
|
394
394
|
},
|
|
395
395
|
{
|
|
396
396
|
"id": "prowler.aws.cloudfront_distributions_multiple_origin_failover_configured",
|
|
397
397
|
"title": "CloudFront distribution has origin failover configured with at least two origins",
|
|
398
|
-
"scope": "Prowler 5.
|
|
398
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_multiple_origin_failover_configured (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
399
399
|
"evidenceType": "Configuration",
|
|
400
400
|
"severity": "low"
|
|
401
401
|
},
|
|
402
402
|
{
|
|
403
403
|
"id": "prowler.aws.cloudfront_distributions_origin_traffic_encrypted",
|
|
404
404
|
"title": "CloudFront distribution encrypts traffic to custom origins",
|
|
405
|
-
"scope": "Prowler 5.
|
|
405
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_origin_traffic_encrypted (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
406
406
|
"evidenceType": "Configuration",
|
|
407
407
|
"severity": "medium"
|
|
408
408
|
},
|
|
409
409
|
{
|
|
410
410
|
"id": "prowler.aws.cloudfront_distributions_pqc_tls_enabled",
|
|
411
411
|
"title": "CloudFront distributions enforce a post-quantum TLS 1.3 security policy",
|
|
412
|
-
"scope": "Prowler 5.
|
|
412
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_pqc_tls_enabled (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
413
413
|
"evidenceType": "Configuration",
|
|
414
414
|
"severity": "low"
|
|
415
415
|
},
|
|
416
416
|
{
|
|
417
417
|
"id": "prowler.aws.cloudfront_distributions_s3_origin_access_control",
|
|
418
418
|
"title": "CloudFront distribution uses Origin Access Control (OAC) for all S3 origins",
|
|
419
|
-
"scope": "Prowler 5.
|
|
419
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_s3_origin_access_control (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
420
420
|
"evidenceType": "Configuration",
|
|
421
421
|
"severity": "medium"
|
|
422
422
|
},
|
|
423
423
|
{
|
|
424
424
|
"id": "prowler.aws.cloudfront_distributions_s3_origin_non_existent_bucket",
|
|
425
425
|
"title": "CloudFront distribution S3 origins reference existing buckets",
|
|
426
|
-
"scope": "Prowler 5.
|
|
426
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_s3_origin_non_existent_bucket (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
427
427
|
"evidenceType": "Configuration",
|
|
428
428
|
"severity": "high"
|
|
429
429
|
},
|
|
430
430
|
{
|
|
431
431
|
"id": "prowler.aws.cloudfront_distributions_using_deprecated_ssl_protocols",
|
|
432
432
|
"title": "CloudFront distribution does not use SSLv3, TLSv1, or TLSv1.1 for origin connections",
|
|
433
|
-
"scope": "Prowler 5.
|
|
433
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_using_deprecated_ssl_protocols (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
434
434
|
"evidenceType": "Configuration",
|
|
435
435
|
"severity": "low"
|
|
436
436
|
},
|
|
437
437
|
{
|
|
438
438
|
"id": "prowler.aws.cloudfront_distributions_using_waf",
|
|
439
439
|
"title": "CloudFront distribution uses an AWS WAF web ACL",
|
|
440
|
-
"scope": "Prowler 5.
|
|
440
|
+
"scope": "Prowler 5.47.0 check cloudfront_distributions_using_waf (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
441
441
|
"evidenceType": "Configuration",
|
|
442
442
|
"severity": "medium"
|
|
443
443
|
},
|
|
444
444
|
{
|
|
445
445
|
"id": "prowler.aws.cloudtrail_bedrock_logging_enabled",
|
|
446
446
|
"title": "CloudTrail logs Amazon Bedrock API calls for security auditing",
|
|
447
|
-
"scope": "Prowler 5.
|
|
447
|
+
"scope": "Prowler 5.47.0 check cloudtrail_bedrock_logging_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
448
448
|
"evidenceType": "Configuration",
|
|
449
449
|
"severity": "medium"
|
|
450
450
|
},
|
|
451
451
|
{
|
|
452
452
|
"id": "prowler.aws.cloudtrail_bucket_requires_mfa_delete",
|
|
453
453
|
"title": "CloudTrail trail S3 bucket has MFA delete enabled",
|
|
454
|
-
"scope": "Prowler 5.
|
|
454
|
+
"scope": "Prowler 5.47.0 check cloudtrail_bucket_requires_mfa_delete (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
455
455
|
"evidenceType": "Configuration",
|
|
456
456
|
"severity": "medium"
|
|
457
457
|
},
|
|
458
458
|
{
|
|
459
459
|
"id": "prowler.aws.cloudtrail_cloudwatch_logging_enabled",
|
|
460
460
|
"title": "CloudTrail trail has delivered logs to CloudWatch Logs in the last 24 hours",
|
|
461
|
-
"scope": "Prowler 5.
|
|
461
|
+
"scope": "Prowler 5.47.0 check cloudtrail_cloudwatch_logging_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
462
462
|
"evidenceType": "Configuration",
|
|
463
463
|
"severity": "low"
|
|
464
464
|
},
|
|
465
465
|
{
|
|
466
466
|
"id": "prowler.aws.cloudtrail_kms_encryption_enabled",
|
|
467
467
|
"title": "CloudTrail trail logs are encrypted at rest with a KMS key",
|
|
468
|
-
"scope": "Prowler 5.
|
|
468
|
+
"scope": "Prowler 5.47.0 check cloudtrail_kms_encryption_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
469
469
|
"evidenceType": "Configuration",
|
|
470
470
|
"severity": "medium"
|
|
471
471
|
},
|
|
472
472
|
{
|
|
473
473
|
"id": "prowler.aws.cloudtrail_log_file_validation_enabled",
|
|
474
474
|
"title": "CloudTrail trail has log file validation enabled",
|
|
475
|
-
"scope": "Prowler 5.
|
|
475
|
+
"scope": "Prowler 5.47.0 check cloudtrail_log_file_validation_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
476
476
|
"evidenceType": "Configuration",
|
|
477
477
|
"severity": "medium"
|
|
478
478
|
},
|
|
479
479
|
{
|
|
480
480
|
"id": "prowler.aws.cloudtrail_logs_s3_bucket_access_logging_enabled",
|
|
481
481
|
"title": "CloudTrail trail destination S3 bucket has access logging enabled",
|
|
482
|
-
"scope": "Prowler 5.
|
|
482
|
+
"scope": "Prowler 5.47.0 check cloudtrail_logs_s3_bucket_access_logging_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
483
483
|
"evidenceType": "Configuration",
|
|
484
484
|
"severity": "medium"
|
|
485
485
|
},
|
|
486
486
|
{
|
|
487
487
|
"id": "prowler.aws.cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
|
|
488
488
|
"title": "CloudTrail trail S3 bucket is not publicly accessible",
|
|
489
|
-
"scope": "Prowler 5.
|
|
489
|
+
"scope": "Prowler 5.47.0 check cloudtrail_logs_s3_bucket_is_not_publicly_accessible (AWS cloudtrail, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
490
490
|
"evidenceType": "Configuration",
|
|
491
491
|
"severity": "critical"
|
|
492
492
|
},
|
|
493
493
|
{
|
|
494
494
|
"id": "prowler.aws.cloudtrail_multi_region_enabled",
|
|
495
495
|
"title": "Region has at least one CloudTrail trail logging",
|
|
496
|
-
"scope": "Prowler 5.
|
|
496
|
+
"scope": "Prowler 5.47.0 check cloudtrail_multi_region_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
497
497
|
"evidenceType": "Configuration",
|
|
498
498
|
"severity": "high"
|
|
499
499
|
},
|
|
500
500
|
{
|
|
501
501
|
"id": "prowler.aws.cloudtrail_multi_region_enabled_logging_management_events",
|
|
502
502
|
"title": "CloudTrail trail logs management events for read and write operations",
|
|
503
|
-
"scope": "Prowler 5.
|
|
503
|
+
"scope": "Prowler 5.47.0 check cloudtrail_multi_region_enabled_logging_management_events (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
504
504
|
"evidenceType": "Configuration",
|
|
505
505
|
"severity": "low"
|
|
506
506
|
},
|
|
507
507
|
{
|
|
508
508
|
"id": "prowler.aws.cloudtrail_s3_dataevents_read_enabled",
|
|
509
509
|
"title": "CloudTrail trail records S3 object-level read events for all S3 buckets",
|
|
510
|
-
"scope": "Prowler 5.
|
|
510
|
+
"scope": "Prowler 5.47.0 check cloudtrail_s3_dataevents_read_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
511
511
|
"evidenceType": "Configuration",
|
|
512
512
|
"severity": "low"
|
|
513
513
|
},
|
|
514
514
|
{
|
|
515
515
|
"id": "prowler.aws.cloudtrail_s3_dataevents_write_enabled",
|
|
516
516
|
"title": "CloudTrail trail records all S3 object-level API operations for all buckets",
|
|
517
|
-
"scope": "Prowler 5.
|
|
517
|
+
"scope": "Prowler 5.47.0 check cloudtrail_s3_dataevents_write_enabled (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
518
518
|
"evidenceType": "Configuration",
|
|
519
519
|
"severity": "low"
|
|
520
520
|
},
|
|
521
521
|
{
|
|
522
522
|
"id": "prowler.aws.cloudwatch_changes_to_network_acls_alarm_configured",
|
|
523
523
|
"title": "CloudWatch log metric filter and alarm exist for Network ACL (NACL) change events",
|
|
524
|
-
"scope": "Prowler 5.
|
|
524
|
+
"scope": "Prowler 5.47.0 check cloudwatch_changes_to_network_acls_alarm_configured (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
525
525
|
"evidenceType": "Configuration",
|
|
526
526
|
"severity": "medium"
|
|
527
527
|
},
|
|
528
528
|
{
|
|
529
529
|
"id": "prowler.aws.cloudwatch_changes_to_network_gateways_alarm_configured",
|
|
530
530
|
"title": "CloudWatch Logs metric filter and alarm exist for changes to network gateways",
|
|
531
|
-
"scope": "Prowler 5.
|
|
531
|
+
"scope": "Prowler 5.47.0 check cloudwatch_changes_to_network_gateways_alarm_configured (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
532
532
|
"evidenceType": "Configuration",
|
|
533
533
|
"severity": "medium"
|
|
534
534
|
},
|
|
535
535
|
{
|
|
536
536
|
"id": "prowler.aws.cloudwatch_changes_to_network_route_tables_alarm_configured",
|
|
537
537
|
"title": "Account monitors VPC route table changes with a CloudWatch Logs metric filter and alarm",
|
|
538
|
-
"scope": "Prowler 5.
|
|
538
|
+
"scope": "Prowler 5.47.0 check cloudwatch_changes_to_network_route_tables_alarm_configured (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
539
539
|
"evidenceType": "Configuration",
|
|
540
540
|
"severity": "medium"
|
|
541
541
|
},
|
|
542
542
|
{
|
|
543
543
|
"id": "prowler.aws.cloudwatch_changes_to_vpcs_alarm_configured",
|
|
544
544
|
"title": "AWS account has a CloudWatch Logs metric filter and alarm for VPC changes",
|
|
545
|
-
"scope": "Prowler 5.
|
|
545
|
+
"scope": "Prowler 5.47.0 check cloudwatch_changes_to_vpcs_alarm_configured (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
546
546
|
"evidenceType": "Configuration",
|
|
547
547
|
"severity": "medium"
|
|
548
548
|
},
|
|
549
549
|
{
|
|
550
550
|
"id": "prowler.aws.cloudwatch_cross_account_sharing_disabled",
|
|
551
551
|
"title": "CloudWatch does not allow cross-account sharing",
|
|
552
|
-
"scope": "Prowler 5.
|
|
552
|
+
"scope": "Prowler 5.47.0 check cloudwatch_cross_account_sharing_disabled (AWS cloudwatch, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
553
553
|
"evidenceType": "Configuration",
|
|
554
554
|
"severity": "medium"
|
|
555
555
|
},
|
|
556
556
|
{
|
|
557
557
|
"id": "prowler.aws.cloudwatch_log_group_kms_encryption_enabled",
|
|
558
558
|
"title": "CloudWatch log group is encrypted with an AWS KMS key",
|
|
559
|
-
"scope": "Prowler 5.
|
|
559
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_group_kms_encryption_enabled (AWS cloudwatch, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
560
560
|
"evidenceType": "Configuration",
|
|
561
561
|
"severity": "medium"
|
|
562
562
|
},
|
|
563
563
|
{
|
|
564
564
|
"id": "prowler.aws.cloudwatch_log_group_no_secrets_in_logs",
|
|
565
565
|
"title": "CloudWatch log group contains no secrets in its log events",
|
|
566
|
-
"scope": "Prowler 5.
|
|
566
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_group_no_secrets_in_logs (AWS cloudwatch, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
567
567
|
"evidenceType": "Configuration",
|
|
568
568
|
"severity": "medium"
|
|
569
569
|
},
|
|
570
570
|
{
|
|
571
571
|
"id": "prowler.aws.cloudwatch_log_group_not_publicly_accessible",
|
|
572
572
|
"title": "CloudWatch Log Group is not publicly accessible",
|
|
573
|
-
"scope": "Prowler 5.
|
|
573
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_group_not_publicly_accessible (AWS cloudwatch, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
574
574
|
"evidenceType": "Configuration",
|
|
575
575
|
"severity": "high"
|
|
576
576
|
},
|
|
577
577
|
{
|
|
578
578
|
"id": "prowler.aws.cloudwatch_log_group_retention_policy_specific_days_enabled",
|
|
579
579
|
"title": "CloudWatch log group has a retention policy of at least the configured minimum days or never expires",
|
|
580
|
-
"scope": "Prowler 5.
|
|
580
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_group_retention_policy_specific_days_enabled (AWS cloudwatch, resource type AwsLogsLogGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
581
581
|
"evidenceType": "Configuration",
|
|
582
582
|
"severity": "medium"
|
|
583
583
|
},
|
|
584
584
|
{
|
|
585
585
|
"id": "prowler.aws.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
|
|
586
586
|
"title": "CloudWatch Logs metric filter and alarm exist for AWS Config configuration changes",
|
|
587
|
-
"scope": "Prowler 5.
|
|
587
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
588
588
|
"evidenceType": "Configuration",
|
|
589
589
|
"severity": "medium"
|
|
590
590
|
},
|
|
591
591
|
{
|
|
592
592
|
"id": "prowler.aws.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
|
|
593
593
|
"title": "CloudWatch Logs metric filter and alarm exist for CloudTrail configuration changes",
|
|
594
|
-
"scope": "Prowler 5.
|
|
594
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
595
595
|
"evidenceType": "Configuration",
|
|
596
596
|
"severity": "medium"
|
|
597
597
|
},
|
|
598
598
|
{
|
|
599
599
|
"id": "prowler.aws.cloudwatch_log_metric_filter_aws_organizations_changes",
|
|
600
600
|
"title": "CloudWatch Logs metric filter and alarm exist for AWS Organizations changes",
|
|
601
|
-
"scope": "Prowler 5.
|
|
601
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_aws_organizations_changes (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
602
602
|
"evidenceType": "Configuration",
|
|
603
603
|
"severity": "medium"
|
|
604
604
|
},
|
|
605
605
|
{
|
|
606
606
|
"id": "prowler.aws.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk",
|
|
607
607
|
"title": "Account has a CloudWatch log metric filter and alarm for disabling or scheduled deletion of customer-managed KMS keys",
|
|
608
|
-
"scope": "Prowler 5.
|
|
608
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
609
609
|
"evidenceType": "Configuration",
|
|
610
610
|
"severity": "medium"
|
|
611
611
|
},
|
|
612
612
|
{
|
|
613
613
|
"id": "prowler.aws.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
|
|
614
614
|
"title": "CloudWatch log metric filter and alarm exist for S3 bucket policy changes",
|
|
615
|
-
"scope": "Prowler 5.
|
|
615
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_for_s3_bucket_policy_changes (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
616
616
|
"evidenceType": "Configuration",
|
|
617
617
|
"severity": "medium"
|
|
618
618
|
},
|
|
619
619
|
{
|
|
620
620
|
"id": "prowler.aws.cloudwatch_log_metric_filter_policy_changes",
|
|
621
621
|
"title": "CloudWatch Logs metric filter and alarm exist for IAM policy changes",
|
|
622
|
-
"scope": "Prowler 5.
|
|
622
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_policy_changes (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
623
623
|
"evidenceType": "Configuration",
|
|
624
624
|
"severity": "medium"
|
|
625
625
|
},
|
|
626
626
|
{
|
|
627
627
|
"id": "prowler.aws.cloudwatch_log_metric_filter_security_group_changes",
|
|
628
628
|
"title": "CloudWatch Logs metric filter and alarm exist for security group changes",
|
|
629
|
-
"scope": "Prowler 5.
|
|
629
|
+
"scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_security_group_changes (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
630
630
|
"evidenceType": "Configuration",
|
|
631
631
|
"severity": "medium"
|
|
632
632
|
},
|
|
633
633
|
{
|
|
634
634
|
"id": "prowler.aws.codeartifact_packages_external_public_publishing_disabled",
|
|
635
635
|
"title": "Internal CodeArtifact package does not allow publishing versions already present in external public sources",
|
|
636
|
-
"scope": "Prowler 5.
|
|
636
|
+
"scope": "Prowler 5.47.0 check codeartifact_packages_external_public_publishing_disabled (AWS codeartifact, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
637
637
|
"evidenceType": "Configuration",
|
|
638
638
|
"severity": "critical"
|
|
639
639
|
},
|
|
640
640
|
{
|
|
641
641
|
"id": "prowler.aws.codebuild_project_logging_enabled",
|
|
642
642
|
"title": "CodeBuild project has CloudWatch Logs or S3 logging enabled",
|
|
643
|
-
"scope": "Prowler 5.
|
|
643
|
+
"scope": "Prowler 5.47.0 check codebuild_project_logging_enabled (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
644
644
|
"evidenceType": "Configuration",
|
|
645
645
|
"severity": "medium"
|
|
646
646
|
},
|
|
647
647
|
{
|
|
648
648
|
"id": "prowler.aws.codebuild_project_no_secrets_in_variables",
|
|
649
649
|
"title": "CodeBuild project has no sensitive credentials in plaintext environment variables",
|
|
650
|
-
"scope": "Prowler 5.
|
|
650
|
+
"scope": "Prowler 5.47.0 check codebuild_project_no_secrets_in_variables (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
651
651
|
"evidenceType": "Configuration",
|
|
652
652
|
"severity": "critical"
|
|
653
653
|
},
|
|
654
654
|
{
|
|
655
655
|
"id": "prowler.aws.codebuild_project_not_publicly_accessible",
|
|
656
656
|
"title": "CodeBuild project visibility is private",
|
|
657
|
-
"scope": "Prowler 5.
|
|
657
|
+
"scope": "Prowler 5.47.0 check codebuild_project_not_publicly_accessible (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
658
658
|
"evidenceType": "Configuration",
|
|
659
659
|
"severity": "high"
|
|
660
660
|
},
|
|
661
661
|
{
|
|
662
662
|
"id": "prowler.aws.codebuild_project_source_repo_url_no_sensitive_credentials",
|
|
663
663
|
"title": "CodeBuild project source repository URLs do not contain sensitive credentials",
|
|
664
|
-
"scope": "Prowler 5.
|
|
664
|
+
"scope": "Prowler 5.47.0 check codebuild_project_source_repo_url_no_sensitive_credentials (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
665
665
|
"evidenceType": "Configuration",
|
|
666
666
|
"severity": "critical"
|
|
667
667
|
},
|
|
668
668
|
{
|
|
669
669
|
"id": "prowler.aws.codebuild_project_user_controlled_buildspec",
|
|
670
670
|
"title": "CodeBuild project does not use a user-controlled buildspec file",
|
|
671
|
-
"scope": "Prowler 5.
|
|
671
|
+
"scope": "Prowler 5.47.0 check codebuild_project_user_controlled_buildspec (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
672
672
|
"evidenceType": "Configuration",
|
|
673
673
|
"severity": "medium"
|
|
674
674
|
},
|
|
675
675
|
{
|
|
676
676
|
"id": "prowler.aws.codebuild_project_uses_allowed_github_organizations",
|
|
677
677
|
"title": "CodeBuild project using GitHub uses an allowed GitHub organization",
|
|
678
|
-
"scope": "Prowler 5.
|
|
678
|
+
"scope": "Prowler 5.47.0 check codebuild_project_uses_allowed_github_organizations (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
679
679
|
"evidenceType": "Configuration",
|
|
680
680
|
"severity": "high"
|
|
681
681
|
},
|
|
682
682
|
{
|
|
683
683
|
"id": "prowler.aws.codebuild_report_group_export_encrypted",
|
|
684
684
|
"title": "CodeBuild report group exports to S3 are encrypted at rest",
|
|
685
|
-
"scope": "Prowler 5.
|
|
685
|
+
"scope": "Prowler 5.47.0 check codebuild_report_group_export_encrypted (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
686
686
|
"evidenceType": "Configuration",
|
|
687
687
|
"severity": "medium"
|
|
688
688
|
},
|
|
689
689
|
{
|
|
690
690
|
"id": "prowler.aws.codecommit_repository_no_secrets",
|
|
691
691
|
"title": "CodeCommit repository has no secrets in its default branch",
|
|
692
|
-
"scope": "Prowler 5.
|
|
692
|
+
"scope": "Prowler 5.47.0 check codecommit_repository_no_secrets (AWS codecommit, resource type AwsCodeCommitRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
693
693
|
"evidenceType": "Configuration",
|
|
694
694
|
"severity": "high"
|
|
695
695
|
},
|
|
696
696
|
{
|
|
697
697
|
"id": "prowler.aws.cognito_user_pool_advanced_security_enabled",
|
|
698
698
|
"title": "Cognito user pool has advanced security enforced with full-function mode",
|
|
699
|
-
"scope": "Prowler 5.
|
|
699
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_advanced_security_enabled (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
700
700
|
"evidenceType": "Configuration",
|
|
701
701
|
"severity": "medium"
|
|
702
702
|
},
|
|
703
703
|
{
|
|
704
704
|
"id": "prowler.aws.cognito_user_pool_blocks_compromised_credentials_sign_in_attempts",
|
|
705
705
|
"title": "Cognito user pool blocks sign-in attempts with suspected compromised credentials",
|
|
706
|
-
"scope": "Prowler 5.
|
|
706
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_blocks_compromised_credentials_sign_in_attempts (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
707
707
|
"evidenceType": "Configuration",
|
|
708
708
|
"severity": "medium"
|
|
709
709
|
},
|
|
710
710
|
{
|
|
711
711
|
"id": "prowler.aws.cognito_user_pool_blocks_potential_malicious_sign_in_attempts",
|
|
712
712
|
"title": "Amazon Cognito user pool blocks all potential malicious sign-in attempts",
|
|
713
|
-
"scope": "Prowler 5.
|
|
713
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_blocks_potential_malicious_sign_in_attempts (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
714
714
|
"evidenceType": "Configuration",
|
|
715
715
|
"severity": "medium"
|
|
716
716
|
},
|
|
717
717
|
{
|
|
718
718
|
"id": "prowler.aws.cognito_user_pool_password_policy_lowercase",
|
|
719
719
|
"title": "Cognito user pool password policy requires at least one lowercase letter",
|
|
720
|
-
"scope": "Prowler 5.
|
|
720
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_password_policy_lowercase (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
721
721
|
"evidenceType": "Configuration",
|
|
722
722
|
"severity": "medium"
|
|
723
723
|
},
|
|
724
724
|
{
|
|
725
725
|
"id": "prowler.aws.cognito_user_pool_password_policy_minimum_length_14",
|
|
726
726
|
"title": "Cognito user pool has a password policy with a minimum length of 14 characters or more",
|
|
727
|
-
"scope": "Prowler 5.
|
|
727
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_password_policy_minimum_length_14 (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
728
728
|
"evidenceType": "Configuration",
|
|
729
729
|
"severity": "medium"
|
|
730
730
|
},
|
|
731
731
|
{
|
|
732
732
|
"id": "prowler.aws.cognito_user_pool_password_policy_number",
|
|
733
733
|
"title": "Cognito user pool password policy requires at least one number",
|
|
734
|
-
"scope": "Prowler 5.
|
|
734
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_password_policy_number (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
735
735
|
"evidenceType": "Configuration",
|
|
736
736
|
"severity": "medium"
|
|
737
737
|
},
|
|
738
738
|
{
|
|
739
739
|
"id": "prowler.aws.cognito_user_pool_password_policy_symbol",
|
|
740
740
|
"title": "Cognito user pool password policy requires at least one symbol",
|
|
741
|
-
"scope": "Prowler 5.
|
|
741
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_password_policy_symbol (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
742
742
|
"evidenceType": "Configuration",
|
|
743
743
|
"severity": "medium"
|
|
744
744
|
},
|
|
745
745
|
{
|
|
746
746
|
"id": "prowler.aws.cognito_user_pool_password_policy_uppercase",
|
|
747
747
|
"title": "Cognito user pool password policy requires at least one uppercase letter",
|
|
748
|
-
"scope": "Prowler 5.
|
|
748
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_password_policy_uppercase (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
749
749
|
"evidenceType": "Configuration",
|
|
750
750
|
"severity": "medium"
|
|
751
751
|
},
|
|
752
752
|
{
|
|
753
753
|
"id": "prowler.aws.cognito_user_pool_waf_acl_attached",
|
|
754
754
|
"title": "Amazon Cognito user pool is associated with a WAF Web ACL",
|
|
755
|
-
"scope": "Prowler 5.
|
|
755
|
+
"scope": "Prowler 5.47.0 check cognito_user_pool_waf_acl_attached (AWS cognito, resource type AwsWafv2WebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
756
756
|
"evidenceType": "Configuration",
|
|
757
757
|
"severity": "medium"
|
|
758
758
|
},
|
|
759
759
|
{
|
|
760
760
|
"id": "prowler.aws.config_delegated_admin_and_org_aggregator_all_regions",
|
|
761
761
|
"title": "AWS Config has a delegated administrator and an organization aggregator covering all AWS regions",
|
|
762
|
-
"scope": "Prowler 5.
|
|
762
|
+
"scope": "Prowler 5.47.0 check config_delegated_admin_and_org_aggregator_all_regions (AWS config, resource type AwsConfigConfigurationAggregator): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
763
763
|
"evidenceType": "Configuration",
|
|
764
764
|
"severity": "high"
|
|
765
765
|
},
|
|
766
766
|
{
|
|
767
767
|
"id": "prowler.aws.config_recorder_all_regions_enabled",
|
|
768
768
|
"title": "AWS Config recorder is enabled and not in failure state or disabled",
|
|
769
|
-
"scope": "Prowler 5.
|
|
769
|
+
"scope": "Prowler 5.47.0 check config_recorder_all_regions_enabled (AWS config, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
770
770
|
"evidenceType": "Configuration",
|
|
771
771
|
"severity": "medium"
|
|
772
772
|
},
|
|
773
773
|
{
|
|
774
774
|
"id": "prowler.aws.datapipeline_pipeline_no_secrets_in_definition",
|
|
775
775
|
"title": "Data Pipeline definition has no sensitive credentials",
|
|
776
|
-
"scope": "Prowler 5.
|
|
776
|
+
"scope": "Prowler 5.47.0 check datapipeline_pipeline_no_secrets_in_definition (AWS datapipeline, resource type AwsDataPipelinePipeline): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
777
777
|
"evidenceType": "Configuration",
|
|
778
778
|
"severity": "high"
|
|
779
779
|
},
|
|
780
780
|
{
|
|
781
781
|
"id": "prowler.aws.datasync_task_logging_enabled",
|
|
782
782
|
"title": "DataSync task has CloudWatch Logs log group configured for logging",
|
|
783
|
-
"scope": "Prowler 5.
