@sagentix-inc/evidence-collector 0.3.1 → 0.3.2

package/apps/sos-app/src/data/checks/prowler_aws.json

@@ -28,6 +28,34 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.account_maintain_current_contact_details",
+   "title": "AWS account contact information is current",
+   "scope": "Prowler 5.47.0 check account_maintain_current_contact_details (AWS account, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.account_maintain_different_contact_details_to_security_billing_and_operations",
+   "title": "AWS account has distinct Security, Billing, and Operations contact details, different from each other and from the root contact",
+   "scope": "Prowler 5.47.0 check account_maintain_different_contact_details_to_security_billing_and_operations (AWS account, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.account_security_contact_information_is_registered",
+   "title": "AWS account has security alternate contact registered",
+   "scope": "Prowler 5.47.0 check account_security_contact_information_is_registered (AWS account, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.account_security_questions_are_registered_in_the_aws_account",
+   "title": "[DEPRECATED] AWS root user has security challenge questions configured",
+   "scope": "Prowler 5.47.0 check account_security_questions_are_registered_in_the_aws_account (AWS account, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.acm_certificates_expiration_check",
    "title": "ACM certificate expires in more than the configured threshold of days",
@@ -35,6 +63,27 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.acm_certificates_transparency_logs_enabled",
+   "title": "ACM certificate is imported or has Certificate Transparency logging enabled",
+   "scope": "Prowler 5.47.0 check acm_certificates_transparency_logs_enabled (AWS acm, resource type AwsCertificateManagerCertificate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.acm_certificates_with_secure_key_algorithms",
+   "title": "ACM certificate uses a secure key algorithm",
+   "scope": "Prowler 5.47.0 check acm_certificates_with_secure_key_algorithms (AWS acm, resource type AwsCertificateManagerCertificate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.acmpca_certificate_authority_pqc_key_algorithm",
+   "title": "AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm",
+   "scope": "Prowler 5.47.0 check acmpca_certificate_authority_pqc_key_algorithm (AWS acmpca, resource type AwsAcmPcaCertificateAuthority): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.amplify_app_no_secrets_in_environment",
    "title": "Amplify app has no sensitive credentials in environment variables or build settings",
@@ -91,6 +140,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.apigateway_restapi_public_with_authorizer",
+   "title": "API Gateway REST API with a public endpoint has an authorizer configured",
+   "scope": "Prowler 5.47.0 check apigateway_restapi_public_with_authorizer (AWS apigateway, resource type AwsApiGatewayRestApi): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.apigateway_restapi_tracing_enabled",
+   "title": "API Gateway REST API stage has X-Ray tracing enabled",
+   "scope": "Prowler 5.47.0 check apigateway_restapi_tracing_enabled (AWS apigateway, resource type AwsApiGatewayStage): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.apigateway_restapi_waf_acl_attached",
    "title": "API Gateway stage has a WAF Web ACL attached",
@@ -119,6 +182,27 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.appstream_fleet_maximum_session_duration",
+   "title": "AppStream fleet maximum user session duration is less than 10 hours",
+   "scope": "Prowler 5.47.0 check appstream_fleet_maximum_session_duration (AWS appstream, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.appstream_fleet_session_disconnect_timeout",
+   "title": "AppStream fleet session disconnect timeout is 5 minutes or less",
+   "scope": "Prowler 5.47.0 check appstream_fleet_session_disconnect_timeout (AWS appstream, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.appstream_fleet_session_idle_disconnect_timeout",
+   "title": "AppStream fleet session idle disconnect timeout is 10 minutes or less",
+   "scope": "Prowler 5.47.0 check appstream_fleet_session_idle_disconnect_timeout (AWS appstream, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.appsync_field_level_logging_enabled",
    "title": "AWS AppSync API has field-level logging set to ALL or ERROR",
@@ -140,6 +224,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.athena_workgroup_enforce_configuration",
+   "title": "Athena workgroup enforces workgroup configuration and cannot be overridden by client-side settings",
+   "scope": "Prowler 5.47.0 check athena_workgroup_enforce_configuration (AWS athena, resource type AwsAthenaWorkGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.athena_workgroup_logging_enabled",
    "title": "Amazon Athena workgroup has CloudWatch logging enabled",