|
|
783
|
+
"scope": "Prowler 5.47.0 check datasync_task_logging_enabled (AWS datasync, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
784
784
|
"evidenceType": "Configuration",
|
|
785
785
|
"severity": "high"
|
|
786
786
|
},
|
|
787
787
|
{
|
|
788
788
|
"id": "prowler.aws.directconnect_connection_redundancy",
|
|
789
789
|
"title": "Direct Connect connections span at least two locations per region",
|
|
790
|
-
"scope": "Prowler 5.
|
|
790
|
+
"scope": "Prowler 5.47.0 check directconnect_connection_redundancy (AWS directconnect, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
791
791
|
"evidenceType": "Configuration",
|
|
792
792
|
"severity": "medium"
|
|
793
793
|
},
|
|
794
794
|
{
|
|
795
795
|
"id": "prowler.aws.directconnect_virtual_interface_redundancy",
|
|
796
796
|
"title": "Direct Connect gateway or virtual private gateway has at least two virtual interfaces on different Direct Connect connections",
|
|
797
|
-
"scope": "Prowler 5.
|
|
797
|
+
"scope": "Prowler 5.47.0 check directconnect_virtual_interface_redundancy (AWS directconnect, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
798
798
|
"evidenceType": "Configuration",
|
|
799
799
|
"severity": "medium"
|
|
800
800
|
},
|
|
801
801
|
{
|
|
802
802
|
"id": "prowler.aws.directoryservice_directory_log_forwarding_enabled",
|
|
803
803
|
"title": "Directory Service directory has log forwarding to CloudWatch Logs enabled",
|
|
804
|
-
"scope": "Prowler 5.
|
|
804
|
+
"scope": "Prowler 5.47.0 check directoryservice_directory_log_forwarding_enabled (AWS directoryservice, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
805
805
|
"evidenceType": "Configuration",
|
|
806
806
|
"severity": "medium"
|
|
807
807
|
},
|
|
808
808
|
{
|
|
809
809
|
"id": "prowler.aws.directoryservice_ldap_certificate_expiration",
|
|
810
810
|
"title": "Directory Service LDAP certificate expires in more than 90 days",
|
|
811
|
-
"scope": "Prowler 5.
|
|
811
|
+
"scope": "Prowler 5.47.0 check directoryservice_ldap_certificate_expiration (AWS directoryservice, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
812
812
|
"evidenceType": "Configuration",
|
|
813
813
|
"severity": "medium"
|
|
814
814
|
},
|
|
815
815
|
{
|
|
816
816
|
"id": "prowler.aws.dlm_ebs_snapshot_lifecycle_policy_exists",
|
|
817
817
|
"title": "Region with EBS snapshots has at least one EBS snapshot lifecycle policy defined",
|
|
818
|
-
"scope": "Prowler 5.
|
|
818
|
+
"scope": "Prowler 5.47.0 check dlm_ebs_snapshot_lifecycle_policy_exists (AWS dlm, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
819
819
|
"evidenceType": "Configuration",
|
|
820
820
|
"severity": "medium"
|
|
821
821
|
},
|
|
822
822
|
{
|
|
823
823
|
"id": "prowler.aws.dms_endpoint_neptune_iam_authorization_enabled",
|
|
824
824
|
"title": "DMS endpoint for Neptune has IAM authorization enabled",
|
|
825
|
-
"scope": "Prowler 5.
|
|
825
|
+
"scope": "Prowler 5.47.0 check dms_endpoint_neptune_iam_authorization_enabled (AWS dms, resource type AwsDmsEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
826
826
|
"evidenceType": "Configuration",
|
|
827
827
|
"severity": "medium"
|
|
828
828
|
},
|
|
829
829
|
{
|
|
830
830
|
"id": "prowler.aws.dms_endpoint_redis_in_transit_encryption_enabled",
|
|
831
831
|
"title": "DMS endpoint for Redis OSS is encrypted in transit",
|
|
832
|
-
"scope": "Prowler 5.
|
|
832
|
+
"scope": "Prowler 5.47.0 check dms_endpoint_redis_in_transit_encryption_enabled (AWS dms, resource type AwsDmsEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
833
833
|
"evidenceType": "Configuration",
|
|
834
834
|
"severity": "medium"
|
|
835
835
|
},
|
|
836
836
|
{
|
|
837
837
|
"id": "prowler.aws.dms_endpoint_ssl_enabled",
|
|
838
838
|
"title": "DMS endpoint has SSL enabled",
|
|
839
|
-
"scope": "Prowler 5.
|
|
839
|
+
"scope": "Prowler 5.47.0 check dms_endpoint_ssl_enabled (AWS dms, resource type AwsDmsEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
840
840
|
"evidenceType": "Configuration",
|
|
841
841
|
"severity": "high"
|
|
842
842
|
},
|
|
843
843
|
{
|
|
844
844
|
"id": "prowler.aws.dms_instance_multi_az_enabled",
|
|
845
845
|
"title": "DMS replication instance has Multi-AZ enabled",
|
|
846
|
-
"scope": "Prowler 5.
|
|
846
|
+
"scope": "Prowler 5.47.0 check dms_instance_multi_az_enabled (AWS dms, resource type AwsDmsReplicationInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
847
847
|
"evidenceType": "Configuration",
|
|
848
848
|
"severity": "medium"
|
|
849
849
|
},
|
|
850
850
|
{
|
|
851
851
|
"id": "prowler.aws.dms_instance_no_public_access",
|
|
852
852
|
"title": "DMS replication instance is not publicly exposed to the Internet",
|
|
853
|
-
"scope": "Prowler 5.
|
|
853
|
+
"scope": "Prowler 5.47.0 check dms_instance_no_public_access (AWS dms, resource type AwsDmsReplicationInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
854
854
|
"evidenceType": "Configuration",
|
|
855
855
|
"severity": "critical"
|
|
856
856
|
},
|
|
857
857
|
{
|
|
858
858
|
"id": "prowler.aws.dms_replication_task_source_logging_enabled",
|
|
859
859
|
"title": "DMS replication task has logging enabled and SOURCE_CAPTURE and SOURCE_UNLOAD components set to at least Default severity",
|
|
860
|
-
"scope": "Prowler 5.
|
|
860
|
+
"scope": "Prowler 5.47.0 check dms_replication_task_source_logging_enabled (AWS dms, resource type AwsDmsReplicationTask): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
861
861
|
"evidenceType": "Configuration",
|
|
862
862
|
"severity": "medium"
|
|
863
863
|
},
|
|
864
864
|
{
|
|
865
865
|
"id": "prowler.aws.dms_replication_task_target_logging_enabled",
|
|
866
866
|
"title": "DMS replication task has TARGET_APPLY and TARGET_LOAD logging enabled with at least default severity",
|
|
867
|
-
"scope": "Prowler 5.
|
|
867
|
+
"scope": "Prowler 5.47.0 check dms_replication_task_target_logging_enabled (AWS dms, resource type AwsDmsReplicationTask): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
868
868
|
"evidenceType": "Configuration",
|
|
869
869
|
"severity": "medium"
|
|
870
870
|
},
|
|
871
871
|
{
|
|
872
872
|
"id": "prowler.aws.documentdb_cluster_backup_enabled",
|
|
873
873
|
"title": "DocumentDB cluster has automated backups enabled with retention period of at least 7 days",
|
|
874
|
-
"scope": "Prowler 5.
|
|
874
|
+
"scope": "Prowler 5.47.0 check documentdb_cluster_backup_enabled (AWS documentdb, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
875
875
|
"evidenceType": "Configuration",
|
|
876
876
|
"severity": "medium"
|
|
877
877
|
},
|
|
878
878
|
{
|
|
879
879
|
"id": "prowler.aws.documentdb_cluster_cloudwatch_log_export",
|
|
880
880
|
"title": "DocumentDB cluster exports audit and profiler logs to CloudWatch Logs",
|
|
881
|
-
"scope": "Prowler 5.
|
|
881
|
+
"scope": "Prowler 5.47.0 check documentdb_cluster_cloudwatch_log_export (AWS documentdb, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
882
882
|
"evidenceType": "Configuration",
|
|
883
883
|
"severity": "medium"
|
|
884
884
|
},
|
|
885
885
|
{
|
|
886
886
|
"id": "prowler.aws.documentdb_cluster_multi_az_enabled",
|
|
887
887
|
"title": "DocumentDB cluster has Multi-AZ enabled",
|
|
888
|
-
"scope": "Prowler 5.
|
|
888
|
+
"scope": "Prowler 5.47.0 check documentdb_cluster_multi_az_enabled (AWS documentdb, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
889
889
|
"evidenceType": "Configuration",
|
|
890
890
|
"severity": "medium"
|
|
891
891
|
},
|
|
892
892
|
{
|
|
893
893
|
"id": "prowler.aws.documentdb_cluster_public_snapshot",
|
|
894
894
|
"title": "DocumentDB manual cluster snapshot is not shared publicly",
|
|
895
|
-
"scope": "Prowler 5.
|
|
895
|
+
"scope": "Prowler 5.47.0 check documentdb_cluster_public_snapshot (AWS documentdb, resource type AwsRdsDbClusterSnapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
896
896
|
"evidenceType": "Configuration",
|
|
897
897
|
"severity": "critical"
|
|
898
898
|
},
|
|
899
899
|
{
|
|
900
900
|
"id": "prowler.aws.documentdb_cluster_storage_encrypted",
|
|
901
901
|
"title": "DocumentDB cluster storage is encrypted at rest",
|
|
902
|
-
"scope": "Prowler 5.
|
|
902
|
+
"scope": "Prowler 5.47.0 check documentdb_cluster_storage_encrypted (AWS documentdb, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
903
903
|
"evidenceType": "Configuration",
|
|
904
904
|
"severity": "medium"
|
|
905
905
|
},
|
|
906
906
|
{
|
|
907
907
|
"id": "prowler.aws.drs_job_exist",
|
|
908
908
|
"title": "Region has AWS Elastic Disaster Recovery (DRS) enabled with at least one recovery job",
|
|
909
|
-
"scope": "Prowler 5.
|
|
909
|
+
"scope": "Prowler 5.47.0 check drs_job_exist (AWS drs, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
910
910
|
"evidenceType": "Configuration",
|
|
911
911
|
"severity": "medium"
|
|
912
912
|
},
|
|
913
913
|
{
|
|
914
914
|
"id": "prowler.aws.dynamodb_accelerator_cluster_encryption_enabled",
|
|
915
915
|
"title": "DynamoDB DAX cluster has encryption at rest enabled",
|
|
916
|
-
"scope": "Prowler 5.
|
|
916
|
+
"scope": "Prowler 5.47.0 check dynamodb_accelerator_cluster_encryption_enabled (AWS dynamodb, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
917
917
|
"evidenceType": "Configuration",
|
|
918
918
|
"severity": "medium"
|
|
919
919
|
},
|
|
920
920
|
{
|
|
921
921
|
"id": "prowler.aws.dynamodb_accelerator_cluster_in_transit_encryption_enabled",
|
|
922
922
|
"title": "DynamoDB Accelerator (DAX) cluster has encryption in transit enabled",
|
|
923
|
-
"scope": "Prowler 5.
|
|
923
|
+
"scope": "Prowler 5.47.0 check dynamodb_accelerator_cluster_in_transit_encryption_enabled (AWS dynamodb, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
924
924
|
"evidenceType": "Configuration",
|
|
925
925
|
"severity": "medium"
|
|
926
926
|
},
|
|
927
927
|
{
|
|
928
928
|
"id": "prowler.aws.dynamodb_accelerator_cluster_multi_az",
|
|
929
929
|
"title": "DynamoDB Accelerator (DAX) cluster has nodes in multiple Availability Zones",
|
|
930
|
-
"scope": "Prowler 5.
|
|
930
|
+
"scope": "Prowler 5.47.0 check dynamodb_accelerator_cluster_multi_az (AWS dynamodb, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
931
931
|
"evidenceType": "Configuration",
|
|
932
932
|
"severity": "medium"
|
|
933
933
|
},
|
|
934
934
|
{
|
|
935
935
|
"id": "prowler.aws.dynamodb_table_autoscaling_enabled",
|
|
936
936
|
"title": "DynamoDB table uses on-demand capacity or has auto scaling enabled for read and write capacity units",
|
|
937
|
-
"scope": "Prowler 5.
|
|
937
|
+
"scope": "Prowler 5.47.0 check dynamodb_table_autoscaling_enabled (AWS dynamodb, resource type AwsDynamoDbTable): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
938
938
|
"evidenceType": "Configuration",
|
|
939
939
|
"severity": "medium"
|
|
940
940
|
},
|
|
941
941
|
{
|
|
942
942
|
"id": "prowler.aws.dynamodb_table_cross_account_access",
|
|
943
943
|
"title": "DynamoDB table resource-based policy does not allow cross-account access",
|
|
944
|
-
"scope": "Prowler 5.
|
|
944
|
+
"scope": "Prowler 5.47.0 check dynamodb_table_cross_account_access (AWS dynamodb, resource type AwsDynamoDbTable): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
945
945
|
"evidenceType": "Configuration",
|
|
946
946
|
"severity": "medium"
|
|
947
947
|
},
|
|
948
948
|
{
|
|
949
949
|
"id": "prowler.aws.dynamodb_table_deletion_protection_enabled",
|
|
950
950
|
"title": "DynamoDB table has deletion protection enabled",
|
|
951
|
-
"scope": "Prowler 5.
|
|
951
|
+
"scope": "Prowler 5.47.0 check dynamodb_table_deletion_protection_enabled (AWS dynamodb, resource type AwsDynamoDbTable): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
952
952
|
"evidenceType": "Configuration",
|
|
953
953
|
"severity": "medium"
|
|
954
954
|
},
|
|
955
955
|
{
|
|
956
956
|
"id": "prowler.aws.dynamodb_table_protected_by_backup_plan",
|
|
957
957
|
"title": "DynamoDB table is protected by a backup plan",
|
|
958
|
-
"scope": "Prowler 5.
|
|
958
|
+
"scope": "Prowler 5.47.0 check dynamodb_table_protected_by_backup_plan (AWS dynamodb, resource type AwsDynamoDbTable): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
959
959
|
"evidenceType": "Configuration",
|
|
960
960
|
"severity": "medium"
|
|
961
961
|
},
|
|
962
962
|
{
|
|
963
963
|
"id": "prowler.aws.dynamodb_tables_kms_cmk_encryption_enabled",
|
|
964
964
|
"title": "DynamoDB table is encrypted at rest with AWS KMS",
|
|
965
|
-
"scope": "Prowler 5.
|
|
965
|
+
"scope": "Prowler 5.47.0 check dynamodb_tables_kms_cmk_encryption_enabled (AWS dynamodb, resource type AwsDynamoDbTable): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
966
966
|
"evidenceType": "Configuration",
|
|
967
967
|
"severity": "medium"
|
|
968
968
|
},
|
|
969
969
|
{
|
|
970
970
|
"id": "prowler.aws.dynamodb_tables_pitr_enabled",
|
|
971
971
|
"title": "DynamoDB table has point-in-time recovery (PITR) enabled",
|
|
972
|
-
"scope": "Prowler 5.
|
|
972
|
+
"scope": "Prowler 5.47.0 check dynamodb_tables_pitr_enabled (AWS dynamodb, resource type AwsDynamoDbTable): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
973
973
|
"evidenceType": "Configuration",
|
|
974
974
|
"severity": "medium"
|
|
975
975
|
},
|
|
976
976
|
{
|
|
977
977
|
"id": "prowler.aws.ec2_ami_account_block_public_access",
|
|
978
978
|
"title": "AMI block public access is enabled at the account level",
|
|
979
|
-
"scope": "Prowler 5.
|
|
979
|
+
"scope": "Prowler 5.47.0 check ec2_ami_account_block_public_access (AWS ec2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
980
980
|
"evidenceType": "Configuration",
|
|
981
981
|
"severity": "medium"
|
|
982
982
|
},
|
|
983
983
|
{
|
|
984
984
|
"id": "prowler.aws.ec2_ami_public",
|
|
985
985
|
"title": "EC2 AMI owned by the account is not public",
|
|
986
|
-
"scope": "Prowler 5.
|
|
986
|
+
"scope": "Prowler 5.47.0 check ec2_ami_public (AWS ec2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
987
987
|
"evidenceType": "Configuration",
|
|
988
988
|
"severity": "critical"
|
|
989
989
|
},
|
|
990
990
|
{
|
|
991
991
|
"id": "prowler.aws.ec2_client_vpn_endpoint_connection_logging_enabled",
|
|
992
992
|
"title": "EC2 Client VPN endpoint has client connection logging enabled",
|
|
993
|
-
"scope": "Prowler 5.
|
|
993
|
+
"scope": "Prowler 5.47.0 check ec2_client_vpn_endpoint_connection_logging_enabled (AWS ec2, resource type AwsEc2ClientVpnEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
994
994
|
"evidenceType": "Configuration",
|
|
995
995
|
"severity": "low"
|
|
996
996
|
},
|
|
997
997
|
{
|
|
998
998
|
"id": "prowler.aws.ec2_confidential_workload_host_imdsv2_not_enforced",
|
|
999
999
|
"title": "Confidential-workload host enforces IMDSv2",
|
|
1000
|
-
"scope": "Prowler 5.
|
|
1000
|
+
"scope": "Prowler 5.47.0 check ec2_confidential_workload_host_imdsv2_not_enforced (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1001
1001
|
"evidenceType": "Configuration",
|
|
1002
1002
|
"severity": "high"
|
|
1003
1003
|
},
|
|
1004
1004
|
{
|
|
1005
1005
|
"id": "prowler.aws.ec2_confidential_workload_host_not_running",
|
|
1006
1006
|
"title": "Nitro Enclave parent instance is in the running state",
|
|
1007
|
-
"scope": "Prowler 5.
|
|
1007
|
+
"scope": "Prowler 5.47.0 check ec2_confidential_workload_host_not_running (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1008
1008
|
"evidenceType": "Configuration",
|
|
1009
1009
|
"severity": "medium"
|
|
1010
1010
|
},
|
|
1011
1011
|
{
|
|
1012
1012
|
"id": "prowler.aws.ec2_confidential_workload_host_public_ip",
|
|
1013
1013
|
"title": "Confidential-workload host is not exposed to the internet",
|
|
1014
|
-
"scope": "Prowler 5.
|
|
1014
|
+
"scope": "Prowler 5.47.0 check ec2_confidential_workload_host_public_ip (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1015
1015
|
"evidenceType": "Configuration",
|
|
1016
1016
|
"severity": "medium"
|
|
1017
1017
|
},
|
|
1018
1018
|
{
|
|
1019
1019
|
"id": "prowler.aws.ec2_confidential_workload_host_unrestricted_ingress",
|
|
1020
1020
|
"title": "Confidential-workload host does not expose non-standard ports to the internet",
|
|
1021
|
-
"scope": "Prowler 5.
|
|
1021
|
+
"scope": "Prowler 5.47.0 check ec2_confidential_workload_host_unrestricted_ingress (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1022
1022
|
"evidenceType": "Configuration",
|
|
1023
1023
|
"severity": "high"
|
|
1024
1024
|
},
|
|
1025
1025
|
{
|
|
1026
1026
|
"id": "prowler.aws.ec2_confidential_workload_host_vsock_proxy_exposed",
|
|
1027
1027
|
"title": "Confidential-workload host does not expose likely vsock-proxy TCP ports to the internet",
|
|
1028
|
-
"scope": "Prowler 5.
|
|
1028
|
+
"scope": "Prowler 5.47.0 check ec2_confidential_workload_host_vsock_proxy_exposed (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1029
1029
|
"evidenceType": "Configuration",
|
|
1030
1030
|
"severity": "medium"
|
|
1031
1031
|
},
|
|
1032
1032
|
{
|
|
1033
1033
|
"id": "prowler.aws.ec2_ebs_default_encryption",
|
|
1034
1034
|
"title": "EBS default encryption is enabled",
|
|
1035
|
-
"scope": "Prowler 5.
|
|
1035
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_default_encryption (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1036
1036
|
"evidenceType": "Configuration",
|
|
1037
1037
|
"severity": "high"
|
|
1038
1038
|
},
|
|
1039
1039
|
{
|
|
1040
1040
|
"id": "prowler.aws.ec2_ebs_public_snapshot",
|
|
1041
1041
|
"title": "EBS snapshot is not public",
|
|
1042
|
-
"scope": "Prowler 5.
|
|
1042
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_public_snapshot (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1043
1043
|
"evidenceType": "Configuration",
|
|
1044
1044
|
"severity": "critical"
|
|
1045
1045
|
},
|
|
1046
1046
|
{
|
|
1047
1047
|
"id": "prowler.aws.ec2_ebs_snapshot_account_block_public_access",
|
|
1048
1048
|
"title": "All EBS snapshots have public access blocked",
|
|
1049
|
-
"scope": "Prowler 5.
|
|
1049
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_snapshot_account_block_public_access (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1050
1050
|
"evidenceType": "Configuration",
|
|
1051
1051
|
"severity": "high"
|
|
1052
1052
|
},
|
|
1053
1053
|
{
|
|
1054
1054
|
"id": "prowler.aws.ec2_ebs_snapshots_encrypted",
|
|
1055
1055
|
"title": "EBS snapshot is encrypted",
|
|
1056
|
-
"scope": "Prowler 5.
|
|
1056
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_snapshots_encrypted (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1057
1057
|
"evidenceType": "Configuration",
|
|
1058
1058
|
"severity": "high"
|
|
1059
1059
|
},
|
|
1060
1060
|
{
|
|
1061
1061
|
"id": "prowler.aws.ec2_ebs_volume_encryption",
|
|
1062
1062
|
"title": "EBS volume is encrypted",
|
|
1063
|
-
"scope": "Prowler 5.
|
|
1063
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_volume_encryption (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1064
1064
|
"evidenceType": "Configuration",
|
|
1065
1065
|
"severity": "high"
|
|
1066
1066
|
},
|
|
1067
1067
|
{
|
|
1068
1068
|
"id": "prowler.aws.ec2_ebs_volume_protected_by_backup_plan",
|
|
1069
1069
|
"title": "EBS volume is protected by a backup plan",
|
|
1070
|
-
"scope": "Prowler 5.
|
|
1070
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_volume_protected_by_backup_plan (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1071
1071
|
"evidenceType": "Configuration",
|
|
1072
1072
|
"severity": "medium"
|
|
1073
1073
|
},
|
|
1074
1074
|
{
|
|
1075
1075
|
"id": "prowler.aws.ec2_ebs_volume_snapshots_exists",
|
|
1076
1076
|
"title": "EBS volume has at least one snapshot",
|
|
1077
|
-
"scope": "Prowler 5.
|
|
1077
|
+
"scope": "Prowler 5.47.0 check ec2_ebs_volume_snapshots_exists (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1078
1078
|
"evidenceType": "Configuration",
|
|
1079
1079
|
"severity": "high"
|
|
1080
1080
|
},
|
|
1081
1081
|
{
|
|
1082
1082
|
"id": "prowler.aws.ec2_elastic_ip_unassigned",
|
|
1083
1083
|
"title": "Elastic IP is associated with an instance or network interface",
|
|
1084
|
-
"scope": "Prowler 5.
|
|
1084
|
+
"scope": "Prowler 5.47.0 check ec2_elastic_ip_unassigned (AWS ec2, resource type AwsEc2Eip): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1085
1085
|
"evidenceType": "Configuration",
|
|
1086
1086
|
"severity": "low"
|
|
1087
1087
|
},
|
|
1088
1088
|
{
|
|
1089
1089
|
"id": "prowler.aws.ec2_instance_imdsv2_enabled",
|
|
1090
1090
|
"title": "EC2 instance requires IMDSv2 or has the instance metadata service disabled",
|
|
1091
|
-
"scope": "Prowler 5.
|
|
1091
|
+
"scope": "Prowler 5.47.0 check ec2_instance_imdsv2_enabled (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1092
1092
|
"evidenceType": "Configuration",
|
|
1093
1093
|
"severity": "high"
|
|
1094
1094
|
},
|
|
1095
1095
|
{
|
|
1096
1096
|
"id": "prowler.aws.ec2_instance_internet_facing_with_instance_profile",
|
|
1097
1097
|
"title": "EC2 instance is not internet-facing with an instance profile attached",
|
|
1098
|
-
"scope": "Prowler 5.
|
|
1098
|
+
"scope": "Prowler 5.47.0 check ec2_instance_internet_facing_with_instance_profile (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1099
1099
|
"evidenceType": "Configuration",
|
|
1100
1100
|
"severity": "high"
|
|
1101
1101
|
},
|
|
1102
1102
|
{
|
|
1103
1103
|
"id": "prowler.aws.ec2_instance_managed_by_ssm",
|
|
1104
1104
|
"title": "EC2 instance is managed by AWS Systems Manager or not running",
|
|
1105
|
-
"scope": "Prowler 5.
|
|
1105
|
+
"scope": "Prowler 5.47.0 check ec2_instance_managed_by_ssm (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1106
1106
|
"evidenceType": "Configuration",
|
|
1107
1107
|
"severity": "medium"
|
|
1108
1108
|
},
|
|
1109
1109
|
{
|
|
1110
1110
|
"id": "prowler.aws.ec2_instance_older_than_specific_days",
|
|
1111
1111
|
"title": "EC2 instance is not older than the configured maximum age or is not running",
|
|
1112
|
-
"scope": "Prowler 5.
|
|
1112
|
+
"scope": "Prowler 5.47.0 check ec2_instance_older_than_specific_days (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1113
1113
|
"evidenceType": "Configuration",
|
|
1114
1114
|
"severity": "medium"
|
|
1115
1115
|
},
|
|
1116
1116
|
{
|
|
1117
1117
|
"id": "prowler.aws.ec2_instance_profile_attached",
|
|
1118
1118
|
"title": "EC2 instance is associated with an IAM instance profile role",
|
|
1119
|
-
"scope": "Prowler 5.
|
|
1119
|
+
"scope": "Prowler 5.47.0 check ec2_instance_profile_attached (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1120
1120
|
"evidenceType": "Configuration",
|
|
1121
1121
|
"severity": "medium"
|
|
1122
1122
|
},
|
|
1123
1123
|
{
|
|
1124
1124
|
"id": "prowler.aws.ec2_instance_public_ip",
|
|
1125
1125
|
"title": "EC2 instance does not have a public IP address",
|
|
1126
|
-
"scope": "Prowler 5.
|
|
1126
|
+
"scope": "Prowler 5.47.0 check ec2_instance_public_ip (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1127
1127
|
"evidenceType": "Configuration",
|
|
1128
1128
|
"severity": "medium"
|
|
1129
1129
|
},
|
|
1130
1130
|
{
|
|
1131
1131
|
"id": "prowler.aws.ec2_instance_secrets_user_data",
|
|
1132
1132
|
"title": "EC2 instance user data contains no secrets",
|
|
1133
|
-
"scope": "Prowler 5.
|
|
1133
|
+
"scope": "Prowler 5.47.0 check ec2_instance_secrets_user_data (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1134
1134
|
"evidenceType": "Configuration",
|
|
1135
1135
|
"severity": "high"
|
|
1136
1136
|
},
|
|
1137
1137
|
{
|
|
1138
1138
|
"id": "prowler.aws.ec2_instance_uses_single_eni",
|
|
1139
1139
|
"title": "EC2 instance has no more than one Elastic Network Interface (ENI) attached",
|
|
1140
|
-
"scope": "Prowler 5.
|
|
1140
|
+
"scope": "Prowler 5.47.0 check ec2_instance_uses_single_eni (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1141
1141
|
"evidenceType": "Configuration",
|
|
1142
1142
|
"severity": "low"
|
|
1143
1143
|
},
|
|
1144
1144
|
{
|
|
1145
1145
|
"id": "prowler.aws.ec2_instance_with_outdated_ami",
|
|
1146
1146
|
"title": "EC2 instance uses a non-deprecated Amazon AMI",
|
|
1147
|
-
"scope": "Prowler 5.
|
|
1147
|
+
"scope": "Prowler 5.47.0 check ec2_instance_with_outdated_ami (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1148
1148
|
"evidenceType": "Configuration",
|
|
1149
1149
|
"severity": "medium"
|
|
1150
1150
|
},
|
|
1151
1151
|
{
|
|
1152
1152
|
"id": "prowler.aws.ec2_launch_template_no_public_ip",
|
|
1153
1153
|
"title": "Amazon EC2 launch template has no public IP addresses configured on network interfaces",
|
|
1154
|
-
"scope": "Prowler 5.
|
|
1154
|
+
"scope": "Prowler 5.47.0 check ec2_launch_template_no_public_ip (AWS ec2, resource type AwsEc2LaunchTemplate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1155
1155
|
"evidenceType": "Configuration",
|
|
1156
1156
|
"severity": "high"
|
|
1157
1157
|
},
|
|
1158
1158
|
{
|
|
1159
1159
|
"id": "prowler.aws.ec2_launch_template_no_secrets",
|
|
1160
1160
|
"title": "EC2 launch template user data contains no secrets in any version",
|
|
1161
|
-
"scope": "Prowler 5.
|
|
1161
|
+
"scope": "Prowler 5.47.0 check ec2_launch_template_no_secrets (AWS ec2, resource type AwsEc2LaunchTemplate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1162
1162
|
"evidenceType": "Configuration",
|
|
1163
1163
|
"severity": "high"
|
|
1164
1164
|
},
|
|
1165
1165
|
{
|
|
1166
1166
|
"id": "prowler.aws.ec2_networkacl_allow_ingress_any_port",
|
|
1167
1167
|
"title": "Network ACL does not allow ingress from 0.0.0.0/0 to any port",
|
|
1168
|
-
"scope": "Prowler 5.
|
|
1168
|
+
"scope": "Prowler 5.47.0 check ec2_networkacl_allow_ingress_any_port (AWS ec2, resource type AwsEc2NetworkAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1169
1169
|
"evidenceType": "Configuration",
|
|
1170
1170
|
"severity": "high"
|
|
1171
1171
|
},
|
|
1172
1172
|
{
|
|
1173
1173
|
"id": "prowler.aws.ec2_networkacl_allow_ingress_tcp_port_22",
|
|
1174
1174
|
"title": "Network ACL does not allow ingress from the Internet to TCP port 22 (SSH)",
|
|
1175
|
-
"scope": "Prowler 5.
|
|
1175
|
+
"scope": "Prowler 5.47.0 check ec2_networkacl_allow_ingress_tcp_port_22 (AWS ec2, resource type AwsEc2NetworkAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1176
1176
|
"evidenceType": "Configuration",
|
|
1177
1177
|
"severity": "medium"
|
|
1178
1178
|
},
|
|
1179
1179
|
{
|
|
1180
1180
|
"id": "prowler.aws.ec2_networkacl_allow_ingress_tcp_port_3389",
|
|
1181
1181
|
"title": "Network ACL does not allow ingress from the Internet to TCP port 3389 (RDP)",
|
|
1182
|
-
"scope": "Prowler 5.
|
|
1182
|
+
"scope": "Prowler 5.47.0 check ec2_networkacl_allow_ingress_tcp_port_3389 (AWS ec2, resource type AwsEc2NetworkAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1183
1183
|
"evidenceType": "Configuration",
|
|
1184
1184
|
"severity": "medium"
|
|
1185
1185
|
},
|
|
1186
1186
|
{
|
|
1187
1187
|
"id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
|
|
1188
1188
|
"title": "Security group does not have all ports open to the Internet",
|
|
1189
|
-
"scope": "Prowler 5.
|
|
1189
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_all_ports (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1190
1190
|
"evidenceType": "Configuration",
|
|
1191
1191
|
"severity": "critical"
|
|
1192
1192
|
},
|
|
1193
1193
|
{
|
|
1194
1194
|
"id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_any_port",
|
|
1195
1195
|
"title": "Security group has no 0.0.0.0/0 or ::/0 ingress to any port, or is attached only to allowed interface types or instance owners",
|
|
1196
|
-
"scope": "Prowler 5.
|
|
1196
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_any_port (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1197
1197
|
"evidenceType": "Configuration",
|
|
1198
1198
|
"severity": "high"
|
|
1199
1199
|
},
|
|
1200
1200
|
{
|
|
1201
1201
|
"id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip",
|
|
1202
1202
|
"title": "Security group does not have any port open to a specific public IP address",
|
|
1203
|
-
"scope": "Prowler 5.
|
|
1203
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1204
1204
|
"evidenceType": "Configuration",
|
|
1205
1205
|
"severity": "medium"
|
|
1206
1206
|
},
|
|
1207
1207
|
{
|
|
1208
1208
|
"id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports",
|
|
1209
1209
|
"title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to high-risk TCP ports",
|
|
1210
|
-
"scope": "Prowler 5.
|
|
1210
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1211
1211
|
"evidenceType": "Configuration",
|
|
1212
1212
|
"severity": "high"
|
|
1213
1213
|
},
|
|
1214
1214
|
{
|
|
1215
1215
|
"id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
|
|
1216
1216
|
"title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 22 (SSH)",
|
|
1217
|
-
"scope": "Prowler 5.
|
|
1217
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1218
1218
|
"evidenceType": "Configuration",
|
|
1219
1219
|
"severity": "high"
|
|
1220
1220
|
},
|
|
1221
1221
|
{
|
|
1222
1222
|
"id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
|
|
1223
1223
|
"title": "Security group does not allow ingress from the Internet to TCP port 3389 (RDP)",
|
|
1224
|
-
"scope": "Prowler 5.
|
|
1224
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1225
1225
|
"evidenceType": "Configuration",
|
|
1226
1226
|
"severity": "high"
|
|
1227
1227
|
},
|
|
1228
1228
|
{
|
|
1229
1229
|
"id": "prowler.aws.ec2_securitygroup_allow_wide_open_public_ipv4",
|
|
1230
1230
|
"title": "Security group has no ingress or egress rules with public IPv4 CIDR ranges from /1 to /23",
|
|
1231
|
-
"scope": "Prowler 5.
|
|
1231
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_allow_wide_open_public_ipv4 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1232
1232
|
"evidenceType": "Configuration",
|
|
1233
1233
|
"severity": "high"
|
|
1234
1234
|
},
|
|
1235
1235
|
{
|
|
1236
1236
|
"id": "prowler.aws.ec2_securitygroup_default_restrict_traffic",
|
|
1237
1237
|
"title": "VPC default security group has no inbound or outbound rules",
|
|
1238
|
-
"scope": "Prowler 5.
|
|
1238
|
+
"scope": "Prowler 5.47.0 check ec2_securitygroup_default_restrict_traffic (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1239
1239
|
"evidenceType": "Configuration",
|
|
1240
1240
|
"severity": "high"
|
|
1241
1241
|
},
|
|
1242
1242
|
{
|
|
1243
1243
|
"id": "prowler.aws.ecr_registry_enhanced_scanning_enabled",
|
|
1244
1244
|
"title": "ECR registry has enhanced scanning enabled",
|
|
1245
|
-
"scope": "Prowler 5.
|
|
1245
|
+
"scope": "Prowler 5.47.0 check ecr_registry_enhanced_scanning_enabled (AWS ecr, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1246
1246
|
"evidenceType": "Configuration",
|
|
1247
1247
|
"severity": "medium"
|
|
1248
1248
|
},
|
|
1249
1249
|
{
|
|
1250
1250
|
"id": "prowler.aws.ecr_registry_scan_images_on_push_enabled",
|
|
1251
1251
|
"title": "ECR registry has automated image scanning enabled for all repositories",
|
|
1252
|
-
"scope": "Prowler 5.
|
|
1252
|
+
"scope": "Prowler 5.47.0 check ecr_registry_scan_images_on_push_enabled (AWS ecr, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1253
1253
|
"evidenceType": "Configuration",
|
|
1254
1254
|
"severity": "medium"
|
|
1255
1255
|
},
|
|
1256
1256
|
{
|
|
1257
1257
|
"id": "prowler.aws.ecr_repositories_not_publicly_accessible",
|
|
1258
1258
|
"title": "ECR repository is not publicly accessible",
|
|
1259
|
-
"scope": "Prowler 5.
|
|
1259
|
+
"scope": "Prowler 5.47.0 check ecr_repositories_not_publicly_accessible (AWS ecr, resource type AwsEcrRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1260
1260
|
"evidenceType": "Configuration",
|
|
1261
1261
|
"severity": "critical"
|
|
1262
1262
|
},
|
|
1263
1263
|
{
|
|
1264
1264
|
"id": "prowler.aws.ecr_repositories_scan_vulnerabilities_in_latest_image",
|
|
1265
1265
|
"title": "ECR repository latest image is scanned with no vulnerabilities at or above the configured minimum severity",
|
|
1266
|
-
"scope": "Prowler 5.
|
|
1266
|
+
"scope": "Prowler 5.47.0 check ecr_repositories_scan_vulnerabilities_in_latest_image (AWS ecr, resource type AwsEcrRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1267
1267
|
"evidenceType": "Configuration",
|
|
1268
1268
|
"severity": "medium"
|
|
1269
1269
|
},
|
|
1270
1270
|
{
|
|
1271
1271
|
"id": "prowler.aws.ecr_repositories_tag_immutability",
|
|
1272
1272
|
"title": "ECR repository has image tag immutability enabled",
|
|
1273
|
-
"scope": "Prowler 5.
|
|
1273
|
+
"scope": "Prowler 5.47.0 check ecr_repositories_tag_immutability (AWS ecr, resource type AwsEcrRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1274
1274
|
"evidenceType": "Configuration",
|
|
1275
1275
|
"severity": "medium"
|
|
1276
1276
|
},
|
|
1277
1277
|
{
|
|
1278
1278
|
"id": "prowler.aws.ecr_repository_image_no_secrets",
|
|
1279
1279
|
"title": "ECR repository image contains no hardcoded secrets",
|
|
1280
|
-
"scope": "Prowler 5.
|
|
1280
|
+
"scope": "Prowler 5.47.0 check ecr_repository_image_no_secrets (AWS ecr, resource type AwsEcrRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1281
1281
|
"evidenceType": "Configuration",
|
|
1282
1282
|
"severity": "high"
|
|
1283
1283
|
},
|
|
1284
1284
|
{
|
|
1285
1285
|
"id": "prowler.aws.ecs_cluster_container_insights_enabled",
|
|
1286
1286
|
"title": "ECS cluster has Container Insights enabled or enhanced",
|
|
1287
|
-
"scope": "Prowler 5.
|
|
1287
|
+
"scope": "Prowler 5.47.0 check ecs_cluster_container_insights_enabled (AWS ecs, resource type AwsEcsCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1288
1288
|
"evidenceType": "Configuration",
|
|
1289
1289
|
"severity": "medium"
|
|
1290
1290
|
},
|
|
1291
1291
|
{
|
|
1292
1292
|
"id": "prowler.aws.ecs_service_fargate_latest_platform_version",
|
|
1293
1293
|
"title": "ECS Fargate service uses the latest Fargate platform version",
|
|
1294
|
-
"scope": "Prowler 5.
|
|
1294
|
+
"scope": "Prowler 5.47.0 check ecs_service_fargate_latest_platform_version (AWS ecs, resource type AwsEcsService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1295
1295
|
"evidenceType": "Configuration",
|
|
1296
1296
|
"severity": "medium"
|
|
1297
1297
|
},
|
|
1298
1298
|
{
|
|
1299
1299
|
"id": "prowler.aws.ecs_service_no_assign_public_ip",
|
|
1300
1300
|
"title": "ECS service does not have automatic public IP assignment",
|
|
1301
|
-
"scope": "Prowler 5.
|
|
1301
|
+
"scope": "Prowler 5.47.0 check ecs_service_no_assign_public_ip (AWS ecs, resource type AwsEcsService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1302
1302
|
"evidenceType": "Configuration",
|
|
1303
1303
|
"severity": "high"
|
|
1304
1304
|
},
|
|
1305
1305
|
{
|
|
1306
1306
|
"id": "prowler.aws.ecs_task_definitions_containers_readonly_access",
|
|
1307
1307
|
"title": "ECS task definition has all containers with read-only root filesystems",
|
|
1308
|
-
"scope": "Prowler 5.
|
|
1308
|
+
"scope": "Prowler 5.47.0 check ecs_task_definitions_containers_readonly_access (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1309
1309
|
"evidenceType": "Configuration",
|
|
1310
1310
|
"severity": "high"
|
|
1311
1311
|
},
|
|
1312
1312
|
{
|
|
1313
1313
|
"id": "prowler.aws.ecs_task_definitions_host_namespace_not_shared",
|
|
1314
1314
|
"title": "ECS task definition does not share the host's process namespace with its containers",
|
|
1315
|
-
"scope": "Prowler 5.
|
|
1315
|
+
"scope": "Prowler 5.47.0 check ecs_task_definitions_host_namespace_not_shared (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1316
1316
|
"evidenceType": "Configuration",
|
|
1317
1317
|
"severity": "high"
|
|
1318
1318
|
},
|
|
1319
1319
|
{
|
|
1320
1320
|
"id": "prowler.aws.ecs_task_definitions_host_networking_mode_users",
|
|
1321
1321
|
"title": "Amazon ECS task definition does not use host network mode, or non-privileged containers specify a non-root user",
|
|
1322
|
-
"scope": "Prowler 5.
|
|
1322
|
+
"scope": "Prowler 5.47.0 check ecs_task_definitions_host_networking_mode_users (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1323
1323
|
"evidenceType": "Configuration",
|
|
1324
1324
|
"severity": "high"
|
|
1325
1325
|
},
|
|
1326
1326
|
{
|
|
1327
1327
|
"id": "prowler.aws.ecs_task_definitions_logging_enabled",
|
|
1328
1328
|
"title": "ECS task definition has logging configured for all containers",
|
|
1329
|
-
"scope": "Prowler 5.
|
|
1329
|
+
"scope": "Prowler 5.47.0 check ecs_task_definitions_logging_enabled (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1330
1330
|
"evidenceType": "Configuration",
|
|
1331
1331
|
"severity": "high"
|
|
1332
1332
|
},
|
|
1333
1333
|
{
|
|
1334
1334
|
"id": "prowler.aws.ecs_task_definitions_no_environment_secrets",
|
|
1335
1335
|
"title": "ECS task definition has no secrets in environment variables",
|
|
1336
|
-
"scope": "Prowler 5.
|
|
1336
|
+
"scope": "Prowler 5.47.0 check ecs_task_definitions_no_environment_secrets (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1337
1337
|
"evidenceType": "Configuration",
|
|
1338
1338
|
"severity": "critical"
|
|
1339
1339
|
},
|
|
1340
1340
|
{
|
|
1341
1341
|
"id": "prowler.aws.ecs_task_definitions_no_privileged_containers",
|
|
1342
1342
|
"title": "ECS task definition has no privileged containers",
|
|
1343
|
-
"scope": "Prowler 5.
|
|
1343
|
+
"scope": "Prowler 5.47.0 check ecs_task_definitions_no_privileged_containers (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1344
1344
|
"evidenceType": "Configuration",
|
|
1345
1345
|
"severity": "high"
|
|
1346
1346
|
},
|
|
1347
1347
|
{
|
|
1348
1348
|
"id": "prowler.aws.ecs_task_set_no_assign_public_ip",
|
|
1349
1349
|
"title": "ECS task set does not automatically assign a public IP address",
|
|
1350
|
-
"scope": "Prowler 5.
|
|
1350
|
+
"scope": "Prowler 5.47.0 check ecs_task_set_no_assign_public_ip (AWS ecs, resource type AwsEcsService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1351
1351
|
"evidenceType": "Configuration",
|
|
1352
1352
|
"severity": "high"
|
|
1353
1353
|
},
|
|
1354
1354
|
{
|
|
1355
1355
|
"id": "prowler.aws.efs_access_point_enforce_root_directory",
|
|
1356
1356
|
"title": "EFS file system has no access points allowing access to the root directory",
|
|
1357
|
-
"scope": "Prowler 5.
|
|
1357
|
+
"scope": "Prowler 5.47.0 check efs_access_point_enforce_root_directory (AWS efs, resource type AwsEfsAccessPoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1358
1358
|
"evidenceType": "Configuration",
|
|
1359
1359
|
"severity": "medium"
|
|
1360
1360
|
},
|
|
1361
1361
|
{
|
|
1362
1362
|
"id": "prowler.aws.efs_access_point_enforce_user_identity",
|
|
1363
1363
|
"title": "EFS file system has all access points with a defined POSIX user",
|
|
1364
|
-
"scope": "Prowler 5.
|
|
1364
|
+
"scope": "Prowler 5.47.0 check efs_access_point_enforce_user_identity (AWS efs, resource type AwsEfsAccessPoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1365
1365
|
"evidenceType": "Configuration",
|
|
1366
1366
|
"severity": "medium"
|
|
1367
1367
|
},
|
|
1368
1368
|
{
|
|
1369
1369
|
"id": "prowler.aws.efs_encryption_at_rest_enabled",
|
|
1370
1370
|
"title": "EFS file system has encryption at rest enabled",
|
|
1371
|
-
"scope": "Prowler 5.
|
|
1371
|
+
"scope": "Prowler 5.47.0 check efs_encryption_at_rest_enabled (AWS efs, resource type AwsEfsFileSystem): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1372
1372
|
"evidenceType": "Configuration",
|
|
1373
1373
|
"severity": "medium"
|
|
1374
1374
|
},
|
|
1375
1375
|
{
|
|
1376
1376
|
"id": "prowler.aws.efs_have_backup_enabled",
|
|
1377
1377
|
"title": "EFS file system has backup enabled",
|
|
1378
|
-
"scope": "Prowler 5.
|
|
1378
|
+
"scope": "Prowler 5.47.0 check efs_have_backup_enabled (AWS efs, resource type AwsEfsFileSystem): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1379
1379
|
"evidenceType": "Configuration",
|
|
1380
1380
|
"severity": "medium"
|
|
1381
1381
|
},
|
|
1382
1382
|
{
|
|
1383
1383
|
"id": "prowler.aws.efs_mount_target_not_publicly_accessible",
|
|
1384
1384
|
"title": "EFS file system has no publicly accessible mount targets",
|
|
1385
|
-
"scope": "Prowler 5.
|
|
1385
|
+
"scope": "Prowler 5.47.0 check efs_mount_target_not_publicly_accessible (AWS efs, resource type AwsEfsFileSystem): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1386
1386
|
"evidenceType": "Configuration",
|
|
1387
1387
|
"severity": "medium"
|
|
1388
1388
|
},
|
|
1389
1389
|
{
|
|
1390
1390
|
"id": "prowler.aws.efs_multi_az_enabled",
|
|
1391
1391
|
"title": "EFS file system is Multi-AZ with more than one mount target",
|
|
1392
|
-
"scope": "Prowler 5.
|
|
1392
|
+
"scope": "Prowler 5.47.0 check efs_multi_az_enabled (AWS efs, resource type AwsEfsFileSystem): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1393
1393
|
"evidenceType": "Configuration",
|
|
1394
1394
|
"severity": "medium"
|
|
1395
1395
|
},
|
|
1396
1396
|
{
|
|
1397
1397
|
"id": "prowler.aws.efs_not_publicly_accessible",
|
|
1398
1398
|
"title": "EFS file system policy does not allow access to any client within the VPC",
|
|
1399
|
-
"scope": "Prowler 5.
|
|
1399
|
+
"scope": "Prowler 5.47.0 check efs_not_publicly_accessible (AWS efs, resource type AwsEfsFileSystem): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1400
1400
|
"evidenceType": "Configuration",
|
|
1401
1401
|
"severity": "medium"
|
|
1402
1402
|
},
|
|
1403
1403
|
{
|
|
1404
1404
|
"id": "prowler.aws.eks_cluster_kms_cmk_encryption_in_secrets_enabled",
|
|
1405
1405
|
"title": "EKS cluster has Kubernetes secrets encryption enabled",
|
|
1406
|
-
"scope": "Prowler 5.
|
|
1406
|
+
"scope": "Prowler 5.47.0 check eks_cluster_kms_cmk_encryption_in_secrets_enabled (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1407
1407
|
"evidenceType": "Configuration",
|
|
1408
1408
|
"severity": "medium"
|
|
1409
1409
|
},
|
|
1410
1410
|
{
|
|
1411
1411
|
"id": "prowler.aws.eks_cluster_network_policy_enabled",
|
|
1412
1412
|
"title": "EKS cluster has network policy enabled",
|
|
1413
|
-
"scope": "Prowler 5.
|
|
1413
|
+
"scope": "Prowler 5.47.0 check eks_cluster_network_policy_enabled (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1414
1414
|
"evidenceType": "Configuration",
|
|
1415
1415
|
"severity": "high"
|
|
1416
1416
|
},
|
|
1417
1417
|
{
|
|
1418
1418
|
"id": "prowler.aws.eks_cluster_not_publicly_accessible",
|
|
1419
1419
|
"title": "EKS cluster endpoint is not publicly accessible from 0.0.0.0/0",
|
|
1420
|
-
"scope": "Prowler 5.
|
|
1420
|
+
"scope": "Prowler 5.47.0 check eks_cluster_not_publicly_accessible (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1421
1421
|
"evidenceType": "Configuration",
|
|
1422
1422
|
"severity": "high"
|
|
1423
1423
|
},
|
|
1424
1424
|
{
|
|
1425
1425
|
"id": "prowler.aws.eks_cluster_private_nodes_enabled",
|
|
1426
1426
|
"title": "EKS cluster has private endpoint access enabled",
|
|
1427
|
-
"scope": "Prowler 5.
|
|
1427
|
+
"scope": "Prowler 5.47.0 check eks_cluster_private_nodes_enabled (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1428
1428
|
"evidenceType": "Configuration",
|
|
1429
1429
|
"severity": "high"
|
|
1430
1430
|
},
|
|
1431
1431
|
{
|
|
1432
1432
|
"id": "prowler.aws.eks_cluster_uses_a_supported_version",
|
|
1433
1433
|
"title": "EKS cluster uses a supported Kubernetes version",
|
|
1434
|
-
"scope": "Prowler 5.
|
|
1434
|
+
"scope": "Prowler 5.47.0 check eks_cluster_uses_a_supported_version (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1435
1435
|
"evidenceType": "Configuration",
|
|
1436
1436
|
"severity": "high"
|
|
1437
1437
|
},
|
|
1438
1438
|
{
|
|
1439
1439
|
"id": "prowler.aws.eks_cluster_vpc_cni_network_policy_enforced",
|
|
1440
1440
|
"title": "EKS cluster enforces Kubernetes network policies through the Amazon VPC CNI add-on",
|
|
1441
|
-
"scope": "Prowler 5.
|
|
1441
|
+
"scope": "Prowler 5.47.0 check eks_cluster_vpc_cni_network_policy_enforced (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1442
1442
|
"evidenceType": "Configuration",
|
|
1443
1443
|
"severity": "medium"
|
|
1444
1444
|
},
|
|
1445
1445
|
{
|
|
1446
1446
|
"id": "prowler.aws.eks_control_plane_logging_all_types_enabled",
|
|
1447
1447
|
"title": "EKS cluster has control plane logging enabled for api, audit, authenticator, controllerManager, and scheduler",
|
|
1448
|
-
"scope": "Prowler 5.
|
|
1448
|
+
"scope": "Prowler 5.47.0 check eks_control_plane_logging_all_types_enabled (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1449
1449
|
"evidenceType": "Configuration",
|
|
1450
1450
|
"severity": "medium"
|
|
1451
1451
|
},
|
|
1452
1452
|
{
|
|
1453
1453
|
"id": "prowler.aws.elasticache_cluster_uses_public_subnet",
|
|
1454
1454
|
"title": "ElastiCache cluster is not using public subnets",
|
|
1455
|
-
"scope": "Prowler 5.
|
|
1455
|
+
"scope": "Prowler 5.47.0 check elasticache_cluster_uses_public_subnet (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1456
1456
|
"evidenceType": "Configuration",
|
|
1457
1457
|
"severity": "medium"
|
|
1458
1458
|
},
|
|
1459
1459
|
{
|
|
1460
1460
|
"id": "prowler.aws.elasticache_redis_cluster_automatic_failover_enabled",
|
|
1461
1461
|
"title": "ElastiCache Redis cluster has automatic failover enabled",
|
|
1462
|
-
"scope": "Prowler 5.
|
|
1462
|
+
"scope": "Prowler 5.47.0 check elasticache_redis_cluster_automatic_failover_enabled (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1463
1463
|
"evidenceType": "Configuration",
|
|
1464
1464
|
"severity": "medium"
|
|
1465
1465
|
},
|
|
1466
1466
|
{
|
|
1467
1467
|
"id": "prowler.aws.elasticache_redis_cluster_backup_enabled",
|
|
1468
1468
|
"title": "ElastiCache Redis cache cluster has automated snapshot backups enabled with retention of at least 7 days",
|
|
1469
|
-
"scope": "Prowler 5.
|
|
1469
|
+
"scope": "Prowler 5.47.0 check elasticache_redis_cluster_backup_enabled (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1470
1470
|
"evidenceType": "Configuration",
|
|
1471
1471
|
"severity": "high"
|
|
1472
1472
|
},
|
|
1473
1473
|
{
|
|
1474
1474
|
"id": "prowler.aws.elasticache_redis_cluster_in_transit_encryption_enabled",
|
|
1475
1475
|
"title": "ElastiCache Redis cache cluster has in-transit encryption enabled",
|
|
1476
|
-
"scope": "Prowler 5.
|
|
1476
|
+
"scope": "Prowler 5.47.0 check elasticache_redis_cluster_in_transit_encryption_enabled (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1477
1477
|
"evidenceType": "Configuration",
|
|
1478
1478
|
"severity": "medium"
|
|
1479
1479
|
},
|
|
1480
1480
|
{
|
|
1481
1481
|
"id": "prowler.aws.elasticache_redis_cluster_multi_az_enabled",
|
|
1482
1482
|
"title": "ElastiCache Redis replication group has Multi-AZ enabled",
|
|
1483
|
-
"scope": "Prowler 5.
|
|
1483
|
+
"scope": "Prowler 5.47.0 check elasticache_redis_cluster_multi_az_enabled (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1484
1484
|
"evidenceType": "Configuration",
|
|
1485
1485
|
"severity": "medium"
|
|
1486
1486
|
},
|
|
1487
1487
|
{
|
|
1488
1488
|
"id": "prowler.aws.elasticache_redis_cluster_rest_encryption_enabled",
|
|
1489
1489
|
"title": "ElastiCache Redis cache cluster has at rest encryption enabled",
|
|
1490
|
-
"scope": "Prowler 5.
|
|
1490
|
+
"scope": "Prowler 5.47.0 check elasticache_redis_cluster_rest_encryption_enabled (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1491
1491
|
"evidenceType": "Configuration",
|
|
1492
1492
|
"severity": "medium"
|
|
1493
1493
|
},
|
|
1494
1494
|
{
|
|
1495
1495
|
"id": "prowler.aws.elasticache_redis_replication_group_auth_enabled",
|
|
1496
1496
|
"title": "ElastiCache Redis replication group with engine version < 6.0 has Redis OSS AUTH enabled",
|
|
1497
|
-
"scope": "Prowler 5.