@@ -147,6 +238,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.autoscaling_find_secrets_ec2_launch_configuration",
+   "title": "[DEPRECATED] EC2 Auto Scaling launch configuration user data contains no secrets",
+   "scope": "Prowler 5.47.0 check autoscaling_find_secrets_ec2_launch_configuration (AWS autoscaling, resource type AwsAutoScalingLaunchConfiguration): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
   {
    "id": "prowler.aws.autoscaling_group_capacity_rebalance_enabled",
    "title": "Amazon EC2 Auto Scaling group has Capacity Rebalancing enabled",
@@ -168,6 +266,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.autoscaling_group_launch_configuration_requires_imdsv2",
+   "title": "Auto Scaling group enforces IMDSv2 or disables the instance metadata service",
+   "scope": "Prowler 5.47.0 check autoscaling_group_launch_configuration_requires_imdsv2 (AWS autoscaling, resource type AwsAutoScalingAutoScalingGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.autoscaling_group_multiple_az",
    "title": "Auto Scaling group uses multiple Availability Zones",
@@ -196,6 +301,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.awslambda_function_inside_vpc",
+   "title": "Lambda function is deployed inside a VPC",
+   "scope": "Prowler 5.47.0 check awslambda_function_inside_vpc (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled",
    "title": "Lambda function Invoke API calls are recorded by CloudTrail",
@@ -203,6 +315,13 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.awslambda_function_no_dead_letter_queue",
+   "title": "Lambda function has a Dead Letter Queue configured",
+   "scope": "Prowler 5.47.0 check awslambda_function_no_dead_letter_queue (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.awslambda_function_no_secrets_in_code",
    "title": "Lambda function code contains no hardcoded secrets",
@@ -224,6 +343,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.awslambda_function_url_cors_policy",
+   "title": "Lambda function URL CORS does not allow wildcard origins (*)",
+   "scope": "Prowler 5.47.0 check awslambda_function_url_cors_policy (AWS awslambda, resource type AwsLambdaFunction): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.awslambda_function_url_public",
    "title": "Lambda function URL is not publicly accessible",
@@ -301,6 +427,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.bedrock_agent_guardrail_enabled",
+   "title": "Amazon Bedrock agent uses a guardrail to protect agent sessions",
+   "scope": "Prowler 5.47.0 check bedrock_agent_guardrail_enabled (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.bedrock_agent_role_least_privilege",
    "title": "Amazon Bedrock agent execution role follows least privilege",
@@ -343,6 +476,41 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.bedrock_guardrail_contextual_grounding_filter_enabled",
+   "title": "Bedrock guardrail blocks ungrounded and irrelevant model responses",
+   "scope": "Prowler 5.47.0 check bedrock_guardrail_contextual_grounding_filter_enabled (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.bedrock_guardrail_prompt_attack_filter_enabled",
+   "title": "Amazon Bedrock guardrail has prompt attack filter strength set to HIGH",
+   "scope": "Prowler 5.47.0 check bedrock_guardrail_prompt_attack_filter_enabled (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.bedrock_guardrail_sensitive_information_filter_enabled",
+   "title": "Amazon Bedrock guardrail blocks or masks sensitive information",
+   "scope": "Prowler 5.47.0 check bedrock_guardrail_sensitive_information_filter_enabled (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.bedrock_guardrail_sensitive_information_filter_enforced",
+   "title": "Amazon Bedrock guardrail sensitive information filter acts on the output path",
+   "scope": "Prowler 5.47.0 check bedrock_guardrail_sensitive_information_filter_enforced (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.bedrock_guardrails_configured",
+   "title": "Bedrock has at least one guardrail configured in the audited region",
+   "scope": "Prowler 5.47.0 check bedrock_guardrails_configured (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.bedrock_knowledge_base_encrypted_with_cmk",
    "title": "Bedrock knowledge base data source is encrypted with a customer-managed KMS key",
@@ -357,6 +525,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.bedrock_model_invocation_logging_text_data_enabled",
+   "title": "Bedrock model invocation logging delivers prompt and response text.",
+   "scope": "Prowler 5.47.0 check bedrock_model_invocation_logging_text_data_enabled (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.bedrock_model_invocation_logs_encryption_enabled",
+   "title": "Amazon Bedrock model invocation logs are encrypted in the S3 bucket and KMS-encrypted in the CloudWatch log group",