|
|
1497
|
+
"scope": "Prowler 5.47.0 check elasticache_redis_replication_group_auth_enabled (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1498
1498
|
"evidenceType": "Configuration",
|
|
1499
1499
|
"severity": "medium"
|
|
1500
1500
|
},
|
|
1501
1501
|
{
|
|
1502
1502
|
"id": "prowler.aws.elasticbeanstalk_environment_cloudwatch_logging_enabled",
|
|
1503
1503
|
"title": "Elastic Beanstalk environment streams logs to CloudWatch Logs",
|
|
1504
|
-
"scope": "Prowler 5.
|
|
1504
|
+
"scope": "Prowler 5.47.0 check elasticbeanstalk_environment_cloudwatch_logging_enabled (AWS elasticbeanstalk, resource type AwsElasticBeanstalkEnvironment): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1505
1505
|
"evidenceType": "Configuration",
|
|
1506
1506
|
"severity": "high"
|
|
1507
1507
|
},
|
|
1508
1508
|
{
|
|
1509
1509
|
"id": "prowler.aws.elasticbeanstalk_environment_no_secrets_in_configuration",
|
|
1510
1510
|
"title": "Elastic Beanstalk environment configuration has no hardcoded secrets",
|
|
1511
|
-
"scope": "Prowler 5.
|
|
1511
|
+
"scope": "Prowler 5.47.0 check elasticbeanstalk_environment_no_secrets_in_configuration (AWS elasticbeanstalk, resource type AwsElasticBeanstalkEnvironment): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1512
1512
|
"evidenceType": "Configuration",
|
|
1513
1513
|
"severity": "high"
|
|
1514
1514
|
},
|
|
1515
|
+
{
|
|
1516
|
+
"id": "prowler.aws.elasticbeanstalk_environment_php_platform_updated",
|
|
1517
|
+
"title": "Elastic Beanstalk PHP environment runs a platform version with the fixed PHP release",
|
|
1518
|
+
"scope": "Prowler 5.47.0 check elasticbeanstalk_environment_php_platform_updated (AWS elasticbeanstalk, resource type AwsElasticBeanstalkEnvironment): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1519
|
+
"evidenceType": "Configuration",
|
|
1520
|
+
"severity": "critical"
|
|
1521
|
+
},
|
|
1515
1522
|
{
|
|
1516
1523
|
"id": "prowler.aws.elb_cross_zone_load_balancing_enabled",
|
|
1517
1524
|
"title": "Classic Load Balancer has cross-zone load balancing enabled",
|
|
1518
|
-
"scope": "Prowler 5.
|
|
1525
|
+
"scope": "Prowler 5.47.0 check elb_cross_zone_load_balancing_enabled (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1519
1526
|
"evidenceType": "Configuration",
|
|
1520
1527
|
"severity": "medium"
|
|
1521
1528
|
},
|
|
1522
1529
|
{
|
|
1523
1530
|
"id": "prowler.aws.elb_desync_mitigation_mode",
|
|
1524
1531
|
"title": "Classic Load Balancer desync mitigation mode is defensive or strictest",
|
|
1525
|
-
"scope": "Prowler 5.
|
|
1532
|
+
"scope": "Prowler 5.47.0 check elb_desync_mitigation_mode (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1526
1533
|
"evidenceType": "Configuration",
|
|
1527
1534
|
"severity": "medium"
|
|
1528
1535
|
},
|
|
1529
1536
|
{
|
|
1530
1537
|
"id": "prowler.aws.elb_insecure_ssl_ciphers",
|
|
1531
1538
|
"title": "Elastic Load Balancer HTTPS listeners, if present, use the ELBSecurityPolicy-TLS-1-2-2017-01 policy",
|
|
1532
|
-
"scope": "Prowler 5.
|
|
1539
|
+
"scope": "Prowler 5.47.0 check elb_insecure_ssl_ciphers (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1533
1540
|
"evidenceType": "Configuration",
|
|
1534
1541
|
"severity": "medium"
|
|
1535
1542
|
},
|
|
1536
1543
|
{
|
|
1537
1544
|
"id": "prowler.aws.elb_internet_facing",
|
|
1538
1545
|
"title": "Elastic Load Balancer is not internet-facing",
|
|
1539
|
-
"scope": "Prowler 5.
|
|
1546
|
+
"scope": "Prowler 5.47.0 check elb_internet_facing (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1540
1547
|
"evidenceType": "Configuration",
|
|
1541
1548
|
"severity": "medium"
|
|
1542
1549
|
},
|
|
1543
1550
|
{
|
|
1544
1551
|
"id": "prowler.aws.elb_is_in_multiple_az",
|
|
1545
1552
|
"title": "Classic Load Balancer is in multiple Availability Zones",
|
|
1546
|
-
"scope": "Prowler 5.
|
|
1553
|
+
"scope": "Prowler 5.47.0 check elb_is_in_multiple_az (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1547
1554
|
"evidenceType": "Configuration",
|
|
1548
1555
|
"severity": "medium"
|
|
1549
1556
|
},
|
|
1550
1557
|
{
|
|
1551
1558
|
"id": "prowler.aws.elb_logging_enabled",
|
|
1552
1559
|
"title": "Elastic Load Balancer has access logs to S3 configured",
|
|
1553
|
-
"scope": "Prowler 5.
|
|
1560
|
+
"scope": "Prowler 5.47.0 check elb_logging_enabled (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1554
1561
|
"evidenceType": "Configuration",
|
|
1555
1562
|
"severity": "medium"
|
|
1556
1563
|
},
|
|
1557
1564
|
{
|
|
1558
1565
|
"id": "prowler.aws.elb_ssl_listeners",
|
|
1559
1566
|
"title": "Elastic Load Balancer has only HTTPS or SSL listeners",
|
|
1560
|
-
"scope": "Prowler 5.
|
|
1567
|
+
"scope": "Prowler 5.47.0 check elb_ssl_listeners (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1561
1568
|
"evidenceType": "Configuration",
|
|
1562
1569
|
"severity": "medium"
|
|
1563
1570
|
},
|
|
1564
1571
|
{
|
|
1565
1572
|
"id": "prowler.aws.elbv2_cross_zone_load_balancing_enabled",
|
|
1566
1573
|
"title": "ELBv2 Network or Gateway Load Balancer has cross-zone load balancing enabled",
|
|
1567
|
-
"scope": "Prowler 5.
|
|
1574
|
+
"scope": "Prowler 5.47.0 check elbv2_cross_zone_load_balancing_enabled (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1568
1575
|
"evidenceType": "Configuration",
|
|
1569
1576
|
"severity": "medium"
|
|
1570
1577
|
},
|
|
1571
1578
|
{
|
|
1572
1579
|
"id": "prowler.aws.elbv2_deletion_protection",
|
|
1573
1580
|
"title": "ELBv2 load balancer has deletion protection enabled",
|
|
1574
|
-
"scope": "Prowler 5.
|
|
1581
|
+
"scope": "Prowler 5.47.0 check elbv2_deletion_protection (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1575
1582
|
"evidenceType": "Configuration",
|
|
1576
1583
|
"severity": "medium"
|
|
1577
1584
|
},
|
|
1578
1585
|
{
|
|
1579
1586
|
"id": "prowler.aws.elbv2_desync_mitigation_mode",
|
|
1580
1587
|
"title": "Application Load Balancer has desync mitigation mode set to strictest or defensive, or drops invalid header fields",
|
|
1581
|
-
"scope": "Prowler 5.
|
|
1588
|
+
"scope": "Prowler 5.47.0 check elbv2_desync_mitigation_mode (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1582
1589
|
"evidenceType": "Configuration",
|
|
1583
1590
|
"severity": "medium"
|
|
1584
1591
|
},
|
|
1585
1592
|
{
|
|
1586
1593
|
"id": "prowler.aws.elbv2_insecure_ssl_ciphers",
|
|
1587
1594
|
"title": "ELBv2 load balancer uses a secure SSL policy on HTTPS listeners",
|
|
1588
|
-
"scope": "Prowler 5.
|
|
1595
|
+
"scope": "Prowler 5.47.0 check elbv2_insecure_ssl_ciphers (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1589
1596
|
"evidenceType": "Configuration",
|
|
1590
1597
|
"severity": "medium"
|
|
1591
1598
|
},
|
|
1592
1599
|
{
|
|
1593
1600
|
"id": "prowler.aws.elbv2_internet_facing",
|
|
1594
1601
|
"title": "Application Load Balancer is not publicly accessible (no inbound TCP from 0.0.0.0/0 or ::/0)",
|
|
1595
|
-
"scope": "Prowler 5.
|
|
1602
|
+
"scope": "Prowler 5.47.0 check elbv2_internet_facing (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1596
1603
|
"evidenceType": "Configuration",
|
|
1597
1604
|
"severity": "medium"
|
|
1598
1605
|
},
|
|
1599
1606
|
{
|
|
1600
1607
|
"id": "prowler.aws.elbv2_is_in_multiple_az",
|
|
1601
1608
|
"title": "ELBv2 load balancer is configured across multiple Availability Zones",
|
|
1602
|
-
"scope": "Prowler 5.
|
|
1609
|
+
"scope": "Prowler 5.47.0 check elbv2_is_in_multiple_az (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1603
1610
|
"evidenceType": "Configuration",
|
|
1604
1611
|
"severity": "medium"
|
|
1605
1612
|
},
|
|
1606
1613
|
{
|
|
1607
1614
|
"id": "prowler.aws.elbv2_listener_pqc_tls_enabled",
|
|
1608
1615
|
"title": "ELBv2 HTTPS/TLS listeners use a post-quantum TLS security policy",
|
|
1609
|
-
"scope": "Prowler 5.
|
|
1616
|
+
"scope": "Prowler 5.47.0 check elbv2_listener_pqc_tls_enabled (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1610
1617
|
"evidenceType": "Configuration",
|
|
1611
1618
|
"severity": "low"
|
|
1612
1619
|
},
|
|
1613
1620
|
{
|
|
1614
1621
|
"id": "prowler.aws.elbv2_logging_enabled",
|
|
1615
1622
|
"title": "ELBv2 Application Load Balancer has access logs to S3 configured",
|
|
1616
|
-
"scope": "Prowler 5.
|
|
1623
|
+
"scope": "Prowler 5.47.0 check elbv2_logging_enabled (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1617
1624
|
"evidenceType": "Configuration",
|
|
1618
1625
|
"severity": "medium"
|
|
1619
1626
|
},
|
|
1620
1627
|
{
|
|
1621
1628
|
"id": "prowler.aws.elbv2_nlb_tls_termination_enabled",
|
|
1622
1629
|
"title": "ELBv2 Network Load Balancer has TLS termination enabled",
|
|
1623
|
-
"scope": "Prowler 5.
|
|
1630
|
+
"scope": "Prowler 5.47.0 check elbv2_nlb_tls_termination_enabled (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1624
1631
|
"evidenceType": "Configuration",
|
|
1625
1632
|
"severity": "medium"
|
|
1626
1633
|
},
|
|
1627
1634
|
{
|
|
1628
1635
|
"id": "prowler.aws.elbv2_ssl_listeners",
|
|
1629
1636
|
"title": "ELBv2 Application Load Balancer listeners use HTTPS or redirect HTTP to HTTPS",
|
|
1630
|
-
"scope": "Prowler 5.
|
|
1637
|
+
"scope": "Prowler 5.47.0 check elbv2_ssl_listeners (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1631
1638
|
"evidenceType": "Configuration",
|
|
1632
1639
|
"severity": "medium"
|
|
1633
1640
|
},
|
|
1634
1641
|
{
|
|
1635
1642
|
"id": "prowler.aws.elbv2_waf_acl_attached",
|
|
1636
1643
|
"title": "Application Load Balancer has a WAF Web ACL attached",
|
|
1637
|
-
"scope": "Prowler 5.
|
|
1644
|
+
"scope": "Prowler 5.47.0 check elbv2_waf_acl_attached (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1638
1645
|
"evidenceType": "Configuration",
|
|
1639
1646
|
"severity": "medium"
|
|
1640
1647
|
},
|
|
1641
1648
|
{
|
|
1642
1649
|
"id": "prowler.aws.emr_cluster_account_public_block_enabled",
|
|
1643
1650
|
"title": "EMR account has Block Public Access enabled",
|
|
1644
|
-
"scope": "Prowler 5.
|
|
1651
|
+
"scope": "Prowler 5.47.0 check emr_cluster_account_public_block_enabled (AWS emr, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1645
1652
|
"evidenceType": "Configuration",
|
|
1646
1653
|
"severity": "high"
|
|
1647
1654
|
},
|
|
1648
1655
|
{
|
|
1649
1656
|
"id": "prowler.aws.emr_cluster_master_nodes_no_public_ip",
|
|
1650
1657
|
"title": "EMR Cluster without Public IP.",
|
|
1651
|
-
"scope": "Prowler 5.
|
|
1658
|
+
"scope": "Prowler 5.47.0 check emr_cluster_master_nodes_no_public_ip (AWS emr, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1652
1659
|
"evidenceType": "Configuration",
|
|
1653
1660
|
"severity": "medium"
|
|
1654
1661
|
},
|
|
1655
1662
|
{
|
|
1656
1663
|
"id": "prowler.aws.emr_cluster_publicly_accesible",
|
|
1657
1664
|
"title": "EMR cluster is not publicly accessible",
|
|
1658
|
-
"scope": "Prowler 5.
|
|
1665
|
+
"scope": "Prowler 5.47.0 check emr_cluster_publicly_accesible (AWS emr, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1659
1666
|
"evidenceType": "Configuration",
|
|
1660
1667
|
"severity": "medium"
|
|
1661
1668
|
},
|
|
1662
1669
|
{
|
|
1663
1670
|
"id": "prowler.aws.eventbridge_bus_cross_account_access",
|
|
1664
1671
|
"title": "AWS EventBridge event bus does not allow cross-account access",
|
|
1665
|
-
"scope": "Prowler 5.
|
|
1672
|
+
"scope": "Prowler 5.47.0 check eventbridge_bus_cross_account_access (AWS eventbridge, resource type AwsEventsEventbus): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1666
1673
|
"evidenceType": "Configuration",
|
|
1667
1674
|
"severity": "high"
|
|
1668
1675
|
},
|
|
1669
1676
|
{
|
|
1670
1677
|
"id": "prowler.aws.eventbridge_bus_exposed",
|
|
1671
1678
|
"title": "AWS EventBridge event bus policy does not allow public access",
|
|
1672
|
-
"scope": "Prowler 5.
|
|
1679
|
+
"scope": "Prowler 5.47.0 check eventbridge_bus_exposed (AWS eventbridge, resource type AwsEventsEventbus): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1673
1680
|
"evidenceType": "Configuration",
|
|
1674
1681
|
"severity": "high"
|
|
1675
1682
|
},
|
|
1676
1683
|
{
|
|
1677
1684
|
"id": "prowler.aws.eventbridge_global_endpoint_event_replication_enabled",
|
|
1678
1685
|
"title": "EventBridge global endpoint has event replication enabled",
|
|
1679
|
-
"scope": "Prowler 5.
|
|
1686
|
+
"scope": "Prowler 5.47.0 check eventbridge_global_endpoint_event_replication_enabled (AWS eventbridge, resource type AwsEventsEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1680
1687
|
"evidenceType": "Configuration",
|
|
1681
1688
|
"severity": "medium"
|
|
1682
1689
|
},
|
|
1683
1690
|
{
|
|
1684
1691
|
"id": "prowler.aws.firehose_stream_encrypted_at_rest",
|
|
1685
1692
|
"title": "Kinesis Data Firehose delivery stream is encrypted at rest",
|
|
1686
|
-
"scope": "Prowler 5.
|
|
1693
|
+
"scope": "Prowler 5.47.0 check firehose_stream_encrypted_at_rest (AWS firehose, resource type AwsKinesisStream): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1687
1694
|
"evidenceType": "Configuration",
|
|
1688
1695
|
"severity": "medium"
|
|
1689
1696
|
},
|
|
1690
1697
|
{
|
|
1691
1698
|
"id": "prowler.aws.fms_policy_compliant",
|
|
1692
1699
|
"title": "All AWS FMS policies in the admin account are compliant for all accounts",
|
|
1693
|
-
"scope": "Prowler 5.
|
|
1700
|
+
"scope": "Prowler 5.47.0 check fms_policy_compliant (AWS fms, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1694
1701
|
"evidenceType": "Configuration",
|
|
1695
1702
|
"severity": "medium"
|
|
1696
1703
|
},
|
|
1697
1704
|
{
|
|
1698
1705
|
"id": "prowler.aws.fsx_windows_file_system_multi_az_enabled",
|
|
1699
1706
|
"title": "FSx Windows file system is configured for Multi-AZ deployment",
|
|
1700
|
-
"scope": "Prowler 5.
|
|
1707
|
+
"scope": "Prowler 5.47.0 check fsx_windows_file_system_multi_az_enabled (AWS fsx, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1701
1708
|
"evidenceType": "Configuration",
|
|
1702
1709
|
"severity": "low"
|
|
1703
1710
|
},
|
|
1704
1711
|
{
|
|
1705
1712
|
"id": "prowler.aws.glacier_vaults_policy_public_access",
|
|
1706
1713
|
"title": "S3 Glacier vault has no policy or its policy does not allow access to everyone",
|
|
1707
|
-
"scope": "Prowler 5.
|
|
1714
|
+
"scope": "Prowler 5.47.0 check glacier_vaults_policy_public_access (AWS glacier, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1708
1715
|
"evidenceType": "Configuration",
|
|
1709
1716
|
"severity": "critical"
|
|
1710
1717
|
},
|
|
1711
1718
|
{
|
|
1712
1719
|
"id": "prowler.aws.glue_catalog_connection_no_secrets",
|
|
1713
1720
|
"title": "Glue Data Catalog connection has no secrets in connection properties",
|
|
1714
|
-
"scope": "Prowler 5.
|
|
1721
|
+
"scope": "Prowler 5.47.0 check glue_catalog_connection_no_secrets (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1715
1722
|
"evidenceType": "Configuration",
|
|
1716
1723
|
"severity": "high"
|
|
1717
1724
|
},
|
|
1718
1725
|
{
|
|
1719
1726
|
"id": "prowler.aws.glue_data_catalogs_metadata_encryption_enabled",
|
|
1720
1727
|
"title": "Glue Data Catalog metadata is encrypted with KMS",
|
|
1721
|
-
"scope": "Prowler 5.
|
|
1728
|
+
"scope": "Prowler 5.47.0 check glue_data_catalogs_metadata_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1722
1729
|
"evidenceType": "Configuration",
|
|
1723
1730
|
"severity": "medium"
|
|
1724
1731
|
},
|
|
1725
1732
|
{
|
|
1726
1733
|
"id": "prowler.aws.glue_data_catalogs_not_publicly_accessible",
|
|
1727
1734
|
"title": "Glue Data Catalog is not publicly accessible via its resource policy",
|
|
1728
|
-
"scope": "Prowler 5.
|
|
1735
|
+
"scope": "Prowler 5.47.0 check glue_data_catalogs_not_publicly_accessible (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1729
1736
|
"evidenceType": "Configuration",
|
|
1730
1737
|
"severity": "high"
|
|
1731
1738
|
},
|
|
1732
1739
|
{
|
|
1733
1740
|
"id": "prowler.aws.glue_database_connections_ssl_enabled",
|
|
1734
1741
|
"title": "Glue connection has SSL enabled",
|
|
1735
|
-
"scope": "Prowler 5.
|
|
1742
|
+
"scope": "Prowler 5.47.0 check glue_database_connections_ssl_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1736
1743
|
"evidenceType": "Configuration",
|
|
1737
1744
|
"severity": "high"
|
|
1738
1745
|
},
|
|
1739
1746
|
{
|
|
1740
1747
|
"id": "prowler.aws.glue_development_endpoints_job_bookmark_encryption_enabled",
|
|
1741
1748
|
"title": "Glue development endpoint has Job Bookmark encryption enabled",
|
|
1742
|
-
"scope": "Prowler 5.
|
|
1749
|
+
"scope": "Prowler 5.47.0 check glue_development_endpoints_job_bookmark_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1743
1750
|
"evidenceType": "Configuration",
|
|
1744
1751
|
"severity": "medium"
|
|
1745
1752
|
},
|
|
1746
1753
|
{
|
|
1747
1754
|
"id": "prowler.aws.glue_development_endpoints_s3_encryption_enabled",
|
|
1748
1755
|
"title": "Glue development endpoint has S3 encryption enabled",
|
|
1749
|
-
"scope": "Prowler 5.
|
|
1756
|
+
"scope": "Prowler 5.47.0 check glue_development_endpoints_s3_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1750
1757
|
"evidenceType": "Configuration",
|
|
1751
1758
|
"severity": "medium"
|
|
1752
1759
|
},
|
|
1753
1760
|
{
|
|
1754
1761
|
"id": "prowler.aws.glue_etl_jobs_amazon_s3_encryption_enabled",
|
|
1755
1762
|
"title": "Glue job has S3 encryption enabled",
|
|
1756
|
-
"scope": "Prowler 5.
|
|
1763
|
+
"scope": "Prowler 5.47.0 check glue_etl_jobs_amazon_s3_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1757
1764
|
"evidenceType": "Configuration",
|
|
1758
1765
|
"severity": "high"
|
|
1759
1766
|
},
|
|
1760
1767
|
{
|
|
1761
1768
|
"id": "prowler.aws.glue_etl_jobs_job_bookmark_encryption_enabled",
|
|
1762
1769
|
"title": "Glue ETL job has Job bookmark encryption enabled",
|
|
1763
|
-
"scope": "Prowler 5.
|
|
1770
|
+
"scope": "Prowler 5.47.0 check glue_etl_jobs_job_bookmark_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1764
1771
|
"evidenceType": "Configuration",
|
|
1765
1772
|
"severity": "medium"
|
|
1766
1773
|
},
|
|
1767
1774
|
{
|
|
1768
1775
|
"id": "prowler.aws.glue_etl_jobs_logging_enabled",
|
|
1769
1776
|
"title": "Glue ETL job has continuous CloudWatch logging enabled",
|
|
1770
|
-
"scope": "Prowler 5.
|
|
1777
|
+
"scope": "Prowler 5.47.0 check glue_etl_jobs_logging_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1771
1778
|
"evidenceType": "Configuration",
|
|
1772
1779
|
"severity": "medium"
|
|
1773
1780
|
},
|
|
1774
1781
|
{
|
|
1775
1782
|
"id": "prowler.aws.glue_etl_jobs_no_secrets_in_arguments",
|
|
1776
1783
|
"title": "Glue ETL job has no secrets in default arguments",
|
|
1777
|
-
"scope": "Prowler 5.
|
|
1784
|
+
"scope": "Prowler 5.47.0 check glue_etl_jobs_no_secrets_in_arguments (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1778
1785
|
"evidenceType": "Configuration",
|
|
1779
1786
|
"severity": "critical"
|
|
1780
1787
|
},
|
|
1781
1788
|
{
|
|
1782
1789
|
"id": "prowler.aws.glue_ml_transform_encrypted_at_rest",
|
|
1783
1790
|
"title": "Glue ML Transform is encrypted at rest",
|
|
1784
|
-
"scope": "Prowler 5.
|
|
1791
|
+
"scope": "Prowler 5.47.0 check glue_ml_transform_encrypted_at_rest (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1785
1792
|
"evidenceType": "Configuration",
|
|
1786
1793
|
"severity": "medium"
|
|
1787
1794
|
},
|
|
1788
1795
|
{
|
|
1789
1796
|
"id": "prowler.aws.guardduty_is_enabled",
|
|
1790
1797
|
"title": "GuardDuty detector is enabled and not suspended",
|
|
1791
|
-
"scope": "Prowler 5.
|
|
1798
|
+
"scope": "Prowler 5.47.0 check guardduty_is_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1792
1799
|
"evidenceType": "Configuration",
|
|
1793
1800
|
"severity": "high"
|
|
1794
1801
|
},
|
|
1795
1802
|
{
|
|
1796
1803
|
"id": "prowler.aws.guardduty_no_high_severity_findings",
|
|
1797
1804
|
"title": "GuardDuty detector has no high severity findings",
|
|
1798
|
-
"scope": "Prowler 5.
|
|
1805
|
+
"scope": "Prowler 5.47.0 check guardduty_no_high_severity_findings (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1799
1806
|
"evidenceType": "Configuration",
|
|
1800
1807
|
"severity": "high"
|
|
1801
1808
|
},
|
|
1802
1809
|
{
|
|
1803
1810
|
"id": "prowler.aws.iam_aws_attached_policy_no_administrative_privileges",
|
|
1804
1811
|
"title": "Attached AWS-managed IAM policy does not allow '*:*' administrative privileges",
|
|
1805
|
-
"scope": "Prowler 5.
|
|
1812
|
+
"scope": "Prowler 5.47.0 check iam_aws_attached_policy_no_administrative_privileges (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1806
1813
|
"evidenceType": "Configuration",
|
|
1807
1814
|
"severity": "critical"
|
|
1808
1815
|
},
|
|
1809
1816
|
{
|
|
1810
1817
|
"id": "prowler.aws.iam_customer_attached_policy_no_administrative_privileges",
|
|
1811
1818
|
"title": "Attached IAM customer-managed policy does not allow '*:*' administrative privileges",
|
|
1812
|
-
"scope": "Prowler 5.
|
|
1819
|
+
"scope": "Prowler 5.47.0 check iam_customer_attached_policy_no_administrative_privileges (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1813
1820
|
"evidenceType": "Configuration",
|
|
1814
1821
|
"severity": "high"
|
|
1815
1822
|
},
|
|
1816
1823
|
{
|
|
1817
1824
|
"id": "prowler.aws.iam_customer_unattached_policy_no_administrative_privileges",
|
|
1818
1825
|
"title": "Unattached customer managed IAM policy does not allow '*:*' administrative privileges",
|
|
1819
|
-
"scope": "Prowler 5.
|
|
1826
|
+
"scope": "Prowler 5.47.0 check iam_customer_unattached_policy_no_administrative_privileges (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1820
1827
|
"evidenceType": "Configuration",
|
|
1821
1828
|
"severity": "medium"
|
|
1822
1829
|
},
|
|
1823
1830
|
{
|
|
1824
1831
|
"id": "prowler.aws.iam_group_administrator_access_policy",
|
|
1825
1832
|
"title": "IAM group does not have AdministratorAccess policy attached",
|
|
1826
|
-
"scope": "Prowler 5.
|
|
1833
|
+
"scope": "Prowler 5.47.0 check iam_group_administrator_access_policy (AWS iam, resource type AwsIamGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1827
1834
|
"evidenceType": "Configuration",
|
|
1828
1835
|
"severity": "high"
|
|
1829
1836
|
},
|
|
1830
1837
|
{
|
|
1831
1838
|
"id": "prowler.aws.iam_inline_policy_allows_privilege_escalation",
|
|
1832
1839
|
"title": "IAM inline policy does not allow privilege escalation",
|
|
1833
|
-
"scope": "Prowler 5.
|
|
1840
|
+
"scope": "Prowler 5.47.0 check iam_inline_policy_allows_privilege_escalation (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1834
1841
|
"evidenceType": "Configuration",
|
|
1835
1842
|
"severity": "high"
|
|
1836
1843
|
},
|
|
1837
1844
|
{
|
|
1838
1845
|
"id": "prowler.aws.iam_inline_policy_no_administrative_privileges",
|
|
1839
1846
|
"title": "Inline IAM policy does not allow '*:*' administrative privileges",
|
|
1840
|
-
"scope": "Prowler 5.
|
|
1847
|
+
"scope": "Prowler 5.47.0 check iam_inline_policy_no_administrative_privileges (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1841
1848
|
"evidenceType": "Configuration",
|
|
1842
1849
|
"severity": "critical"
|
|
1843
1850
|
},
|
|
1844
1851
|
{
|
|
1845
1852
|
"id": "prowler.aws.iam_inline_policy_no_full_access_to_cloudtrail",
|
|
1846
1853
|
"title": "Inline IAM policy does not allow 'cloudtrail:*' privileges",
|
|
1847
|
-
"scope": "Prowler 5.
|
|
1854
|
+
"scope": "Prowler 5.47.0 check iam_inline_policy_no_full_access_to_cloudtrail (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1848
1855
|
"evidenceType": "Configuration",
|
|
1849
1856
|
"severity": "high"
|
|
1850
1857
|
},
|
|
1851
1858
|
{
|
|
1852
1859
|
"id": "prowler.aws.iam_inline_policy_no_wildcard_marketplace_subscribe",
|
|
1853
1860
|
"title": "Inline IAM policy does not allow 'aws-marketplace:Subscribe' on all resources",
|
|
1854
|
-
"scope": "Prowler 5.
|
|
1861
|
+
"scope": "Prowler 5.47.0 check iam_inline_policy_no_wildcard_marketplace_subscribe (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1855
1862
|
"evidenceType": "Configuration",
|
|
1856
1863
|
"severity": "medium"
|
|
1857
1864
|
},
|
|
1858
1865
|
{
|
|
1859
1866
|
"id": "prowler.aws.iam_no_custom_policy_permissive_role_assumption",
|
|
1860
1867
|
"title": "Custom IAM policy does not allow STS role assumption on wildcard resources",
|
|
1861
|
-
"scope": "Prowler 5.
|
|
1868
|
+
"scope": "Prowler 5.47.0 check iam_no_custom_policy_permissive_role_assumption (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1862
1869
|
"evidenceType": "Configuration",
|
|
1863
1870
|
"severity": "high"
|
|
1864
1871
|
},
|
|
1865
1872
|
{
|
|
1866
1873
|
"id": "prowler.aws.iam_no_expired_server_certificates_stored",
|
|
1867
1874
|
"title": "IAM server certificate is not expired",
|
|
1868
|
-
"scope": "Prowler 5.
|
|
1875
|
+
"scope": "Prowler 5.47.0 check iam_no_expired_server_certificates_stored (AWS iam, resource type AwsCertificateManagerCertificate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1869
1876
|
"evidenceType": "Configuration",
|
|
1870
1877
|
"severity": "high"
|
|
1871
1878
|
},
|
|
1872
1879
|
{
|
|
1873
1880
|
"id": "prowler.aws.iam_no_root_access_key",
|
|
1874
1881
|
"title": "Root account has no active access keys",
|
|
1875
|
-
"scope": "Prowler 5.
|
|
1882
|
+
"scope": "Prowler 5.47.0 check iam_no_root_access_key (AWS iam, resource type AwsIamAccessKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1876
1883
|
"evidenceType": "Configuration",
|
|
1877
1884
|
"severity": "critical"
|
|
1878
1885
|
},
|
|
1879
1886
|
{
|
|
1880
1887
|
"id": "prowler.aws.iam_password_policy_lowercase",
|
|
1881
1888
|
"title": "IAM password policy requires at least one lowercase letter",
|
|
1882
|
-
"scope": "Prowler 5.
|
|
1889
|
+
"scope": "Prowler 5.47.0 check iam_password_policy_lowercase (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1883
1890
|
"evidenceType": "Configuration",
|
|
1884
1891
|
"severity": "low"
|
|
1885
1892
|
},
|
|
1886
1893
|
{
|
|
1887
1894
|
"id": "prowler.aws.iam_password_policy_minimum_length_14",
|
|
1888
1895
|
"title": "IAM password policy requires passwords to be at least 14 characters long",
|
|
1889
|
-
"scope": "Prowler 5.
|
|
1896
|
+
"scope": "Prowler 5.47.0 check iam_password_policy_minimum_length_14 (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1890
1897
|
"evidenceType": "Configuration",
|
|
1891
1898
|
"severity": "medium"
|
|
1892
1899
|
},
|
|
1893
1900
|
{
|
|
1894
1901
|
"id": "prowler.aws.iam_password_policy_number",
|
|
1895
1902
|
"title": "IAM password policy requires at least one number",
|
|
1896
|
-
"scope": "Prowler 5.
|
|
1903
|
+
"scope": "Prowler 5.47.0 check iam_password_policy_number (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1897
1904
|
"evidenceType": "Configuration",
|
|
1898
1905
|
"severity": "medium"
|
|
1899
1906
|
},
|
|
1900
1907
|
{
|
|
1901
1908
|
"id": "prowler.aws.iam_password_policy_reuse_24",
|
|
1902
1909
|
"title": "IAM password policy prevents reuse of the last 24 passwords",
|
|
1903
|
-
"scope": "Prowler 5.
|
|
1910
|
+
"scope": "Prowler 5.47.0 check iam_password_policy_reuse_24 (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1904
1911
|
"evidenceType": "Configuration",
|
|
1905
1912
|
"severity": "medium"
|
|
1906
1913
|
},
|
|
1907
1914
|
{
|
|
1908
1915
|
"id": "prowler.aws.iam_password_policy_symbol",
|
|
1909
1916
|
"title": "IAM password policy requires at least one symbol",
|
|
1910
|
-
"scope": "Prowler 5.
|
|
1917
|
+
"scope": "Prowler 5.47.0 check iam_password_policy_symbol (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1911
1918
|
"evidenceType": "Configuration",
|
|
1912
1919
|
"severity": "medium"
|
|
1913
1920
|
},
|
|
1914
1921
|
{
|
|
1915
1922
|
"id": "prowler.aws.iam_password_policy_uppercase",
|
|
1916
1923
|
"title": "IAM password policy requires at least one uppercase letter",
|
|
1917
|
-
"scope": "Prowler 5.
|
|
1924
|
+
"scope": "Prowler 5.47.0 check iam_password_policy_uppercase (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1918
1925
|
"evidenceType": "Configuration",
|
|
1919
1926
|
"severity": "medium"
|
|
1920
1927
|
},
|
|
1921
1928
|
{
|
|
1922
1929
|
"id": "prowler.aws.iam_policy_allows_privilege_escalation",
|
|
1923
1930
|
"title": "Customer managed IAM policy does not allow actions that can lead to privilege escalation",
|
|
1924
|
-
"scope": "Prowler 5.
|
|
1931
|
+
"scope": "Prowler 5.47.0 check iam_policy_allows_privilege_escalation (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1925
1932
|
"evidenceType": "Configuration",
|
|
1926
1933
|
"severity": "high"
|
|
1927
1934
|
},
|
|
1928
1935
|
{
|
|
1929
1936
|
"id": "prowler.aws.iam_policy_attached_only_to_group_or_roles",
|
|
1930
1937
|
"title": "IAM user has no inline or attached policies",
|
|
1931
|
-
"scope": "Prowler 5.
|
|
1938
|
+
"scope": "Prowler 5.47.0 check iam_policy_attached_only_to_group_or_roles (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1932
1939
|
"evidenceType": "Configuration",
|
|
1933
1940
|
"severity": "low"
|
|
1934
1941
|
},
|
|
1935
1942
|
{
|
|
1936
1943
|
"id": "prowler.aws.iam_policy_cloudshell_admin_not_attached",
|
|
1937
1944
|
"title": "No IAM users, groups, or roles have the AWSCloudShellFullAccess policy attached",
|
|
1938
|
-
"scope": "Prowler 5.
|
|
1945
|
+
"scope": "Prowler 5.47.0 check iam_policy_cloudshell_admin_not_attached (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1939
1946
|
"evidenceType": "Configuration",
|
|
1940
1947
|
"severity": "medium"
|
|
1941
1948
|
},
|
|
1942
1949
|
{
|
|
1943
1950
|
"id": "prowler.aws.iam_policy_no_agentcore_workload_access_token_wildcard",
|
|
1944
1951
|
"title": "Custom IAM policy scopes Bedrock AgentCore workload access token retrieval to workload identity ARNs",
|
|
1945
|
-
"scope": "Prowler 5.
|
|
1952
|
+
"scope": "Prowler 5.47.0 check iam_policy_no_agentcore_workload_access_token_wildcard (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1946
1953
|
"evidenceType": "Configuration",
|
|
1947
1954
|
"severity": "high"
|
|
1948
1955
|
},
|
|
1949
1956
|
{
|
|
1950
1957
|
"id": "prowler.aws.iam_policy_no_full_access_to_cloudtrail",
|
|
1951
1958
|
"title": "Customer managed IAM policy does not allow cloudtrail:* privileges",
|
|
1952
|
-
"scope": "Prowler 5.
|
|
1959
|
+
"scope": "Prowler 5.47.0 check iam_policy_no_full_access_to_cloudtrail (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1953
1960
|
"evidenceType": "Configuration",
|
|
1954
1961
|
"severity": "medium"
|
|
1955
1962
|
},
|
|
1956
1963
|
{
|
|
1957
1964
|
"id": "prowler.aws.iam_policy_no_full_access_to_kms",
|
|
1958
1965
|
"title": "Custom IAM policy does not allow 'kms:*' privileges",
|
|
1959
|
-
"scope": "Prowler 5.
|
|
1966
|
+
"scope": "Prowler 5.47.0 check iam_policy_no_full_access_to_kms (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1960
1967
|
"evidenceType": "Configuration",
|
|
1961
1968
|
"severity": "medium"
|
|
1962
1969
|
},
|
|
1963
1970
|
{
|
|
1964
1971
|
"id": "prowler.aws.iam_policy_no_wildcard_marketplace_subscribe",
|
|
1965
1972
|
"title": "Custom IAM policy does not allow 'aws-marketplace:Subscribe' on all resources",
|
|
1966
|
-
"scope": "Prowler 5.
|
|
1973
|
+
"scope": "Prowler 5.47.0 check iam_policy_no_wildcard_marketplace_subscribe (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1967
1974
|
"evidenceType": "Configuration",
|
|
1968
1975
|
"severity": "medium"
|
|
1969
1976
|
},
|
|
1970
1977
|
{
|
|
1971
1978
|
"id": "prowler.aws.iam_policy_passrole_to_bedrock_agentcore_restricted",
|
|
1972
1979
|
"title": "Custom IAM policy restricts iam:PassRole to Bedrock AgentCore to specific roles",
|
|
1973
|
-
"scope": "Prowler 5.
|
|
1980
|
+
"scope": "Prowler 5.47.0 check iam_policy_passrole_to_bedrock_agentcore_restricted (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1974
1981
|
"evidenceType": "Configuration",
|
|
1975
1982
|
"severity": "high"
|
|
1976
1983
|
},
|
|
1977
1984
|
{
|
|
1978
1985
|
"id": "prowler.aws.iam_role_access_not_stale_to_bedrock",
|
|
1979
1986
|
"title": "Regular Bedrock access ensures IAM roles retain only actively used permissions",
|
|
1980
|
-
"scope": "Prowler 5.
|
|
1987
|
+
"scope": "Prowler 5.47.0 check iam_role_access_not_stale_to_bedrock (AWS iam, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1981
1988
|
"evidenceType": "Configuration",
|
|
1982
1989
|
"severity": "medium"
|
|
1983
1990
|
},
|
|
1984
1991
|
{
|
|
1985
1992
|
"id": "prowler.aws.iam_role_administratoraccess_policy",
|
|
1986
1993
|
"title": "IAM role does not have AdministratorAccess policy attached",
|
|
1987
|
-
"scope": "Prowler 5.
|
|
1994
|
+
"scope": "Prowler 5.47.0 check iam_role_administratoraccess_policy (AWS iam, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1988
1995
|
"evidenceType": "Configuration",
|
|
1989
1996
|
"severity": "high"
|
|
1990
1997
|
},
|
|
1991
1998
|
{
|
|
1992
1999
|
"id": "prowler.aws.iam_role_cross_service_confused_deputy_prevention",
|
|
1993
2000
|
"title": "IAM service role prevents cross-service confused deputy attack",
|
|
1994
|
-
"scope": "Prowler 5.
|
|
2001
|
+
"scope": "Prowler 5.47.0 check iam_role_cross_service_confused_deputy_prevention (AWS iam, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1995
2002
|
"evidenceType": "Configuration",
|
|
1996
2003
|
"severity": "high"
|
|
1997
2004
|
},
|
|
1998
2005
|
{
|
|
1999
2006
|
"id": "prowler.aws.iam_role_service_trust_restricts_source_to_account",
|
|
2000
2007
|
"title": "IAM role trust policy confines AWS service principals to a specific source account",
|
|
2001
|
-
"scope": "Prowler 5.
|
|
2008
|
+
"scope": "Prowler 5.47.0 check iam_role_service_trust_restricts_source_to_account (AWS iam, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2002
2009
|
"evidenceType": "Configuration",
|
|
2003
2010
|
"severity": "medium"
|
|
2004
2011
|
},
|
|
2005
2012
|
{
|
|
2006
2013
|
"id": "prowler.aws.iam_root_credentials_management_enabled",
|
|
2007
2014
|
"title": "AWS Organization has centralized root credentials management enabled",
|
|
2008
|
-
"scope": "Prowler 5.
|
|
2015
|
+
"scope": "Prowler 5.47.0 check iam_root_credentials_management_enabled (AWS iam, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2009
2016
|
"evidenceType": "Configuration",
|
|
2010
2017
|
"severity": "high"
|
|
2011
2018
|
},
|
|
2012
2019
|
{
|
|
2013
2020
|
"id": "prowler.aws.iam_root_hardware_mfa_enabled",
|
|
2014
2021
|
"title": "Root account has a hardware MFA device enabled",
|
|
2015
|
-
"scope": "Prowler 5.
|
|
2022
|
+
"scope": "Prowler 5.47.0 check iam_root_hardware_mfa_enabled (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2016
2023
|
"evidenceType": "Configuration",
|
|
2017
2024
|
"severity": "critical"
|
|
2018
2025
|
},
|
|
2019
2026
|
{
|
|
2020
2027
|
"id": "prowler.aws.iam_root_mfa_enabled",
|
|
2021
2028
|
"title": "Root account has MFA enabled",
|
|
2022
|
-
"scope": "Prowler 5.
|
|
2029
|
+
"scope": "Prowler 5.47.0 check iam_root_mfa_enabled (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2023
2030
|
"evidenceType": "Configuration",
|
|
2024
2031
|
"severity": "critical"
|
|
2025
2032
|
},
|
|
2026
2033
|
{
|
|
2027
2034
|
"id": "prowler.aws.iam_rotate_access_key_90_days",
|
|
2028
2035
|
"title": "IAM user does not have active access keys older than 90 days",
|
|
2029
|
-
"scope": "Prowler 5.
|
|
2036
|
+
"scope": "Prowler 5.47.0 check iam_rotate_access_key_90_days (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2030
2037
|
"evidenceType": "Configuration",
|
|
2031
2038
|
"severity": "medium"
|
|
2032
2039
|
},
|
|
2033
2040
|
{
|
|
2034
2041
|
"id": "prowler.aws.iam_user_access_not_stale_to_bedrock",
|
|
2035
2042
|
"title": "Regular Bedrock access ensures IAM users retain only actively used permissions",
|
|
2036
|
-
"scope": "Prowler 5.
|
|
2043
|
+
"scope": "Prowler 5.47.0 check iam_user_access_not_stale_to_bedrock (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2037
2044
|
"evidenceType": "Configuration",
|
|
2038
2045
|
"severity": "medium"
|
|
2039
2046
|
},
|
|
2040
2047
|
{
|
|
2041
2048
|
"id": "prowler.aws.iam_user_access_not_stale_to_sagemaker",
|
|
2042
2049
|
"title": "Regular SageMaker access ensures IAM users retain only actively used permissions",
|
|
2043
|
-
"scope": "Prowler 5.
|
|
2050
|
+
"scope": "Prowler 5.47.0 check iam_user_access_not_stale_to_sagemaker (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2044
2051
|
"evidenceType": "Configuration",
|
|
2045
2052
|
"severity": "medium"
|
|
2046
2053
|
},
|
|
2047
2054
|
{
|
|
2048
2055
|
"id": "prowler.aws.iam_user_accesskey_unused",
|
|
2049
2056
|
"title": "IAM user does not have unused access keys older than 45 days",
|
|
2050
|
-
"scope": "Prowler 5.
|
|
2057
|
+
"scope": "Prowler 5.47.0 check iam_user_accesskey_unused (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2051
2058
|
"evidenceType": "Configuration",
|
|
2052
2059
|
"severity": "medium"
|
|
2053
2060
|
},
|
|
2054
2061
|
{
|
|
2055
2062
|
"id": "prowler.aws.iam_user_administrator_access_policy",
|
|
2056
2063
|
"title": "IAM user does not have AdministratorAccess policy attached",
|
|
2057
|
-
"scope": "Prowler 5.
|
|
2064
|
+
"scope": "Prowler 5.47.0 check iam_user_administrator_access_policy (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2058
2065
|
"evidenceType": "Configuration",
|
|
2059
2066
|
"severity": "critical"
|
|
2060
2067
|
},
|
|
2061
2068
|
{
|
|
2062
2069
|
"id": "prowler.aws.iam_user_console_access_unused",
|
|
2063
2070
|
"title": "IAM user console access is disabled, used within the configured inactivity period, or never used",
|
|
2064
|
-
"scope": "Prowler 5.
|
|
2071
|
+
"scope": "Prowler 5.47.0 check iam_user_console_access_unused (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2065
2072
|
"evidenceType": "Configuration",
|
|
2066
2073
|
"severity": "medium"
|
|
2067
2074
|
},
|
|
2068
2075
|
{
|
|
2069
2076
|
"id": "prowler.aws.iam_user_hardware_mfa_enabled",
|
|
2070
2077
|
"title": "IAM user has hardware MFA enabled",
|
|
2071
|
-
"scope": "Prowler 5.
|
|
2078
|
+
"scope": "Prowler 5.47.0 check iam_user_hardware_mfa_enabled (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2072
2079
|
"evidenceType": "Configuration",
|
|
2073
2080
|
"severity": "high"
|
|
2074
2081
|
},
|
|
2075
2082
|
{
|
|
2076
2083
|
"id": "prowler.aws.iam_user_mfa_enabled_console_access",
|
|
2077
2084
|
"title": "IAM user has MFA enabled for console access or no console password is set",
|
|
2078
|
-
"scope": "Prowler 5.
|
|
2085
|
+
"scope": "Prowler 5.47.0 check iam_user_mfa_enabled_console_access (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2079
2086
|
"evidenceType": "Configuration",
|
|
2080
2087
|
"severity": "high"
|
|
2081
2088
|
},
|
|
2082
2089
|
{
|
|
2083
2090
|
"id": "prowler.aws.iam_user_no_setup_initial_access_key",
|
|
2084
2091
|
"title": "IAM user does not have active access keys that have never been used",
|
|
2085
|
-
"scope": "Prowler 5.
|
|
2092
|
+
"scope": "Prowler 5.47.0 check iam_user_no_setup_initial_access_key (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2086
2093
|
"evidenceType": "Configuration",
|
|
2087
2094
|
"severity": "medium"
|
|
2088
2095
|
},
|
|
2089
2096
|
{
|
|
2090
2097
|
"id": "prowler.aws.iam_user_two_active_access_key",
|
|
2091
2098
|
"title": "IAM user has at most one active access key",
|
|
2092
|
-
"scope": "Prowler 5.
|
|
2099
|
+
"scope": "Prowler 5.47.0 check iam_user_two_active_access_key (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2093
2100
|
"evidenceType": "Configuration",
|
|
2094
2101
|
"severity": "medium"
|
|
2095
2102
|
},
|
|
2096
2103
|
{
|
|
2097
2104
|
"id": "prowler.aws.iam_user_with_temporary_credentials",
|
|
2098
2105
|
"title": "IAM user does not use long-lived credentials to access services other than IAM or STS",
|
|
2099
|
-
"scope": "Prowler 5.
|
|
2106
|
+
"scope": "Prowler 5.47.0 check iam_user_with_temporary_credentials (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2100
2107
|
"evidenceType": "Configuration",
|
|
2101
2108
|
"severity": "high"
|
|
2102
2109
|
},
|
|
2103
2110
|
{
|
|
2104
2111
|
"id": "prowler.aws.inspector2_active_findings_exist",
|
|
2105
2112
|
"title": "Inspector2 is enabled with no active findings",
|
|
2106
|
-
"scope": "Prowler 5.
|
|
2113
|
+
"scope": "Prowler 5.47.0 check inspector2_active_findings_exist (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2107
2114
|
"evidenceType": "Configuration",
|
|
2108
2115
|
"severity": "high"
|
|
2109
2116
|
},
|
|
2110
2117
|
{
|
|
2111
2118
|
"id": "prowler.aws.inspector2_is_enabled",
|
|
2112
2119
|
"title": "Inspector2 is enabled for Amazon EC2 instances, ECR container images, Lambda functions, and Lambda code",
|
|
2113
|
-
"scope": "Prowler 5.
|
|
2120
|
+
"scope": "Prowler 5.47.0 check inspector2_is_enabled (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2114
2121
|
"evidenceType": "Configuration",
|
|
2115
2122
|
"severity": "medium"
|
|
2116
2123
|
},
|
|
2117
2124
|
{
|
|
2118
2125
|
"id": "prowler.aws.kafka_cluster_encryption_at_rest_uses_cmk",
|
|
2119
2126
|
"title": "Kafka cluster has encryption at rest enabled with a customer managed key (CMK) or is serverless",
|
|
2120
|
-
"scope": "Prowler 5.
|
|
2127
|
+
"scope": "Prowler 5.47.0 check kafka_cluster_encryption_at_rest_uses_cmk (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2121
2128
|
"evidenceType": "Configuration",
|
|
2122
2129
|
"severity": "medium"
|
|
2123
2130
|
},
|
|
2124
2131
|
{
|
|
2125
2132
|
"id": "prowler.aws.kafka_cluster_in_transit_encryption_enabled",
|
|
2126
2133
|
"title": "Kafka cluster has encryption in transit enabled",
|
|
2127
|
-
"scope": "Prowler 5.
|
|
2134
|
+
"scope": "Prowler 5.47.0 check kafka_cluster_in_transit_encryption_enabled (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2128
2135
|
"evidenceType": "Configuration",
|
|
2129
2136
|
"severity": "high"
|
|
2130
2137
|
},
|
|
2131
2138
|
{
|
|
2132
2139
|
"id": "prowler.aws.kafka_cluster_is_public",
|
|
2133
2140
|
"title": "Kafka cluster is not publicly accessible",
|
|
2134
|
-
"scope": "Prowler 5.
|
|
2141
|
+
"scope": "Prowler 5.47.0 check kafka_cluster_is_public (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2135
2142
|
"evidenceType": "Configuration",
|
|
2136
2143
|
"severity": "critical"
|
|
2137
2144
|
},
|
|
2138
2145
|
{
|
|
2139
2146
|
"id": "prowler.aws.kafka_cluster_mutual_tls_authentication_enabled",
|
|
2140
2147
|
"title": "Kafka cluster has TLS authentication enabled",
|
|
2141
|
-
"scope": "Prowler 5.
|
|
2148
|
+
"scope": "Prowler 5.47.0 check kafka_cluster_mutual_tls_authentication_enabled (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2142
2149
|
"evidenceType": "Configuration",
|
|
2143
2150
|
"severity": "high"
|
|
2144
2151
|
},
|
|
2145
2152
|
{
|
|
2146
2153
|
"id": "prowler.aws.kafka_cluster_unrestricted_access_disabled",
|
|
2147
2154
|
"title": "Kafka cluster requires authentication",
|
|
2148
|
-
"scope": "Prowler 5.
|
|
2155
|
+
"scope": "Prowler 5.47.0 check kafka_cluster_unrestricted_access_disabled (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2149
2156
|
"evidenceType": "Configuration",
|
|
2150
2157
|
"severity": "critical"
|
|
2151
2158
|
},
|
|
2152
2159
|
{
|
|
2153
2160
|
"id": "prowler.aws.kafka_cluster_uses_latest_version",
|
|
2154
2161
|
"title": "MSK cluster uses the latest Kafka version or is serverless with AWS-managed version",
|
|
2155
|
-
"scope": "Prowler 5.
|
|
2162
|
+
"scope": "Prowler 5.47.0 check kafka_cluster_uses_latest_version (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2156
2163
|
"evidenceType": "Configuration",
|
|
2157
2164
|
"severity": "medium"
|
|
2158
2165
|
},
|
|
2159
2166
|
{
|
|
2160
2167
|
"id": "prowler.aws.kafka_connector_in_transit_encryption_enabled",
|
|
2161
2168
|
"title": "MSK Connect connector has encryption in transit enabled",
|
|
2162
|
-
"scope": "Prowler 5.
|
|
2169
|
+
"scope": "Prowler 5.47.0 check kafka_connector_in_transit_encryption_enabled (AWS kafka, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2163
2170
|
"evidenceType": "Configuration",
|
|
2164
2171
|
"severity": "high"
|
|
2165
2172
|
},
|
|
2166
2173
|
{
|
|
2167
2174
|
"id": "prowler.aws.kinesis_stream_encrypted_at_rest",
|
|
2168
2175
|
"title": "Kinesis stream is encrypted at rest with KMS",
|
|
2169
|
-
"scope": "Prowler 5.
|
|
2176
|
+
"scope": "Prowler 5.47.0 check kinesis_stream_encrypted_at_rest (AWS kinesis, resource type AwsKinesisStream): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2170
2177
|
"evidenceType": "Configuration",
|
|
2171
2178
|
"severity": "high"
|
|
2172
2179
|
},
|
|
2173
2180
|
{
|
|
2174
2181
|
"id": "prowler.aws.kms_cmk_rotation_enabled",
|
|
2175
2182
|
"title": "KMS customer-managed symmetric CMK has automatic rotation enabled",
|
|
2176
|
-
"scope": "Prowler 5.
|
|
2183
|
+
"scope": "Prowler 5.47.0 check kms_cmk_rotation_enabled (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2177
2184
|
"evidenceType": "Configuration",
|
|
2178
2185
|
"severity": "high"
|
|
2179
2186
|
},
|
|
2180
2187
|
{
|
|
2181
2188
|
"id": "prowler.aws.kms_key_enclave_attestation_bypassable_path",
|
|
2182
2189
|
"title": "KMS enclave key has no authorization path that bypasses attestation",
|
|
2183
|
-
"scope": "Prowler 5.
|
|
2190
|
+
"scope": "Prowler 5.47.0 check kms_key_enclave_attestation_bypassable_path (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2184
2191
|
"evidenceType": "Configuration",
|
|
2185
2192
|
"severity": "high"
|
|
2186
2193
|
},
|
|
2187
2194
|
{
|
|
2188
2195
|
"id": "prowler.aws.kms_key_enclave_attestation_no_deployment_binding",
|
|
2189
2196
|
"title": "KMS enclave key attestation binds a specific deployment context",
|
|
2190
|
-
"scope": "Prowler 5.
|
|
2197
|
+
"scope": "Prowler 5.47.0 check kms_key_enclave_attestation_no_deployment_binding (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2191
2198
|
"evidenceType": "Configuration",
|
|
2192
2199
|
"severity": "informational"
|
|
2193
2200
|
},
|
|
2194
2201
|
{
|
|
2195
2202
|
"id": "prowler.aws.kms_key_enclave_attestation_not_enforced",
|
|
2196
2203
|
"title": "KMS enclave key requires kms:RecipientAttestation conditions on sensitive actions",
|
|
2197
|
-
"scope": "Prowler 5.
|
|
2204
|
+
"scope": "Prowler 5.47.0 check kms_key_enclave_attestation_not_enforced (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2198
2205
|
"evidenceType": "Configuration",
|
|
2199
2206
|
"severity": "high"
|
|
2200
2207
|
},
|
|
2201
2208
|
{
|
|
2202
2209
|
"id": "prowler.aws.kms_key_enclave_attestation_pcr_mismatch",
|
|
2203
2210
|
"title": "KMS enclave key attestation PCRs match customer-supplied golden values",
|
|
2204
|
-
"scope": "Prowler 5.