+   "scope": "Prowler 5.47.0 check bedrock_model_invocation_logs_encryption_enabled (AWS bedrock, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.bedrock_prompt_encrypted_with_cmk",
    "title": "Amazon Bedrock prompt is encrypted at rest with a customer-managed KMS key",
@@ -364,6 +546,27 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.bedrock_prompt_management_exists",
+   "title": "Amazon Bedrock Prompt Management prompts exist in the region",
+   "scope": "Prowler 5.47.0 check bedrock_prompt_management_exists (AWS bedrock, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.bedrock_vpc_endpoints_configured",
+   "title": "VPC endpoints ensure private connectivity for all Bedrock APIs",
+   "scope": "Prowler 5.47.0 check bedrock_vpc_endpoints_configured (AWS bedrock, resource type AwsEc2VpcEndpointService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cloudformation_stack_cdktoolkit_bootstrap_version",
+   "title": "CDKToolkit CloudFormation stack has Bootstrap version 21 or higher",
+   "scope": "Prowler 5.47.0 check cloudformation_stack_cdktoolkit_bootstrap_version (AWS cloudformation, resource type AwsCloudFormationStack): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.cloudformation_stack_outputs_find_secrets",
    "title": "CloudFormation stack outputs do not contain secrets",
@@ -371,6 +574,27 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.cloudformation_stacks_termination_protection_enabled",
+   "title": "CloudFormation stack has termination protection enabled",
+   "scope": "Prowler 5.47.0 check cloudformation_stacks_termination_protection_enabled (AWS cloudformation, resource type AwsCloudFormationStack): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cloudfront_distributions_custom_ssl_certificate",
+   "title": "CloudFront distribution uses a custom SSL/TLS certificate",
+   "scope": "Prowler 5.47.0 check cloudfront_distributions_custom_ssl_certificate (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cloudfront_distributions_default_root_object",
+   "title": "CloudFront distribution has a default root object configured",
+   "scope": "Prowler 5.47.0 check cloudfront_distributions_default_root_object (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.cloudfront_distributions_field_level_encryption_enabled",
    "title": "CloudFront distribution has Field Level Encryption enabled",
@@ -378,6 +602,13 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.cloudfront_distributions_geo_restrictions_enabled",
+   "title": "CloudFront distribution has Geo restrictions enabled",
+   "scope": "Prowler 5.47.0 check cloudfront_distributions_geo_restrictions_enabled (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.cloudfront_distributions_https_enabled",
    "title": "CloudFront distribution has viewer protocol policy set to HTTPS only or redirect to HTTPS",
@@ -385,6 +616,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cloudfront_distributions_https_sni_enabled",
+   "title": "CloudFront distribution serves HTTPS requests using SNI",
+   "scope": "Prowler 5.47.0 check cloudfront_distributions_https_sni_enabled (AWS cloudfront, resource type AwsCloudFrontDistribution): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.cloudfront_distributions_logging_enabled",
    "title": "CloudFront distribution has logging enabled",
@@ -462,6 +700,13 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.cloudtrail_insights_exist",
+   "title": "CloudTrail trail has Insights enabled",
+   "scope": "Prowler 5.47.0 check cloudtrail_insights_exist (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.cloudtrail_kms_encryption_enabled",
    "title": "CloudTrail trail logs are encrypted at rest with a KMS key",
@@ -518,6 +763,41 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.cloudtrail_threat_detection_enumeration",
+   "title": "CloudTrail logs show no potential enumeration activity",
+   "scope": "Prowler 5.47.0 check cloudtrail_threat_detection_enumeration (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.cloudtrail_threat_detection_llm_jacking",
+   "title": "No potential LLM jacking activity detected in CloudTrail",
+   "scope": "Prowler 5.47.0 check cloudtrail_threat_detection_llm_jacking (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.cloudtrail_threat_detection_privilege_escalation",
+   "title": "No potential privilege escalation activity detected in CloudTrail",
+   "scope": "Prowler 5.47.0 check cloudtrail_threat_detection_privilege_escalation (AWS cloudtrail, resource type AwsCloudTrailTrail): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.cloudwatch_alarm_actions_alarm_state_configured",
+   "title": "CloudWatch metric alarm has actions configured for the ALARM state",
+   "scope": "Prowler 5.47.0 check cloudwatch_alarm_actions_alarm_state_configured (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.cloudwatch_alarm_actions_enabled",
+   "title": "CloudWatch metric alarm has actions enabled",