|
|
2211
|
+
"scope": "Prowler 5.47.0 check kms_key_enclave_attestation_pcr_mismatch (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2205
2212
|
"evidenceType": "Configuration",
|
|
2206
2213
|
"severity": "medium"
|
|
2207
2214
|
},
|
|
2208
2215
|
{
|
|
2209
2216
|
"id": "prowler.aws.kms_key_enclave_attestation_unknown_image",
|
|
2210
2217
|
"title": "No enclave with an unknown image identity has called this KMS key",
|
|
2211
|
-
"scope": "Prowler 5.
|
|
2218
|
+
"scope": "Prowler 5.47.0 check kms_key_enclave_attestation_unknown_image (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2212
2219
|
"evidenceType": "Configuration",
|
|
2213
2220
|
"severity": "medium"
|
|
2214
2221
|
},
|
|
2215
2222
|
{
|
|
2216
2223
|
"id": "prowler.aws.kms_key_enclave_debug_attestation_detected",
|
|
2217
2224
|
"title": "No Nitro Enclave debug-mode attestation observed against this KMS key",
|
|
2218
|
-
"scope": "Prowler 5.
|
|
2225
|
+
"scope": "Prowler 5.47.0 check kms_key_enclave_debug_attestation_detected (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2219
2226
|
"evidenceType": "Configuration",
|
|
2220
2227
|
"severity": "high"
|
|
2221
2228
|
},
|
|
2222
2229
|
{
|
|
2223
2230
|
"id": "prowler.aws.kms_key_not_publicly_accessible",
|
|
2224
2231
|
"title": "Cloud KMS key does not grant access to allUsers or allAuthenticatedUsers",
|
|
2225
|
-
"scope": "Prowler 5.
|
|
2232
|
+
"scope": "Prowler 5.47.0 check kms_key_not_publicly_accessible (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2226
2233
|
"evidenceType": "Configuration",
|
|
2227
2234
|
"severity": "critical"
|
|
2228
2235
|
},
|
|
2229
2236
|
{
|
|
2230
2237
|
"id": "prowler.aws.lightsail_database_public",
|
|
2231
2238
|
"title": "Lightsail database public access disabled",
|
|
2232
|
-
"scope": "Prowler 5.
|
|
2239
|
+
"scope": "Prowler 5.47.0 check lightsail_database_public (AWS lightsail, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2233
2240
|
"evidenceType": "Configuration",
|
|
2234
2241
|
"severity": "high"
|
|
2235
2242
|
},
|
|
2236
2243
|
{
|
|
2237
2244
|
"id": "prowler.aws.lightsail_instance_automated_snapshots",
|
|
2238
2245
|
"title": "Lightsail instance has automated snapshots enabled",
|
|
2239
|
-
"scope": "Prowler 5.
|
|
2246
|
+
"scope": "Prowler 5.47.0 check lightsail_instance_automated_snapshots (AWS lightsail, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2240
2247
|
"evidenceType": "Configuration",
|
|
2241
2248
|
"severity": "medium"
|
|
2242
2249
|
},
|
|
2243
2250
|
{
|
|
2244
2251
|
"id": "prowler.aws.lightsail_instance_public",
|
|
2245
2252
|
"title": "Lightsail instance has no publicly accessible ports",
|
|
2246
|
-
"scope": "Prowler 5.
|
|
2253
|
+
"scope": "Prowler 5.47.0 check lightsail_instance_public (AWS lightsail, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2247
2254
|
"evidenceType": "Configuration",
|
|
2248
2255
|
"severity": "high"
|
|
2249
2256
|
},
|
|
2250
2257
|
{
|
|
2251
2258
|
"id": "prowler.aws.lightsail_static_ip_unused",
|
|
2252
2259
|
"title": "Lightsail static IP is associated with an instance",
|
|
2253
|
-
"scope": "Prowler 5.
|
|
2260
|
+
"scope": "Prowler 5.47.0 check lightsail_static_ip_unused (AWS lightsail, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2254
2261
|
"evidenceType": "Configuration",
|
|
2255
2262
|
"severity": "low"
|
|
2256
2263
|
},
|
|
2257
2264
|
{
|
|
2258
2265
|
"id": "prowler.aws.memorydb_cluster_in_transit_encryption_enabled",
|
|
2259
2266
|
"title": "MemoryDB cluster has in-transit encryption enabled",
|
|
2260
|
-
"scope": "Prowler 5.
|
|
2267
|
+
"scope": "Prowler 5.47.0 check memorydb_cluster_in_transit_encryption_enabled (AWS memorydb, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2261
2268
|
"evidenceType": "Configuration",
|
|
2262
2269
|
"severity": "medium"
|
|
2263
2270
|
},
|
|
2264
2271
|
{
|
|
2265
2272
|
"id": "prowler.aws.mq_broker_active_deployment_mode",
|
|
2266
2273
|
"title": "Apache ActiveMQ broker is configured in active/standby Multi-AZ deployment mode",
|
|
2267
|
-
"scope": "Prowler 5.
|
|
2274
|
+
"scope": "Prowler 5.47.0 check mq_broker_active_deployment_mode (AWS mq, resource type AwsAmazonMQBroker): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2268
2275
|
"evidenceType": "Configuration",
|
|
2269
2276
|
"severity": "low"
|
|
2270
2277
|
},
|
|
2271
2278
|
{
|
|
2272
2279
|
"id": "prowler.aws.mq_broker_cluster_deployment_mode",
|
|
2273
2280
|
"title": "MQ RabbitMQ broker has cluster (multi-AZ) deployment mode",
|
|
2274
|
-
"scope": "Prowler 5.
|
|
2281
|
+
"scope": "Prowler 5.47.0 check mq_broker_cluster_deployment_mode (AWS mq, resource type AwsAmazonMQBroker): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2275
2282
|
"evidenceType": "Configuration",
|
|
2276
2283
|
"severity": "medium"
|
|
2277
2284
|
},
|
|
2278
2285
|
{
|
|
2279
2286
|
"id": "prowler.aws.mq_broker_logging_enabled",
|
|
2280
2287
|
"title": "MQ broker has general logging enabled and, for ActiveMQ, audit logging enabled",
|
|
2281
|
-
"scope": "Prowler 5.
|
|
2288
|
+
"scope": "Prowler 5.47.0 check mq_broker_logging_enabled (AWS mq, resource type AwsAmazonMQBroker): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2282
2289
|
"evidenceType": "Configuration",
|
|
2283
2290
|
"severity": "low"
|
|
2284
2291
|
},
|
|
2285
2292
|
{
|
|
2286
2293
|
"id": "prowler.aws.mq_broker_not_publicly_accessible",
|
|
2287
2294
|
"title": "Amazon MQ broker is not publicly accessible",
|
|
2288
|
-
"scope": "Prowler 5.
|
|
2295
|
+
"scope": "Prowler 5.47.0 check mq_broker_not_publicly_accessible (AWS mq, resource type AwsAmazonMQBroker): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2289
2296
|
"evidenceType": "Configuration",
|
|
2290
2297
|
"severity": "high"
|
|
2291
2298
|
},
|
|
2292
2299
|
{
|
|
2293
2300
|
"id": "prowler.aws.neptune_cluster_backup_enabled",
|
|
2294
2301
|
"title": "Neptune cluster has automated backups enabled with retention period equal to or greater than the configured minimum",
|
|
2295
|
-
"scope": "Prowler 5.
|
|
2302
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_backup_enabled (AWS neptune, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2296
2303
|
"evidenceType": "Configuration",
|
|
2297
2304
|
"severity": "medium"
|
|
2298
2305
|
},
|
|
2299
2306
|
{
|
|
2300
2307
|
"id": "prowler.aws.neptune_cluster_iam_authentication_enabled",
|
|
2301
2308
|
"title": "Neptune cluster has IAM authentication enabled",
|
|
2302
|
-
"scope": "Prowler 5.
|
|
2309
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_iam_authentication_enabled (AWS neptune, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2303
2310
|
"evidenceType": "Configuration",
|
|
2304
2311
|
"severity": "medium"
|
|
2305
2312
|
},
|
|
2306
2313
|
{
|
|
2307
2314
|
"id": "prowler.aws.neptune_cluster_integration_cloudwatch_logs",
|
|
2308
2315
|
"title": "Neptune cluster has CloudWatch audit logs enabled",
|
|
2309
|
-
"scope": "Prowler 5.
|
|
2316
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_integration_cloudwatch_logs (AWS neptune, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2310
2317
|
"evidenceType": "Configuration",
|
|
2311
2318
|
"severity": "medium"
|
|
2312
2319
|
},
|
|
2313
2320
|
{
|
|
2314
2321
|
"id": "prowler.aws.neptune_cluster_multi_az",
|
|
2315
2322
|
"title": "Neptune cluster has Multi-AZ enabled",
|
|
2316
|
-
"scope": "Prowler 5.
|
|
2323
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_multi_az (AWS neptune, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2317
2324
|
"evidenceType": "Configuration",
|
|
2318
2325
|
"severity": "medium"
|
|
2319
2326
|
},
|
|
2320
2327
|
{
|
|
2321
2328
|
"id": "prowler.aws.neptune_cluster_public_snapshot",
|
|
2322
2329
|
"title": "NeptuneDB cluster snapshot is not publicly shared",
|
|
2323
|
-
"scope": "Prowler 5.
|
|
2330
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_public_snapshot (AWS neptune, resource type AwsRdsDbClusterSnapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2324
2331
|
"evidenceType": "Configuration",
|
|
2325
2332
|
"severity": "critical"
|
|
2326
2333
|
},
|
|
2327
2334
|
{
|
|
2328
2335
|
"id": "prowler.aws.neptune_cluster_snapshot_encrypted",
|
|
2329
2336
|
"title": "Neptune DB cluster snapshot is encrypted at rest",
|
|
2330
|
-
"scope": "Prowler 5.
|
|
2337
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_snapshot_encrypted (AWS neptune, resource type AwsRdsDbClusterSnapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2331
2338
|
"evidenceType": "Configuration",
|
|
2332
2339
|
"severity": "medium"
|
|
2333
2340
|
},
|
|
2334
2341
|
{
|
|
2335
2342
|
"id": "prowler.aws.neptune_cluster_storage_encrypted",
|
|
2336
2343
|
"title": "Neptune cluster storage is encrypted at rest",
|
|
2337
|
-
"scope": "Prowler 5.
|
|
2344
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_storage_encrypted (AWS neptune, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2338
2345
|
"evidenceType": "Configuration",
|
|
2339
2346
|
"severity": "high"
|
|
2340
2347
|
},
|
|
2341
2348
|
{
|
|
2342
2349
|
"id": "prowler.aws.neptune_cluster_uses_public_subnet",
|
|
2343
2350
|
"title": "Neptune cluster is not using public subnets",
|
|
2344
|
-
"scope": "Prowler 5.
|
|
2351
|
+
"scope": "Prowler 5.47.0 check neptune_cluster_uses_public_subnet (AWS neptune, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2345
2352
|
"evidenceType": "Configuration",
|
|
2346
2353
|
"severity": "medium"
|
|
2347
2354
|
},
|
|
2348
2355
|
{
|
|
2349
2356
|
"id": "prowler.aws.networkfirewall_in_all_vpc",
|
|
2350
2357
|
"title": "VPC has Network Firewall enabled",
|
|
2351
|
-
"scope": "Prowler 5.
|
|
2358
|
+
"scope": "Prowler 5.47.0 check networkfirewall_in_all_vpc (AWS networkfirewall, resource type AwsEc2Vpc): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2352
2359
|
"evidenceType": "Configuration",
|
|
2353
2360
|
"severity": "medium"
|
|
2354
2361
|
},
|
|
2355
2362
|
{
|
|
2356
2363
|
"id": "prowler.aws.networkfirewall_logging_enabled",
|
|
2357
2364
|
"title": "Network Firewall has logging enabled",
|
|
2358
|
-
"scope": "Prowler 5.
|
|
2365
|
+
"scope": "Prowler 5.47.0 check networkfirewall_logging_enabled (AWS networkfirewall, resource type AwsNetworkFirewallFirewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2359
2366
|
"evidenceType": "Configuration",
|
|
2360
2367
|
"severity": "high"
|
|
2361
2368
|
},
|
|
2362
2369
|
{
|
|
2363
2370
|
"id": "prowler.aws.networkfirewall_multi_az",
|
|
2364
2371
|
"title": "Network Firewall firewall is deployed across multiple Availability Zones",
|
|
2365
|
-
"scope": "Prowler 5.
|
|
2372
|
+
"scope": "Prowler 5.47.0 check networkfirewall_multi_az (AWS networkfirewall, resource type AwsNetworkFirewallFirewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2366
2373
|
"evidenceType": "Configuration",
|
|
2367
2374
|
"severity": "high"
|
|
2368
2375
|
},
|
|
2369
2376
|
{
|
|
2370
2377
|
"id": "prowler.aws.networkfirewall_policy_default_action_fragmented_packets",
|
|
2371
2378
|
"title": "Network Firewall policy drops or forwards fragmented packets by default",
|
|
2372
|
-
"scope": "Prowler 5.
|
|
2379
|
+
"scope": "Prowler 5.47.0 check networkfirewall_policy_default_action_fragmented_packets (AWS networkfirewall, resource type AwsNetworkFirewallFirewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2373
2380
|
"evidenceType": "Configuration",
|
|
2374
2381
|
"severity": "high"
|
|
2375
2382
|
},
|
|
2376
2383
|
{
|
|
2377
2384
|
"id": "prowler.aws.networkfirewall_policy_default_action_full_packets",
|
|
2378
2385
|
"title": "Network Firewall firewall policy default stateless action for full packets is drop or forward",
|
|
2379
|
-
"scope": "Prowler 5.
|
|
2386
|
+
"scope": "Prowler 5.47.0 check networkfirewall_policy_default_action_full_packets (AWS networkfirewall, resource type AwsNetworkFirewallFirewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2380
2387
|
"evidenceType": "Configuration",
|
|
2381
2388
|
"severity": "high"
|
|
2382
2389
|
},
|
|
2383
2390
|
{
|
|
2384
2391
|
"id": "prowler.aws.networkfirewall_policy_rule_group_associated",
|
|
2385
2392
|
"title": "Network Firewall policy has at least one rule group associated",
|
|
2386
|
-
"scope": "Prowler 5.
|
|
2393
|
+
"scope": "Prowler 5.47.0 check networkfirewall_policy_rule_group_associated (AWS networkfirewall, resource type AwsNetworkFirewallFirewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2387
2394
|
"evidenceType": "Configuration",
|
|
2388
2395
|
"severity": "high"
|
|
2389
2396
|
},
|
|
2390
2397
|
{
|
|
2391
2398
|
"id": "prowler.aws.opensearch_service_domains_access_control_enabled",
|
|
2392
2399
|
"title": "Amazon OpenSearch Service domain has fine-grained access control enabled",
|
|
2393
|
-
"scope": "Prowler 5.
|
|
2400
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_access_control_enabled (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2394
2401
|
"evidenceType": "Configuration",
|
|
2395
2402
|
"severity": "high"
|
|
2396
2403
|
},
|
|
2397
2404
|
{
|
|
2398
2405
|
"id": "prowler.aws.opensearch_service_domains_audit_logging_enabled",
|
|
2399
2406
|
"title": "Amazon OpenSearch Service domain has audit logging enabled",
|
|
2400
|
-
"scope": "Prowler 5.
|
|
2407
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_audit_logging_enabled (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2401
2408
|
"evidenceType": "Configuration",
|
|
2402
2409
|
"severity": "high"
|
|
2403
2410
|
},
|
|
2404
2411
|
{
|
|
2405
2412
|
"id": "prowler.aws.opensearch_service_domains_cloudwatch_logging_enabled",
|
|
2406
2413
|
"title": "Amazon OpenSearch Service domain publishes search and index slow logs to CloudWatch Logs",
|
|
2407
|
-
"scope": "Prowler 5.
|
|
2414
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_cloudwatch_logging_enabled (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2408
2415
|
"evidenceType": "Configuration",
|
|
2409
2416
|
"severity": "low"
|
|
2410
2417
|
},
|
|
2411
2418
|
{
|
|
2412
2419
|
"id": "prowler.aws.opensearch_service_domains_encryption_at_rest_enabled",
|
|
2413
2420
|
"title": "Amazon OpenSearch Service domain has encryption at rest enabled",
|
|
2414
|
-
"scope": "Prowler 5.
|
|
2421
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_encryption_at_rest_enabled (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2415
2422
|
"evidenceType": "Configuration",
|
|
2416
2423
|
"severity": "critical"
|
|
2417
2424
|
},
|
|
2418
2425
|
{
|
|
2419
2426
|
"id": "prowler.aws.opensearch_service_domains_fault_tolerant_data_nodes",
|
|
2420
2427
|
"title": "OpenSearch domain has at least 3 data nodes and Zone Awareness enabled",
|
|
2421
|
-
"scope": "Prowler 5.
|
|
2428
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_fault_tolerant_data_nodes (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2422
2429
|
"evidenceType": "Configuration",
|
|
2423
2430
|
"severity": "medium"
|
|
2424
2431
|
},
|
|
2425
2432
|
{
|
|
2426
2433
|
"id": "prowler.aws.opensearch_service_domains_fault_tolerant_master_nodes",
|
|
2427
2434
|
"title": "OpenSearch domain has at least 3 dedicated master nodes",
|
|
2428
|
-
"scope": "Prowler 5.
|
|
2435
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_fault_tolerant_master_nodes (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2429
2436
|
"evidenceType": "Configuration",
|
|
2430
2437
|
"severity": "medium"
|
|
2431
2438
|
},
|
|
2432
2439
|
{
|
|
2433
2440
|
"id": "prowler.aws.opensearch_service_domains_https_communications_enforced",
|
|
2434
2441
|
"title": "OpenSearch domain has HTTPS enforcement enabled",
|
|
2435
|
-
"scope": "Prowler 5.
|
|
2442
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_https_communications_enforced (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2436
2443
|
"evidenceType": "Configuration",
|
|
2437
2444
|
"severity": "high"
|
|
2438
2445
|
},
|
|
2439
2446
|
{
|
|
2440
2447
|
"id": "prowler.aws.opensearch_service_domains_node_to_node_encryption_enabled",
|
|
2441
2448
|
"title": "Amazon OpenSearch Service domain has node-to-node encryption enabled",
|
|
2442
|
-
"scope": "Prowler 5.
|
|
2449
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_node_to_node_encryption_enabled (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2443
2450
|
"evidenceType": "Configuration",
|
|
2444
2451
|
"severity": "high"
|
|
2445
2452
|
},
|
|
2446
2453
|
{
|
|
2447
2454
|
"id": "prowler.aws.opensearch_service_domains_not_publicly_accessible",
|
|
2448
2455
|
"title": "Amazon OpenSearch Service domain is not publicly accessible",
|
|
2449
|
-
"scope": "Prowler 5.
|
|
2456
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_not_publicly_accessible (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2450
2457
|
"evidenceType": "Configuration",
|
|
2451
2458
|
"severity": "critical"
|
|
2452
2459
|
},
|
|
2453
2460
|
{
|
|
2454
2461
|
"id": "prowler.aws.opensearch_service_domains_updated_to_the_latest_service_software_version",
|
|
2455
2462
|
"title": "Amazon OpenSearch Service domain is updated to the latest service software version",
|
|
2456
|
-
"scope": "Prowler 5.
|
|
2463
|
+
"scope": "Prowler 5.47.0 check opensearch_service_domains_updated_to_the_latest_service_software_version (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2457
2464
|
"evidenceType": "Configuration",
|
|
2458
2465
|
"severity": "high"
|
|
2459
2466
|
},
|
|
2460
2467
|
{
|
|
2461
2468
|
"id": "prowler.aws.organizations_delegated_administrators",
|
|
2462
2469
|
"title": "AWS Organization has only trusted delegated administrators",
|
|
2463
|
-
"scope": "Prowler 5.
|
|
2470
|
+
"scope": "Prowler 5.47.0 check organizations_delegated_administrators (AWS organizations, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2464
2471
|
"evidenceType": "Configuration",
|
|
2465
2472
|
"severity": "critical"
|
|
2466
2473
|
},
|
|
2467
2474
|
{
|
|
2468
2475
|
"id": "prowler.aws.organizations_scp_check_deny_regions",
|
|
2469
2476
|
"title": "AWS Organization restricts operations to only the configured AWS Regions with SCP policies",
|
|
2470
|
-
"scope": "Prowler 5.
|
|
2477
|
+
"scope": "Prowler 5.47.0 check organizations_scp_check_deny_regions (AWS organizations, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2471
2478
|
"evidenceType": "Configuration",
|
|
2472
2479
|
"severity": "high"
|
|
2473
2480
|
},
|
|
2474
2481
|
{
|
|
2475
2482
|
"id": "prowler.aws.rds_cluster_backtrack_enabled",
|
|
2476
2483
|
"title": "RDS Aurora MySQL cluster has Backtrack enabled",
|
|
2477
|
-
"scope": "Prowler 5.
|
|
2484
|
+
"scope": "Prowler 5.47.0 check rds_cluster_backtrack_enabled (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2478
2485
|
"evidenceType": "Configuration",
|
|
2479
2486
|
"severity": "low"
|
|
2480
2487
|
},
|
|
2481
2488
|
{
|
|
2482
2489
|
"id": "prowler.aws.rds_cluster_iam_authentication_enabled",
|
|
2483
2490
|
"title": "RDS cluster has IAM authentication enabled",
|
|
2484
|
-
"scope": "Prowler 5.
|
|
2491
|
+
"scope": "Prowler 5.47.0 check rds_cluster_iam_authentication_enabled (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2485
2492
|
"evidenceType": "Configuration",
|
|
2486
2493
|
"severity": "medium"
|
|
2487
2494
|
},
|
|
2488
2495
|
{
|
|
2489
2496
|
"id": "prowler.aws.rds_cluster_integration_cloudwatch_logs",
|
|
2490
2497
|
"title": "RDS cluster has CloudWatch Logs export enabled",
|
|
2491
|
-
"scope": "Prowler 5.
|
|
2498
|
+
"scope": "Prowler 5.47.0 check rds_cluster_integration_cloudwatch_logs (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2492
2499
|
"evidenceType": "Configuration",
|
|
2493
2500
|
"severity": "medium"
|
|
2494
2501
|
},
|
|
2495
2502
|
{
|
|
2496
2503
|
"id": "prowler.aws.rds_cluster_multi_az",
|
|
2497
2504
|
"title": "RDS cluster has Multi-AZ enabled",
|
|
2498
|
-
"scope": "Prowler 5.
|
|
2505
|
+
"scope": "Prowler 5.47.0 check rds_cluster_multi_az (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2499
2506
|
"evidenceType": "Configuration",
|
|
2500
2507
|
"severity": "medium"
|
|
2501
2508
|
},
|
|
2502
2509
|
{
|
|
2503
2510
|
"id": "prowler.aws.rds_cluster_protected_by_backup_plan",
|
|
2504
2511
|
"title": "RDS cluster is protected by an AWS Backup plan",
|
|
2505
|
-
"scope": "Prowler 5.
|
|
2512
|
+
"scope": "Prowler 5.47.0 check rds_cluster_protected_by_backup_plan (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2506
2513
|
"evidenceType": "Configuration",
|
|
2507
2514
|
"severity": "high"
|
|
2508
2515
|
},
|
|
2509
2516
|
{
|
|
2510
2517
|
"id": "prowler.aws.rds_cluster_storage_encrypted",
|
|
2511
2518
|
"title": "RDS cluster storage is encrypted",
|
|
2512
|
-
"scope": "Prowler 5.
|
|
2519
|
+
"scope": "Prowler 5.47.0 check rds_cluster_storage_encrypted (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2513
2520
|
"evidenceType": "Configuration",
|
|
2514
2521
|
"severity": "high"
|
|
2515
2522
|
},
|
|
2516
2523
|
{
|
|
2517
2524
|
"id": "prowler.aws.rds_instance_backup_enabled",
|
|
2518
2525
|
"title": "RDS instance has backup retention period greater than 0 days",
|
|
2519
|
-
"scope": "Prowler 5.
|
|
2526
|
+
"scope": "Prowler 5.47.0 check rds_instance_backup_enabled (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2520
2527
|
"evidenceType": "Configuration",
|
|
2521
2528
|
"severity": "medium"
|
|
2522
2529
|
},
|
|
2523
2530
|
{
|
|
2524
2531
|
"id": "prowler.aws.rds_instance_certificate_expiration",
|
|
2525
2532
|
"title": "RDS instance SSL/TLS certificate has more than 3 months of validity remaining",
|
|
2526
|
-
"scope": "Prowler 5.
|
|
2533
|
+
"scope": "Prowler 5.47.0 check rds_instance_certificate_expiration (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2527
2534
|
"evidenceType": "Configuration",
|
|
2528
2535
|
"severity": "high"
|
|
2529
2536
|
},
|
|
2530
2537
|
{
|
|
2531
2538
|
"id": "prowler.aws.rds_instance_deletion_protection",
|
|
2532
2539
|
"title": "RDS instance has deletion protection enabled",
|
|
2533
|
-
"scope": "Prowler 5.
|
|
2540
|
+
"scope": "Prowler 5.47.0 check rds_instance_deletion_protection (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2534
2541
|
"evidenceType": "Configuration",
|
|
2535
2542
|
"severity": "medium"
|
|
2536
2543
|
},
|
|
2537
2544
|
{
|
|
2538
2545
|
"id": "prowler.aws.rds_instance_deprecated_engine_version",
|
|
2539
2546
|
"title": "RDS instance uses a supported engine version",
|
|
2540
|
-
"scope": "Prowler 5.
|
|
2547
|
+
"scope": "Prowler 5.47.0 check rds_instance_deprecated_engine_version (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2541
2548
|
"evidenceType": "Configuration",
|
|
2542
2549
|
"severity": "high"
|
|
2543
2550
|
},
|
|
2544
2551
|
{
|
|
2545
2552
|
"id": "prowler.aws.rds_instance_enhanced_monitoring_enabled",
|
|
2546
2553
|
"title": "RDS instance has enhanced monitoring enabled",
|
|
2547
|
-
"scope": "Prowler 5.
|
|
2554
|
+
"scope": "Prowler 5.47.0 check rds_instance_enhanced_monitoring_enabled (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2548
2555
|
"evidenceType": "Configuration",
|
|
2549
2556
|
"severity": "low"
|
|
2550
2557
|
},
|
|
2551
2558
|
{
|
|
2552
2559
|
"id": "prowler.aws.rds_instance_iam_authentication_enabled",
|
|
2553
2560
|
"title": "RDS instance has IAM database authentication enabled",
|
|
2554
|
-
"scope": "Prowler 5.
|
|
2561
|
+
"scope": "Prowler 5.47.0 check rds_instance_iam_authentication_enabled (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2555
2562
|
"evidenceType": "Configuration",
|
|
2556
2563
|
"severity": "medium"
|
|
2557
2564
|
},
|
|
2558
2565
|
{
|
|
2559
2566
|
"id": "prowler.aws.rds_instance_integration_cloudwatch_logs",
|
|
2560
2567
|
"title": "RDS instance exports logs to CloudWatch Logs",
|
|
2561
|
-
"scope": "Prowler 5.
|
|
2568
|
+
"scope": "Prowler 5.47.0 check rds_instance_integration_cloudwatch_logs (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2562
2569
|
"evidenceType": "Configuration",
|
|
2563
2570
|
"severity": "medium"
|
|
2564
2571
|
},
|
|
2565
2572
|
{
|
|
2566
2573
|
"id": "prowler.aws.rds_instance_multi_az",
|
|
2567
2574
|
"title": "RDS instance has Multi-AZ enabled",
|
|
2568
|
-
"scope": "Prowler 5.
|
|
2575
|
+
"scope": "Prowler 5.47.0 check rds_instance_multi_az (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2569
2576
|
"evidenceType": "Configuration",
|
|
2570
2577
|
"severity": "medium"
|
|
2571
2578
|
},
|
|
2572
2579
|
{
|
|
2573
2580
|
"id": "prowler.aws.rds_instance_no_public_access",
|
|
2574
2581
|
"title": "RDS instance is not publicly exposed to the Internet",
|
|
2575
|
-
"scope": "Prowler 5.
|
|
2582
|
+
"scope": "Prowler 5.47.0 check rds_instance_no_public_access (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2576
2583
|
"evidenceType": "Configuration",
|
|
2577
2584
|
"severity": "critical"
|
|
2578
2585
|
},
|
|
2579
2586
|
{
|
|
2580
2587
|
"id": "prowler.aws.rds_instance_protected_by_backup_plan",
|
|
2581
2588
|
"title": "RDS instance is protected by an AWS Backup plan",
|
|
2582
|
-
"scope": "Prowler 5.
|
|
2589
|
+
"scope": "Prowler 5.47.0 check rds_instance_protected_by_backup_plan (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2583
2590
|
"evidenceType": "Configuration",
|
|
2584
2591
|
"severity": "high"
|
|
2585
2592
|
},
|
|
2586
2593
|
{
|
|
2587
2594
|
"id": "prowler.aws.rds_instance_storage_encrypted",
|
|
2588
2595
|
"title": "RDS DB instance storage is encrypted at rest",
|
|
2589
|
-
"scope": "Prowler 5.
|
|
2596
|
+
"scope": "Prowler 5.47.0 check rds_instance_storage_encrypted (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2590
2597
|
"evidenceType": "Configuration",
|
|
2591
2598
|
"severity": "high"
|
|
2592
2599
|
},
|
|
2593
2600
|
{
|
|
2594
2601
|
"id": "prowler.aws.rds_instance_transport_encrypted",
|
|
2595
2602
|
"title": "RDS instance or cluster enforces SSL/TLS encryption for client connections",
|
|
2596
|
-
"scope": "Prowler 5.
|
|
2603
|
+
"scope": "Prowler 5.47.0 check rds_instance_transport_encrypted (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2597
2604
|
"evidenceType": "Configuration",
|
|
2598
2605
|
"severity": "high"
|
|
2599
2606
|
},
|
|
2600
2607
|
{
|
|
2601
2608
|
"id": "prowler.aws.rds_snapshots_encrypted",
|
|
2602
2609
|
"title": "RDS DB instance snapshot or DB cluster snapshot is encrypted",
|
|
2603
|
-
"scope": "Prowler 5.
|
|
2610
|
+
"scope": "Prowler 5.47.0 check rds_snapshots_encrypted (AWS rds, resource type AwsRdsDbSnapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2604
2611
|
"evidenceType": "Configuration",
|
|
2605
2612
|
"severity": "high"
|
|
2606
2613
|
},
|
|
2607
2614
|
{
|
|
2608
2615
|
"id": "prowler.aws.rds_snapshots_public_access",
|
|
2609
2616
|
"title": "RDS snapshot is not publicly shared",
|
|
2610
|
-
"scope": "Prowler 5.
|
|
2617
|
+
"scope": "Prowler 5.47.0 check rds_snapshots_public_access (AWS rds, resource type AwsRdsDbSnapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2611
2618
|
"evidenceType": "Configuration",
|
|
2612
2619
|
"severity": "critical"
|
|
2613
2620
|
},
|
|
2614
2621
|
{
|
|
2615
2622
|
"id": "prowler.aws.redshift_cluster_audit_logging",
|
|
2616
2623
|
"title": "Redshift cluster has audit logging enabled",
|
|
2617
|
-
"scope": "Prowler 5.
|
|
2624
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_audit_logging (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2618
2625
|
"evidenceType": "Configuration",
|
|
2619
2626
|
"severity": "medium"
|
|
2620
2627
|
},
|
|
2621
2628
|
{
|
|
2622
2629
|
"id": "prowler.aws.redshift_cluster_automated_snapshot",
|
|
2623
2630
|
"title": "Redshift cluster has automated snapshots enabled",
|
|
2624
|
-
"scope": "Prowler 5.
|
|
2631
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_automated_snapshot (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2625
2632
|
"evidenceType": "Configuration",
|
|
2626
2633
|
"severity": "high"
|
|
2627
2634
|
},
|
|
2628
2635
|
{
|
|
2629
2636
|
"id": "prowler.aws.redshift_cluster_automatic_upgrades",
|
|
2630
2637
|
"title": "Redshift cluster has automatic version upgrade enabled",
|
|
2631
|
-
"scope": "Prowler 5.
|
|
2638
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_automatic_upgrades (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2632
2639
|
"evidenceType": "Configuration",
|
|
2633
2640
|
"severity": "medium"
|
|
2634
2641
|
},
|
|
2635
2642
|
{
|
|
2636
2643
|
"id": "prowler.aws.redshift_cluster_encrypted_at_rest",
|
|
2637
2644
|
"title": "Redshift cluster is encrypted at rest",
|
|
2638
|
-
"scope": "Prowler 5.
|
|
2645
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_encrypted_at_rest (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2639
2646
|
"evidenceType": "Configuration",
|
|
2640
2647
|
"severity": "critical"
|
|
2641
2648
|
},
|
|
2642
2649
|
{
|
|
2643
2650
|
"id": "prowler.aws.redshift_cluster_in_transit_encryption_enabled",
|
|
2644
2651
|
"title": "Redshift cluster is encrypted in transit",
|
|
2645
|
-
"scope": "Prowler 5.
|
|
2652
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_in_transit_encryption_enabled (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2646
2653
|
"evidenceType": "Configuration",
|
|
2647
2654
|
"severity": "high"
|
|
2648
2655
|
},
|
|
2649
2656
|
{
|
|
2650
2657
|
"id": "prowler.aws.redshift_cluster_multi_az_enabled",
|
|
2651
2658
|
"title": "Redshift cluster has Multi-AZ enabled",
|
|
2652
|
-
"scope": "Prowler 5.
|
|
2659
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_multi_az_enabled (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2653
2660
|
"evidenceType": "Configuration",
|
|
2654
2661
|
"severity": "medium"
|
|
2655
2662
|
},
|
|
2656
2663
|
{
|
|
2657
2664
|
"id": "prowler.aws.redshift_cluster_public_access",
|
|
2658
2665
|
"title": "Redshift cluster is not publicly exposed to the Internet",
|
|
2659
|
-
"scope": "Prowler 5.
|
|
2666
|
+
"scope": "Prowler 5.47.0 check redshift_cluster_public_access (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2660
2667
|
"evidenceType": "Configuration",
|
|
2661
2668
|
"severity": "critical"
|
|
2662
2669
|
},
|
|
2663
2670
|
{
|
|
2664
2671
|
"id": "prowler.aws.resourceexplorer2_indexes_found",
|
|
2665
2672
|
"title": "Resource Explorer indexes exist",
|
|
2666
|
-
"scope": "Prowler 5.
|
|
2673
|
+
"scope": "Prowler 5.47.0 check resourceexplorer2_indexes_found (AWS resourceexplorer2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2667
2674
|
"evidenceType": "Configuration",
|
|
2668
2675
|
"severity": "low"
|
|
2669
2676
|
},
|
|
2670
2677
|
{
|
|
2671
2678
|
"id": "prowler.aws.rolesanywhere_profile_restricts_session_permissions",
|
|
2672
2679
|
"title": "IAM Roles Anywhere profiles scope down the vended session permissions",
|
|
2673
|
-
"scope": "Prowler 5.
|
|
2680
|
+
"scope": "Prowler 5.47.0 check rolesanywhere_profile_restricts_session_permissions (AWS rolesanywhere, resource type AwsRolesAnywhereProfile): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2674
2681
|
"evidenceType": "Configuration",
|
|
2675
2682
|
"severity": "medium"
|
|
2676
2683
|
},
|
|
2677
2684
|
{
|
|
2678
2685
|
"id": "prowler.aws.route53_dangling_ip_subdomain_takeover",
|
|
2679
2686
|
"title": "Route53 record does not point to a dangling AWS resource",
|
|
2680
|
-
"scope": "Prowler 5.
|
|
2687
|
+
"scope": "Prowler 5.47.0 check route53_dangling_ip_subdomain_takeover (AWS route53, resource type AwsRoute53HostedZone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2681
2688
|
"evidenceType": "Configuration",
|
|
2682
2689
|
"severity": "high"
|
|
2683
2690
|
},
|
|
2684
2691
|
{
|
|
2685
2692
|
"id": "prowler.aws.route53_public_hosted_zones_cloudwatch_logging_enabled",
|
|
2686
2693
|
"title": "Route53 public hosted zone has query logging enabled to a CloudWatch Logs log group",
|
|
2687
|
-
"scope": "Prowler 5.
|
|
2694
|
+
"scope": "Prowler 5.47.0 check route53_public_hosted_zones_cloudwatch_logging_enabled (AWS route53, resource type AwsRoute53HostedZone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2688
2695
|
"evidenceType": "Configuration",
|
|
2689
2696
|
"severity": "medium"
|
|
2690
2697
|
},
|
|
2691
2698
|
{
|
|
2692
2699
|
"id": "prowler.aws.s3_access_point_public_access_block",
|
|
2693
2700
|
"title": "S3 access point has all Block Public Access settings enabled",
|
|
2694
|
-
"scope": "Prowler 5.
|
|
2701
|
+
"scope": "Prowler 5.47.0 check s3_access_point_public_access_block (AWS s3, resource type AwsS3AccessPoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2695
2702
|
"evidenceType": "Configuration",
|
|
2696
2703
|
"severity": "critical"
|
|
2697
2704
|
},
|
|
2698
2705
|
{
|
|
2699
2706
|
"id": "prowler.aws.s3_account_level_public_access_blocks",
|
|
2700
2707
|
"title": "S3 account-level Block Public Access ignores public ACLs and restricts public buckets",
|
|
2701
|
-
"scope": "Prowler 5.
|
|
2708
|
+
"scope": "Prowler 5.47.0 check s3_account_level_public_access_blocks (AWS s3, resource type AwsS3AccountPublicAccessBlock): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2702
2709
|
"evidenceType": "Configuration",
|
|
2703
2710
|
"severity": "high"
|
|
2704
2711
|
},
|
|
2705
2712
|
{
|
|
2706
2713
|
"id": "prowler.aws.s3_bucket_acl_prohibited",
|
|
2707
2714
|
"title": "S3 bucket has bucket ACLs disabled",
|
|
2708
|
-
"scope": "Prowler 5.
|
|
2715
|
+
"scope": "Prowler 5.47.0 check s3_bucket_acl_prohibited (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2709
2716
|
"evidenceType": "Configuration",
|
|
2710
2717
|
"severity": "medium"
|
|
2711
2718
|
},
|
|
2712
2719
|
{
|
|
2713
2720
|
"id": "prowler.aws.s3_bucket_cross_account_access",
|
|
2714
2721
|
"title": "S3 bucket policy does not allow cross-account access",
|
|
2715
|
-
"scope": "Prowler 5.
|
|
2722
|
+
"scope": "Prowler 5.47.0 check s3_bucket_cross_account_access (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2716
2723
|
"evidenceType": "Configuration",
|
|
2717
2724
|
"severity": "high"
|
|
2718
2725
|
},
|
|
2719
2726
|
{
|
|
2720
2727
|
"id": "prowler.aws.s3_bucket_cross_region_replication",
|
|
2721
2728
|
"title": "S3 bucket has cross-region replication configured to a bucket in a different region",
|
|
2722
|
-
"scope": "Prowler 5.
|
|
2729
|
+
"scope": "Prowler 5.47.0 check s3_bucket_cross_region_replication (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2723
2730
|
"evidenceType": "Configuration",
|
|
2724
2731
|
"severity": "low"
|
|
2725
2732
|
},
|
|
2726
2733
|
{
|
|
2727
2734
|
"id": "prowler.aws.s3_bucket_default_encryption",
|
|
2728
2735
|
"title": "[DEPRECATED] S3 bucket has default server-side encryption (SSE) enabled",
|
|
2729
|
-
"scope": "Prowler 5.
|
|
2736
|
+
"scope": "Prowler 5.47.0 check s3_bucket_default_encryption (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2730
2737
|
"evidenceType": "Configuration",
|
|
2731
2738
|
"severity": "medium"
|
|
2732
2739
|
},
|
|
2733
2740
|
{
|
|
2734
2741
|
"id": "prowler.aws.s3_bucket_kms_encryption",
|
|
2735
2742
|
"title": "S3 bucket has server-side encryption with AWS KMS",
|
|
2736
|
-
"scope": "Prowler 5.
|
|
2743
|
+
"scope": "Prowler 5.47.0 check s3_bucket_kms_encryption (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2737
2744
|
"evidenceType": "Configuration",
|
|
2738
2745
|
"severity": "medium"
|
|
2739
2746
|
},
|
|
2740
2747
|
{
|
|
2741
2748
|
"id": "prowler.aws.s3_bucket_level_public_access_block",
|
|
2742
2749
|
"title": "S3 bucket has Block Public Access with IgnorePublicAcls and RestrictPublicBuckets enabled at bucket or account level",
|
|
2743
|
-
"scope": "Prowler 5.
|
|
2750
|
+
"scope": "Prowler 5.47.0 check s3_bucket_level_public_access_block (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2744
2751
|
"evidenceType": "Configuration",
|
|
2745
2752
|
"severity": "high"
|
|
2746
2753
|
},
|
|
2747
2754
|
{
|
|
2748
2755
|
"id": "prowler.aws.s3_bucket_no_mfa_delete",
|
|
2749
2756
|
"title": "S3 bucket has MFA Delete enabled",
|
|
2750
|
-
"scope": "Prowler 5.
|
|
2757
|
+
"scope": "Prowler 5.47.0 check s3_bucket_no_mfa_delete (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2751
2758
|
"evidenceType": "Configuration",
|
|
2752
2759
|
"severity": "medium"
|
|
2753
2760
|
},
|
|
2754
2761
|
{
|
|
2755
2762
|
"id": "prowler.aws.s3_bucket_object_lock",
|
|
2756
2763
|
"title": "S3 bucket has Object Lock enabled",
|
|
2757
|
-
"scope": "Prowler 5.
|
|
2764
|
+
"scope": "Prowler 5.47.0 check s3_bucket_object_lock (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2758
2765
|
"evidenceType": "Configuration",
|
|
2759
2766
|
"severity": "low"
|
|
2760
2767
|
},
|
|
2761
2768
|
{
|
|
2762
2769
|
"id": "prowler.aws.s3_bucket_object_public",
|
|
2763
2770
|
"title": "Spot-check S3 bucket objects for public ACLs",
|
|
2764
|
-
"scope": "Prowler 5.
|
|
2771
|
+
"scope": "Prowler 5.47.0 check s3_bucket_object_public (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2765
2772
|
"evidenceType": "Configuration",
|
|
2766
2773
|
"severity": "low"
|
|
2767
2774
|
},
|
|
2768
2775
|
{
|
|
2769
2776
|
"id": "prowler.aws.s3_bucket_object_versioning",
|
|
2770
2777
|
"title": "S3 bucket has object versioning enabled",
|
|
2771
|
-
"scope": "Prowler 5.
|
|
2778
|
+
"scope": "Prowler 5.47.0 check s3_bucket_object_versioning (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2772
2779
|
"evidenceType": "Configuration",
|
|
2773
2780
|
"severity": "medium"
|
|
2774
2781
|
},
|
|
2775
2782
|
{
|
|
2776
2783
|
"id": "prowler.aws.s3_bucket_policy_public_write_access",
|
|
2777
2784
|
"title": "S3 bucket policy does not allow public write access",
|
|
2778
|
-
"scope": "Prowler 5.
|
|
2785
|
+
"scope": "Prowler 5.47.0 check s3_bucket_policy_public_write_access (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2779
2786
|
"evidenceType": "Configuration",
|
|
2780
2787
|
"severity": "critical"
|
|
2781
2788
|
},
|
|
2782
2789
|
{
|
|
2783
2790
|
"id": "prowler.aws.s3_bucket_public_access",
|
|
2784
2791
|
"title": "S3 bucket is not publicly accessible to Everyone or Authenticated Users",
|
|
2785
|
-
"scope": "Prowler 5.
|
|
2792
|
+
"scope": "Prowler 5.47.0 check s3_bucket_public_access (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2786
2793
|
"evidenceType": "Configuration",
|
|
2787
2794
|
"severity": "critical"
|
|
2788
2795
|
},
|
|
2789
2796
|
{
|
|
2790
2797
|
"id": "prowler.aws.s3_bucket_public_list_acl",
|
|
2791
2798
|
"title": "S3 bucket is not publicly listable by Everyone or any authenticated AWS user",
|
|
2792
|
-
"scope": "Prowler 5.
|
|
2799
|
+
"scope": "Prowler 5.47.0 check s3_bucket_public_list_acl (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2793
2800
|
"evidenceType": "Configuration",
|
|
2794
2801
|
"severity": "critical"
|
|
2795
2802
|
},
|
|
2796
2803
|
{
|
|
2797
2804
|
"id": "prowler.aws.s3_bucket_public_write_acl",
|
|
2798
2805
|
"title": "S3 bucket ACL does not grant write access to Everyone or any AWS customer",
|
|
2799
|
-
"scope": "Prowler 5.
|
|
2806
|
+
"scope": "Prowler 5.47.0 check s3_bucket_public_write_acl (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2800
2807
|
"evidenceType": "Configuration",
|
|
2801
2808
|
"severity": "critical"
|
|
2802
2809
|
},
|
|
2803
2810
|
{
|
|
2804
2811
|
"id": "prowler.aws.s3_bucket_secure_transport_policy",
|
|
2805
2812
|
"title": "S3 bucket policy denies requests over insecure transport",
|
|
2806
|
-
"scope": "Prowler 5.
|
|
2813
|
+
"scope": "Prowler 5.47.0 check s3_bucket_secure_transport_policy (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2807
2814
|
"evidenceType": "Configuration",
|
|
2808
2815
|
"severity": "medium"
|
|
2809
2816
|
},
|
|
2810
2817
|
{
|
|
2811
2818
|
"id": "prowler.aws.s3_bucket_server_access_logging_enabled",
|
|
2812
2819
|
"title": "S3 bucket has server access logging enabled",
|
|
2813
|
-
"scope": "Prowler 5.
|
|
2820
|
+
"scope": "Prowler 5.47.0 check s3_bucket_server_access_logging_enabled (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2814
2821
|
"evidenceType": "Configuration",
|
|
2815
2822
|
"severity": "medium"
|
|
2816
2823
|
},
|
|
2817
2824
|
{
|
|
2818
2825
|
"id": "prowler.aws.s3_bucket_shadow_resource_vulnerability",
|
|
2819
2826
|
"title": "S3 bucket is not a known shadow resource owned by another account",
|
|
2820
|
-
"scope": "Prowler 5.
|
|
2827
|
+
"scope": "Prowler 5.47.0 check s3_bucket_shadow_resource_vulnerability (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2821
2828
|
"evidenceType": "Configuration",
|
|
2822
2829
|
"severity": "high"
|
|
2823
2830
|
},
|
|
2824
2831
|
{
|
|
2825
2832
|
"id": "prowler.aws.s3_multi_region_access_point_public_access_block",
|
|
2826
2833
|
"title": "S3 Multi-Region Access Point has all Block Public Access settings enabled",
|
|
2827
|
-
"scope": "Prowler 5.
|
|
2834
|
+
"scope": "Prowler 5.47.0 check s3_multi_region_access_point_public_access_block (AWS s3, resource type AwsS3AccessPoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2828
2835
|
"evidenceType": "Configuration",
|
|
2829
2836
|
"severity": "high"
|
|
2830
2837
|
},
|
|
2831
2838
|
{
|
|
2832
2839
|
"id": "prowler.aws.sagemaker_endpoint_config_kms_encryption_enabled",
|
|
2833
2840
|
"title": "SageMaker endpoint configuration is encrypted with a KMS key",
|
|
2834
|
-
"scope": "Prowler 5.
|
|
2841
|
+
"scope": "Prowler 5.47.0 check sagemaker_endpoint_config_kms_encryption_enabled (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2835
2842
|
"evidenceType": "Configuration",
|
|
2836
2843
|
"severity": "medium"
|
|
2837
2844
|
},
|
|
2838
2845
|
{
|
|
2839
2846
|
"id": "prowler.aws.sagemaker_endpoint_config_prod_variant_instances",
|
|
2840
2847
|
"title": "SageMaker endpoint configuration has all production variants with at least two initial instances",
|
|
2841
|
-
"scope": "Prowler 5.
|
|
2848
|
+
"scope": "Prowler 5.47.0 check sagemaker_endpoint_config_prod_variant_instances (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2842
2849
|
"evidenceType": "Configuration",
|
|
2843
2850
|
"severity": "medium"
|
|
2844
2851
|
},
|
|
2845
2852
|
{
|
|
2846
2853
|
"id": "prowler.aws.sagemaker_models_network_isolation_enabled",
|
|
2847
2854
|
"title": "Amazon SageMaker model has network isolation enabled",
|
|
2848
|
-
"scope": "Prowler 5.
|
|
2855
|
+
"scope": "Prowler 5.47.0 check sagemaker_models_network_isolation_enabled (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2849
2856
|
"evidenceType": "Configuration",
|
|
2850
2857
|
"severity": "high"
|
|
2851
2858
|
},
|
|
2852
2859
|
{
|
|
2853
2860
|
"id": "prowler.aws.sagemaker_notebook_instance_encryption_enabled",
|
|
2854
2861
|
"title": "SageMaker notebook instance is encrypted with a KMS key",
|
|
2855
|
-
"scope": "Prowler 5.
|
|
2862
|
+
"scope": "Prowler 5.47.0 check sagemaker_notebook_instance_encryption_enabled (AWS sagemaker, resource type AwsSageMakerNotebookInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2856
2863
|
"evidenceType": "Configuration",
|
|
2857
2864
|
"severity": "high"
|
|
2858
2865
|
},
|
|
2859
2866
|
{
|
|
2860
2867
|
"id": "prowler.aws.sagemaker_notebook_instance_no_secrets",
|
|
2861
2868
|
"title": "SageMaker notebook instance lifecycle configuration contains no hardcoded secrets",
|
|
2862
|
-
"scope": "Prowler 5.
|
|
2869
|
+
"scope": "Prowler 5.47.0 check sagemaker_notebook_instance_no_secrets (AWS sagemaker, resource type AwsSageMakerNotebookInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2863
2870
|
"evidenceType": "Configuration",
|
|
2864
2871
|
"severity": "high"
|
|
2865
2872
|
},
|
|
2866
2873
|
{
|
|
2867
2874
|
"id": "prowler.aws.sagemaker_notebook_instance_root_access_disabled",
|
|
2868
2875
|
"title": "Amazon SageMaker notebook instance has root access disabled",
|
|
2869
|
-
"scope": "Prowler 5.
|
|
2876
|
+
"scope": "Prowler 5.47.0 check sagemaker_notebook_instance_root_access_disabled (AWS sagemaker, resource type AwsSageMakerNotebookInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2870
2877
|
"evidenceType": "Configuration",
|
|
2871
2878
|
"severity": "medium"
|
|
2872
2879
|
},
|
|
2873
2880
|
{
|
|
2874
2881
|
"id": "prowler.aws.sagemaker_notebook_instance_without_direct_internet_access_configured",
|
|
2875
2882
|
"title": "Amazon SageMaker notebook instance has direct internet access disabled",
|
|
2876
|
-
"scope": "Prowler 5.
|
|
2883
|
+
"scope": "Prowler 5.47.0 check sagemaker_notebook_instance_without_direct_internet_access_configured (AWS sagemaker, resource type AwsSageMakerNotebookInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2877
2884
|
"evidenceType": "Configuration",
|
|
2878
2885
|
"severity": "high"
|
|
2879
2886
|
},
|
|
2880
2887
|
{
|
|
2881
2888
|
"id": "prowler.aws.sagemaker_training_jobs_intercontainer_encryption_enabled",
|
|
2882
2889
|
"title": "Amazon SageMaker training job has inter-container traffic encryption enabled",
|
|
2883
|
-
"scope": "Prowler 5.
|
|
2890
|
+
"scope": "Prowler 5.47.0 check sagemaker_training_jobs_intercontainer_encryption_enabled (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2884
2891
|
"evidenceType": "Configuration",
|
|
2885
2892
|
"severity": "medium"
|
|
2886
2893
|
},
|
|
2887
2894
|
{
|
|
2888
2895
|
"id": "prowler.aws.sagemaker_training_jobs_network_isolation_enabled",
|
|
2889
2896
|
"title": "Amazon SageMaker training job has network isolation enabled",
|
|
2890
|
-
"scope": "Prowler 5.
|
|
2897
|
+
"scope": "Prowler 5.47.0 check sagemaker_training_jobs_network_isolation_enabled (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2891
2898
|
"evidenceType": "Configuration",
|
|
2892
2899
|
"severity": "high"
|
|
2893
2900
|
},
|
|
2894
2901
|
{
|
|
2895
2902
|
"id": "prowler.aws.sagemaker_training_jobs_volume_and_output_encryption_enabled",
|
|
2896
2903
|
"title": "Amazon SageMaker training job volume has KMS encryption enabled",
|
|
2897
|
-
"scope": "Prowler 5.
|
|
2904
|
+
"scope": "Prowler 5.47.0 check sagemaker_training_jobs_volume_and_output_encryption_enabled (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2898
2905
|
"evidenceType": "Configuration",
|
|
2899
2906
|
"severity": "high"
|
|
2900
2907
|
},
|
|
2901
2908
|
{
|
|
2902
2909
|
"id": "prowler.aws.secretsmanager_automatic_rotation_enabled",
|
|
2903
2910
|
"title": "Secrets Manager secret has rotation enabled",
|
|
2904
|
-
"scope": "Prowler 5.
|
|
2911
|
+
"scope": "Prowler 5.47.0 check secretsmanager_automatic_rotation_enabled (AWS secretsmanager, resource type AwsSecretsManagerSecret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2905
2912
|
"evidenceType": "Configuration",
|
|
2906
2913
|
"severity": "high"
|
|
2907
2914
|
},
|
|
2908
2915
|
{
|
|
2909
2916
|
"id": "prowler.aws.secretsmanager_has_restrictive_resource_policy",
|
|
2910
2917
|
"title": "Secrets Manager secret has a restrictive resource-based policy",
|
|
2911
|
-
"scope": "Prowler 5.
|
|
2918
|
+
"scope": "Prowler 5.47.0 check secretsmanager_has_restrictive_resource_policy (AWS secretsmanager, resource type AwsSecretsManagerSecret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2912
2919
|
"evidenceType": "Configuration",
|
|
2913
2920
|
"severity": "high"
|
|
2914
2921
|
},
|
|
2915
2922
|
{
|
|
2916
2923
|
"id": "prowler.aws.secretsmanager_not_publicly_accessible",
|
|
2917
2924
|
"title": "Secrets Manager secret resource policy does not allow public access",
|
|
2918
|
-
"scope": "Prowler 5.
|
|
2925
|
+
"scope": "Prowler 5.47.0 check secretsmanager_not_publicly_accessible (AWS secretsmanager, resource type AwsSecretsManagerSecret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2919
2926
|
"evidenceType": "Configuration",
|
|
2920
2927
|
"severity": "high"
|
|
2921
2928
|
},
|
|
2922
2929
|
{
|
|
2923
2930
|
"id": "prowler.aws.secretsmanager_secret_rotated_periodically",
|
|
2924
2931
|
"title": "AWS Secrets Manager secret is rotated within the configured maximum number of days",
|
|
2925
|
-
"scope": "Prowler 5.
|
|
2932
|
+
"scope": "Prowler 5.47.0 check secretsmanager_secret_rotated_periodically (AWS secretsmanager, resource type AwsSecretsManagerSecret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2926
2933
|
"evidenceType": "Configuration",
|
|
2927
2934
|
"severity": "medium"
|
|
2928
2935
|
},
|
|
2929
2936
|
{
|
|
2930
2937
|
"id": "prowler.aws.secretsmanager_secret_unused",
|
|
2931
2938
|
"title": "Secrets Manager secret has been accessed within the last 90 days",
|
|
2932
|
-
"scope": "Prowler 5.
|
|
2939
|
+
"scope": "Prowler 5.47.0 check secretsmanager_secret_unused (AWS secretsmanager, resource type AwsSecretsManagerSecret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2933
2940
|
"evidenceType": "Configuration",
|
|
2934
2941
|
"severity": "medium"
|
|
2935
2942
|
},
|
|
2936
2943
|
{
|
|
2937
2944
|
"id": "prowler.aws.securityhub_enabled",
|
|
2938
2945
|
"title": "Security Hub is enabled with standards or integrations configured",
|
|
2939
|
-
"scope": "Prowler 5.
|
|
2946
|
+
"scope": "Prowler 5.47.0 check securityhub_enabled (AWS securityhub, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2940
2947
|
"evidenceType": "Configuration",
|
|
2941
2948
|
"severity": "high"
|
|
2942
2949
|
},
|
|
2943
2950
|
{
|
|
2944
2951
|
"id": "prowler.aws.ses_identity_dkim_enabled",
|
|
2945
2952
|
"title": "SES identity has DKIM signing enabled",
|
|
2946
|
-
"scope": "Prowler 5.
|
|
2953
|
+
"scope": "Prowler 5.47.0 check ses_identity_dkim_enabled (AWS ses, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2947
2954
|
"evidenceType": "Configuration",
|
|
2948
2955
|
"severity": "medium"
|
|
2949
2956
|
},
|
|
2950
2957
|
{
|
|
2951
2958
|
"id": "prowler.aws.shield_advanced_protection_in_associated_elastic_ips",
|
|
2952
2959
|
"title": "Elastic IP address is protected by AWS Shield Advanced",
|
|
2953
|
-
"scope": "Prowler 5.
|
|
2960
|
+
"scope": "Prowler 5.47.0 check shield_advanced_protection_in_associated_elastic_ips (AWS shield, resource type AwsEc2Eip): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2954
2961
|
"evidenceType": "Configuration",
|
|
2955
2962
|
"severity": "medium"
|
|
2956
2963
|
},
|
|
2957
2964
|
{
|
|
2958
2965
|
"id": "prowler.aws.shield_advanced_protection_in_classic_load_balancers",
|
|
2959
2966
|
"title": "Classic Load Balancer is protected by AWS Shield Advanced",
|
|
2960
|
-
"scope": "Prowler 5.
|
|
2967
|
+
"scope": "Prowler 5.47.0 check shield_advanced_protection_in_classic_load_balancers (AWS shield, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2961
2968
|
"evidenceType": "Configuration",
|
|
2962
2969
|
"severity": "medium"
|
|
2963
2970
|
},
|
|
2964
2971
|
{
|
|
2965
2972
|
"id": "prowler.aws.shield_advanced_protection_in_cloudfront_distributions",
|
|
2966
2973
|
"title": "CloudFront distribution is protected by AWS Shield Advanced",
|
|
2967
|
-
"scope": "Prowler 5.
|
|
2974
|
+
"scope": "Prowler 5.47.0 check shield_advanced_protection_in_cloudfront_distributions (AWS shield, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2968
2975
|
"evidenceType": "Configuration",
|
|
2969
2976
|
"severity": "medium"
|
|
2970
2977
|
},
|
|
2971
2978
|
{
|
|
2972
2979
|
"id": "prowler.aws.shield_advanced_protection_in_global_accelerators",
|
|
2973
2980
|
"title": "Global Accelerator accelerator is protected by AWS Shield Advanced",
|
|
2974
|
-
"scope": "Prowler 5.
|
|
2981
|
+
"scope": "Prowler 5.47.0 check shield_advanced_protection_in_global_accelerators (AWS shield, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2975
2982
|
"evidenceType": "Configuration",
|
|
2976
2983
|
"severity": "medium"
|
|
2977
2984
|
},
|
|
2978
2985
|
{
|
|
2979
2986
|
"id": "prowler.aws.shield_advanced_protection_in_internet_facing_load_balancers",
|
|
2980
2987
|
"title": "Internet-facing Application Load Balancer is protected by AWS Shield Advanced",
|
|
2981
|
-
"scope": "Prowler 5.
|
|
2988
|
+
"scope": "Prowler 5.47.0 check shield_advanced_protection_in_internet_facing_load_balancers (AWS shield, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2982
2989
|
"evidenceType": "Configuration",
|
|
2983
2990
|
"severity": "medium"
|
|
2984
2991
|
},
|
|
2985
2992
|
{
|
|
2986
2993
|
"id": "prowler.aws.shield_advanced_protection_in_route53_hosted_zones",
|
|
2987
2994
|
"title": "Route53 hosted zone is protected by AWS Shield Advanced",
|
|
2988
|
-
"scope": "Prowler 5.
|
|
2995
|
+
"scope": "Prowler 5.47.0 check shield_advanced_protection_in_route53_hosted_zones (AWS shield, resource type AwsRoute53HostedZone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2989
2996
|
"evidenceType": "Configuration",
|
|
2990
2997
|
"severity": "medium"
|
|
2991
2998
|
},
|
|
2992
2999
|
{
|
|
2993
3000
|
"id": "prowler.aws.sns_subscription_not_using_http_endpoints",
|
|
2994
3001
|
"title": "SNS subscription uses an HTTPS endpoint",
|
|
2995
|
-
"scope": "Prowler 5.
|
|
3002
|
+
"scope": "Prowler 5.47.0 check sns_subscription_not_using_http_endpoints (AWS sns, resource type AwsSnsTopic): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
2996
3003
|
"evidenceType": "Configuration",
|
|
2997
3004
|
"severity": "high"
|
|
2998
3005
|
},
|
|
2999
3006
|
{
|
|
3000
3007
|
"id": "prowler.aws.sns_topics_kms_encryption_at_rest_enabled",
|
|
3001
3008
|
"title": "SNS topic is encrypted at rest with KMS",
|
|
3002
|
-
"scope": "Prowler 5.
|
|
3009
|
+
"scope": "Prowler 5.47.0 check sns_topics_kms_encryption_at_rest_enabled (AWS sns, resource type AwsSnsTopic): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3003
3010
|
"evidenceType": "Configuration",
|
|
3004
3011
|
"severity": "high"
|
|
3005
3012
|
},
|
|
3006
3013
|
{
|
|
3007
3014
|
"id": "prowler.aws.sns_topics_not_publicly_accessible",
|
|
3008
3015
|
"title": "SNS topic is not publicly accessible",
|
|
3009
|
-
"scope": "Prowler 5.
|
|
3016
|
+
"scope": "Prowler 5.47.0 check sns_topics_not_publicly_accessible (AWS sns, resource type AwsSnsTopic): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3010
3017
|
"evidenceType": "Configuration",
|
|
3011
3018
|
"severity": "high"
|
|
3012
3019
|
},
|
|
3013
3020
|
{
|
|
3014
3021
|
"id": "prowler.aws.sqs_queues_not_publicly_accessible",
|
|
3015
3022
|
"title": "SQS queue policy does not allow public access",
|
|
3016
|
-
"scope": "Prowler 5.
|
|
3023
|
+
"scope": "Prowler 5.47.0 check sqs_queues_not_publicly_accessible (AWS sqs, resource type AwsSqsQueue): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3017
3024
|
"evidenceType": "Configuration",
|
|
3018
3025
|
"severity": "critical"
|
|
3019
3026
|
},
|
|
3020
3027
|
{
|
|
3021
3028
|
"id": "prowler.aws.sqs_queues_server_side_encryption_enabled",
|
|
3022
3029
|
"title": "SQS queue has server-side encryption enabled",
|
|
3023
|
-
"scope": "Prowler 5.
|
|
3030
|
+
"scope": "Prowler 5.47.0 check sqs_queues_server_side_encryption_enabled (AWS sqs, resource type AwsSqsQueue): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3024
3031
|
"evidenceType": "Configuration",
|
|
3025
3032
|
"severity": "medium"
|
|
3026
3033
|
},
|
|
3027
3034
|
{
|
|
3028
3035
|
"id": "prowler.aws.ssm_document_secrets",
|
|
3029
3036
|
"title": "SSM document contains no secrets",
|
|
3030
|
-
"scope": "Prowler 5.
|
|
3037
|
+
"scope": "Prowler 5.47.0 check ssm_document_secrets (AWS ssm, resource type AwsSsmPatchCompliance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3031
3038
|
"evidenceType": "Configuration",
|
|
3032
3039
|
"severity": "high"
|
|
3033
3040
|
},
|
|
3034
3041
|
{
|
|
3035
3042
|
"id": "prowler.aws.ssm_documents_set_as_public",
|
|
3036
3043
|
"title": "SSM document is not public and shared only with trusted AWS accounts",
|
|
3037
|
-
"scope": "Prowler 5.
|
|
3044
|
+
"scope": "Prowler 5.47.0 check ssm_documents_set_as_public (AWS ssm, resource type AwsSsmPatchCompliance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3038
3045
|
"evidenceType": "Configuration",
|
|
3039
3046
|
"severity": "high"
|
|
3040
3047
|
},
|
|
3041
3048
|
{
|
|
3042
3049
|
"id": "prowler.aws.ssm_managed_compliant_patching",
|
|
3043
3050
|
"title": "EC2 managed instance is compliant with Systems Manager patching requirements",
|
|
3044
|
-
"scope": "Prowler 5.
|
|
3051
|
+
"scope": "Prowler 5.47.0 check ssm_managed_compliant_patching (AWS ssm, resource type AwsSsmPatchCompliance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3045
3052
|
"evidenceType": "Configuration",
|
|
3046
3053
|
"severity": "high"
|
|
3047
3054
|
},
|
|
3048
3055
|
{
|
|
3049
3056
|
"id": "prowler.aws.stepfunctions_statemachine_encrypted_with_cmk",
|
|
3050
3057
|
"title": "Step Functions state machine is encrypted at rest with a customer-managed KMS key",
|
|
3051
|
-
"scope": "Prowler 5.
|
|
3058
|
+
"scope": "Prowler 5.47.0 check stepfunctions_statemachine_encrypted_with_cmk (AWS stepfunctions, resource type AwsStepFunctionStateMachine): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3052
3059
|
"evidenceType": "Configuration",
|
|
3053
3060
|
"severity": "medium"
|
|
3054
3061
|
},
|
|
3055
3062
|
{
|
|
3056
3063
|
"id": "prowler.aws.stepfunctions_statemachine_logging_enabled",
|
|
3057
3064
|
"title": "Step Functions state machine has logging enabled",
|
|
3058
|
-
"scope": "Prowler 5.
|
|
3065
|
+
"scope": "Prowler 5.47.0 check stepfunctions_statemachine_logging_enabled (AWS stepfunctions, resource type AwsStepFunctionStateMachine): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3059
3066
|
"evidenceType": "Configuration",
|
|
3060
3067
|
"severity": "medium"
|
|
3061
3068
|
},
|
|
3062
3069
|
{
|
|
3063
3070
|
"id": "prowler.aws.stepfunctions_statemachine_no_secrets_in_definition",
|
|
3064
3071
|
"title": "Step Functions state machine has no sensitive credentials in its definition",
|
|
3065
|
-
"scope": "Prowler 5.
|
|
3072
|
+
"scope": "Prowler 5.47.0 check stepfunctions_statemachine_no_secrets_in_definition (AWS stepfunctions, resource type AwsStepFunctionStateMachine): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3066
3073
|
"evidenceType": "Configuration",
|
|
3067
3074
|
"severity": "critical"
|
|
3068
3075
|
},
|
|
3069
3076
|
{
|
|
3070
3077
|
"id": "prowler.aws.storagegateway_fileshare_encryption_enabled",
|
|
3071
3078
|
"title": "Storage Gateway file share is encrypted with KMS CMK",
|
|
3072
|
-
"scope": "Prowler 5.
|
|
3079
|
+
"scope": "Prowler 5.47.0 check storagegateway_fileshare_encryption_enabled (AWS storagegateway, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3073
3080
|
"evidenceType": "Configuration",
|
|
3074
3081
|
"severity": "medium"
|
|
3075
3082
|
},
|
|
3076
3083
|
{
|
|
3077
3084
|
"id": "prowler.aws.storagegateway_gateway_fault_tolerant",
|
|
3078
3085
|
"title": "AWS Storage Gateway gateway is not hosted on EC2",
|
|
3079
|
-
"scope": "Prowler 5.
|
|
3086
|
+
"scope": "Prowler 5.47.0 check storagegateway_gateway_fault_tolerant (AWS storagegateway, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3080
3087
|
"evidenceType": "Configuration",
|
|
3081
3088
|
"severity": "medium"
|
|
3082
3089
|
},
|
|
3083
3090
|
{
|
|
3084
3091
|
"id": "prowler.aws.transfer_server_in_transit_encryption_enabled",
|
|
3085
3092
|
"title": "Transfer Family server has encryption in transit enabled",
|
|
3086
|
-
"scope": "Prowler 5.
|
|
3093
|
+
"scope": "Prowler 5.47.0 check transfer_server_in_transit_encryption_enabled (AWS transfer, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3087
3094
|
"evidenceType": "Configuration",
|
|
3088
3095
|
"severity": "high"
|
|
3089
3096
|
},
|
|
3090
3097
|
{
|
|
3091
3098
|
"id": "prowler.aws.transfer_server_pqc_ssh_kex_enabled",
|
|
3092
3099
|
"title": "AWS Transfer Family server uses a post-quantum hybrid SSH key exchange security policy",
|
|
3093
|
-
"scope": "Prowler 5.
|
|
3100
|
+
"scope": "Prowler 5.47.0 check transfer_server_pqc_ssh_kex_enabled (AWS transfer, resource type AwsTransferServer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3094
3101
|
"evidenceType": "Configuration",
|
|
3095
3102
|
"severity": "low"
|
|
3096
3103
|
},
|
|
3097
3104
|
{
|
|
3098
3105
|
"id": "prowler.aws.trustedadvisor_errors_and_warnings",
|
|
3099
3106
|
"title": "Trusted Advisor check has no errors or warnings",
|
|
3100
|
-
"scope": "Prowler 5.
|
|
3107
|
+
"scope": "Prowler 5.47.0 check trustedadvisor_errors_and_warnings (AWS trustedadvisor, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3101
3108
|
"evidenceType": "Configuration",
|
|
3102
3109
|
"severity": "medium"
|
|
3103
3110
|
},
|
|
3104
3111
|
{
|
|
3105
3112
|
"id": "prowler.aws.vpc_endpoint_connections_trust_boundaries",
|
|
3106
3113
|
"title": "VPC endpoint policy allows access only from trusted AWS accounts",
|
|
3107
|
-
"scope": "Prowler 5.
|
|
3114
|
+
"scope": "Prowler 5.47.0 check vpc_endpoint_connections_trust_boundaries (AWS vpc, resource type AwsEc2VpcEndpointService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3108
3115
|
"evidenceType": "Configuration",
|
|
3109
3116
|
"severity": "high"
|
|
3110
3117
|
},
|
|
3111
3118
|
{
|
|
3112
3119
|
"id": "prowler.aws.vpc_endpoint_multi_az_enabled",
|
|
3113
3120
|
"title": "Amazon VPC interface endpoint has subnets in multiple Availability Zones",
|
|
3114
|
-
"scope": "Prowler 5.
|
|
3121
|
+
"scope": "Prowler 5.47.0 check vpc_endpoint_multi_az_enabled (AWS vpc, resource type AwsEc2VpcEndpointService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3115
3122
|
"evidenceType": "Configuration",
|
|
3116
3123
|
"severity": "medium"
|
|
3117
3124
|
},
|
|
3118
3125
|
{
|
|
3119
3126
|
"id": "prowler.aws.vpc_endpoint_services_allowed_principals_trust_boundaries",
|
|
3120
3127
|
"title": "VPC endpoint service allows only trusted principals or none",
|
|
3121
|
-
"scope": "Prowler 5.
|
|
3128
|
+
"scope": "Prowler 5.47.0 check vpc_endpoint_services_allowed_principals_trust_boundaries (AWS vpc, resource type AwsEc2VpcEndpointService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3122
3129
|
"evidenceType": "Configuration",
|
|
3123
3130
|
"severity": "high"
|
|
3124
3131
|
},
|
|
3125
3132
|
{
|
|
3126
3133
|
"id": "prowler.aws.vpc_flow_logs_enabled",
|
|
3127
3134
|
"title": "VPC flow logs are enabled",
|
|
3128
|
-
"scope": "Prowler 5.
|
|
3135
|
+
"scope": "Prowler 5.47.0 check vpc_flow_logs_enabled (AWS vpc, resource type AwsEc2Vpc): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3129
3136
|
"evidenceType": "Configuration",
|
|
3130
3137
|
"severity": "medium"
|
|
3131
3138
|
},
|
|
3132
3139
|
{
|
|
3133
3140
|
"id": "prowler.aws.vpc_peering_routing_tables_with_least_privilege",
|
|
3134
3141
|
"title": "VPC peering connection route tables do not include 0.0.0.0/0 or entire requester/accepter VPC CIDR routes",
|
|
3135
|
-
"scope": "Prowler 5.
|
|
3142
|
+
"scope": "Prowler 5.47.0 check vpc_peering_routing_tables_with_least_privilege (AWS vpc, resource type AwsEc2VpcPeeringConnection): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3136
3143
|
"evidenceType": "Configuration",
|
|
3137
3144
|
"severity": "medium"
|
|
3138
3145
|
},
|
|
3139
3146
|
{
|
|
3140
3147
|
"id": "prowler.aws.vpc_subnet_different_az",
|
|
3141
3148
|
"title": "VPC has subnets in more than one Availability Zone",
|
|
3142
|
-
"scope": "Prowler 5.
|
|
3149
|
+
"scope": "Prowler 5.47.0 check vpc_subnet_different_az (AWS vpc, resource type AwsEc2Subnet): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3143
3150
|
"evidenceType": "Configuration",
|
|
3144
3151
|
"severity": "medium"
|
|
3145
3152
|
},
|
|
3146
3153
|
{
|
|
3147
3154
|
"id": "prowler.aws.vpc_subnet_no_public_ip_by_default",
|
|
3148
3155
|
"title": "VPC subnet does not assign public IP addresses by default",
|
|
3149
|
-
"scope": "Prowler 5.
|
|
3156
|
+
"scope": "Prowler 5.47.0 check vpc_subnet_no_public_ip_by_default (AWS vpc, resource type AwsEc2Subnet): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3150
3157
|
"evidenceType": "Configuration",
|
|
3151
3158
|
"severity": "high"
|
|
3152
3159
|
},
|
|
3153
3160
|
{
|
|
3154
3161
|
"id": "prowler.aws.vpc_subnet_separate_private_public",
|
|
3155
3162
|
"title": "VPC has both public and private subnets",
|
|
3156
|
-
"scope": "Prowler 5.
|
|
3163
|
+
"scope": "Prowler 5.47.0 check vpc_subnet_separate_private_public (AWS vpc, resource type AwsEc2Subnet): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3157
3164
|
"evidenceType": "Configuration",
|
|
3158
3165
|
"severity": "medium"
|
|
3159
3166
|
},
|
|
3160
3167
|
{
|
|
3161
3168
|
"id": "prowler.aws.vpc_vpn_connection_tunnels_up",
|
|
3162
3169
|
"title": "AWS Site-to-Site VPN connection has both tunnels up",
|
|
3163
|
-
"scope": "Prowler 5.
|
|
3170
|
+
"scope": "Prowler 5.47.0 check vpc_vpn_connection_tunnels_up (AWS vpc, resource type AwsEc2ClientVpnEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3164
3171
|
"evidenceType": "Configuration",
|
|
3165
3172
|
"severity": "medium"
|
|
3166
3173
|
},
|
|
3167
3174
|
{
|
|
3168
3175
|
"id": "prowler.aws.waf_global_rule_with_conditions",
|
|
3169
3176
|
"title": "AWS WAF Classic Global rule has at least one condition",
|
|
3170
|
-
"scope": "Prowler 5.
|
|
3177
|
+
"scope": "Prowler 5.47.0 check waf_global_rule_with_conditions (AWS waf, resource type AwsWafRule): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3171
3178
|
"evidenceType": "Configuration",
|
|
3172
3179
|
"severity": "medium"
|
|
3173
3180
|
},
|
|
3174
3181
|
{
|
|
3175
3182
|
"id": "prowler.aws.waf_global_rulegroup_not_empty",
|
|
3176
3183
|
"title": "AWS WAF Classic global rule group has at least one rule",
|
|
3177
|
-
"scope": "Prowler 5.
|
|
3184
|
+
"scope": "Prowler 5.47.0 check waf_global_rulegroup_not_empty (AWS waf, resource type AwsWafRuleGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3178
3185
|
"evidenceType": "Configuration",
|
|
3179
3186
|
"severity": "high"
|
|
3180
3187
|
},
|
|
3181
3188
|
{
|
|
3182
3189
|
"id": "prowler.aws.waf_global_webacl_logging_enabled",
|
|
3183
3190
|
"title": "AWS WAF Classic Global Web ACL has logging enabled",
|
|
3184
|
-
"scope": "Prowler 5.
|
|
3191
|
+
"scope": "Prowler 5.47.0 check waf_global_webacl_logging_enabled (AWS waf, resource type AwsWafWebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3185
3192
|
"evidenceType": "Configuration",
|
|
3186
3193
|
"severity": "medium"
|
|
3187
3194
|
},
|
|
3188
3195
|
{
|
|
3189
3196
|
"id": "prowler.aws.waf_global_webacl_with_rules",
|
|
3190
3197
|
"title": "AWS WAF Classic global Web ACL has at least one rule or rule group",
|
|
3191
|
-
"scope": "Prowler 5.
|
|
3198
|
+
"scope": "Prowler 5.47.0 check waf_global_webacl_with_rules (AWS waf, resource type AwsWafWebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3192
3199
|
"evidenceType": "Configuration",
|
|
3193
3200
|
"severity": "medium"
|
|
3194
3201
|
},
|
|
3195
3202
|
{
|
|
3196
3203
|
"id": "prowler.aws.waf_regional_rule_with_conditions",
|
|
3197
3204
|
"title": "AWS WAF Classic Regional rule has at least one condition",
|
|
3198
|
-
"scope": "Prowler 5.
|
|
3205
|
+
"scope": "Prowler 5.47.0 check waf_regional_rule_with_conditions (AWS waf, resource type AwsWafRegionalRule): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3199
3206
|
"evidenceType": "Configuration",
|
|
3200
3207
|
"severity": "medium"
|
|
3201
3208
|
},
|
|
3202
3209
|
{
|
|
3203
3210
|
"id": "prowler.aws.waf_regional_rulegroup_not_empty",
|
|
3204
3211
|
"title": "AWS WAF Classic Regional rule group has at least one rule",
|
|
3205
|
-
"scope": "Prowler 5.
|
|
3212
|
+
"scope": "Prowler 5.47.0 check waf_regional_rulegroup_not_empty (AWS waf, resource type AwsWafRegionalRuleGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3206
3213
|
"evidenceType": "Configuration",
|
|
3207
3214
|
"severity": "medium"
|
|
3208
3215
|
},
|
|
3209
3216
|
{
|
|
3210
3217
|
"id": "prowler.aws.waf_regional_webacl_logging_enabled",
|
|
3211
3218
|
"title": "AWS WAF Classic Regional Web ACL has logging enabled",
|
|
3212
|
-
"scope": "Prowler 5.
|
|
3219
|
+
"scope": "Prowler 5.47.0 check waf_regional_webacl_logging_enabled (AWS waf, resource type AwsWafRegionalWebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3213
3220
|
"evidenceType": "Configuration",
|
|
3214
3221
|
"severity": "medium"
|
|
3215
3222
|
},
|
|
3216
3223
|
{
|
|
3217
3224
|
"id": "prowler.aws.waf_regional_webacl_with_rules",
|
|
3218
3225
|
"title": "AWS WAF Classic Regional Web ACL has at least one rule or rule group",
|
|
3219
|
-
"scope": "Prowler 5.
|
|
3226
|
+
"scope": "Prowler 5.47.0 check waf_regional_webacl_with_rules (AWS waf, resource type AwsWafRegionalWebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3220
3227
|
"evidenceType": "Configuration",
|
|
3221
3228
|
"severity": "medium"
|
|
3222
3229
|
},
|
|
3223
3230
|
{
|
|
3224
3231
|
"id": "prowler.aws.wafv2_webacl_logging_enabled",
|
|
3225
3232
|
"title": "AWS WAFv2 Web ACL has logging enabled",
|
|
3226
|
-
"scope": "Prowler 5.
|
|
3233
|
+
"scope": "Prowler 5.47.0 check wafv2_webacl_logging_enabled (AWS wafv2, resource type AwsWafv2WebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3234
|
+
"evidenceType": "Configuration",
|
|
3235
|
+
"severity": "medium"
|
|
3236
|
+
},
|
|
3237
|
+
{
|
|
3238
|
+
"id": "prowler.aws.wafv2_webacl_managed_rule_groups_enabled",
|
|
3239
|
+
"title": "WAFv2 Web ACL uses managed rule groups",
|
|
3240
|
+
"scope": "Prowler 5.47.0 check wafv2_webacl_managed_rule_groups_enabled (AWS wafv2, resource type AwsWafv2WebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3227
3241
|
"evidenceType": "Configuration",
|
|
3228
3242
|
"severity": "medium"
|
|
3229
3243
|
},
|
|
3230
3244
|
{
|
|
3231
3245
|
"id": "prowler.aws.wafv2_webacl_with_rules",
|
|
3232
3246
|
"title": "AWS WAFv2 Web ACL has at least one rule or rule group attached",
|
|
3233
|
-
"scope": "Prowler 5.
|
|
3247
|
+
"scope": "Prowler 5.47.0 check wafv2_webacl_with_rules (AWS wafv2, resource type AwsWafv2WebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3234
3248
|
"evidenceType": "Configuration",
|
|
3235
3249
|
"severity": "high"
|
|
3236
3250
|
},
|
|
3237
3251
|
{
|
|
3238
3252
|
"id": "prowler.aws.wellarchitected_workload_no_high_or_medium_risks",
|
|
3239
3253
|
"title": "AWS Well-Architected Tool workload has no high or medium risks",
|
|
3240
|
-
"scope": "Prowler 5.
|
|
3254
|
+
"scope": "Prowler 5.47.0 check wellarchitected_workload_no_high_or_medium_risks (AWS wellarchitected, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3241
3255
|
"evidenceType": "Configuration",
|
|
3242
3256
|
"severity": "medium"
|
|
3243
3257
|
},
|
|
3244
3258
|
{
|
|
3245
3259
|
"id": "prowler.aws.workspaces_volume_encryption_enabled",
|
|
3246
3260
|
"title": "Amazon WorkSpaces workspace root and user volumes are encrypted",
|
|
3247
|
-
"scope": "Prowler 5.
|
|
3261
|
+
"scope": "Prowler 5.47.0 check workspaces_volume_encryption_enabled (AWS workspaces, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
3248
3262
|
"evidenceType": "Configuration",
|
|
3249
3263
|
"severity": "high"
|
|
3250
3264
|
}
|