+   "scope": "Prowler 5.47.0 check cloudwatch_alarm_actions_enabled (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.cloudwatch_changes_to_network_acls_alarm_configured",
    "title": "CloudWatch log metric filter and alarm exist for Network ACL (NACL) change events",
@@ -553,6 +833,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cloudwatch_log_group_agentcore_data_protection_policy_enabled",
+   "title": "Bedrock AgentCore log groups have a CloudWatch Logs data protection policy activated",
+   "scope": "Prowler 5.47.0 check cloudwatch_log_group_agentcore_data_protection_policy_enabled (AWS cloudwatch, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.cloudwatch_log_group_kms_encryption_enabled",
    "title": "CloudWatch log group is encrypted with an AWS KMS key",
@@ -595,6 +882,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cloudwatch_log_metric_filter_authentication_failures",
+   "title": "Account has a CloudWatch Logs metric filter and alarm for AWS Management Console authentication failures",
+   "scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_authentication_failures (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.cloudwatch_log_metric_filter_aws_organizations_changes",
    "title": "CloudWatch Logs metric filter and alarm exist for AWS Organizations changes",
@@ -623,6 +917,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cloudwatch_log_metric_filter_root_usage",
+   "title": "Account has a CloudWatch Logs metric filter and alarm for root account usage",
+   "scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_root_usage (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.cloudwatch_log_metric_filter_security_group_changes",
    "title": "CloudWatch Logs metric filter and alarm exist for security group changes",
@@ -630,6 +931,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cloudwatch_log_metric_filter_sign_in_without_mfa",
+   "title": "CloudWatch log metric filter and alarm exist for Management Console sign-in without MFA",
+   "scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_sign_in_without_mfa (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cloudwatch_log_metric_filter_unauthorized_api_calls",
+   "title": "CloudWatch Logs metric filter and alarm exist for unauthorized API calls",
+   "scope": "Prowler 5.47.0 check cloudwatch_log_metric_filter_unauthorized_api_calls (AWS cloudwatch, resource type AwsCloudWatchAlarm): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.codeartifact_packages_external_public_publishing_disabled",
    "title": "Internal CodeArtifact package does not allow publishing versions already present in external public sources",
@@ -658,6 +973,20 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.codebuild_project_older_90_days",
+   "title": "CodeBuild project has been invoked in the last 90 days",
+   "scope": "Prowler 5.47.0 check codebuild_project_older_90_days (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.codebuild_project_s3_logs_encrypted",
+   "title": "CodeBuild project S3 logs are encrypted at rest",
+   "scope": "Prowler 5.47.0 check codebuild_project_s3_logs_encrypted (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.codebuild_project_source_repo_url_no_sensitive_credentials",
    "title": "CodeBuild project source repository URLs do not contain sensitive credentials",
@@ -679,6 +1008,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.codebuild_project_webhook_filters_use_anchored_patterns",
+   "title": "CodeBuild project webhook filters use anchored regex patterns",
+   "scope": "Prowler 5.47.0 check codebuild_project_webhook_filters_use_anchored_patterns (AWS codebuild, resource type AwsCodeBuildProject): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.codebuild_report_group_export_encrypted",
    "title": "CodeBuild report group exports to S3 are encrypted at rest",
@@ -693,6 +1029,27 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.codepipeline_project_repo_private",
+   "title": "CodePipeline pipeline should use private repository source with authenticated connection",
+   "scope": "Prowler 5.47.0 check codepipeline_project_repo_private (AWS codepipeline, resource type AwsCodePipelinePipeline): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cognito_identity_pool_guest_access_disabled",
+   "title": "Cognito identity pool has guest access disabled",
+   "scope": "Prowler 5.47.0 check cognito_identity_pool_guest_access_disabled (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cognito_user_pool_account_recovery_sms_not_preferred",
+   "title": "Cognito user pool does not prefer SMS for account recovery",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_account_recovery_sms_not_preferred (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.cognito_user_pool_advanced_security_enabled",
    "title": "Cognito user pool has advanced security enforced with full-function mode",
@@ -714,6 +1071,34 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cognito_user_pool_client_prevent_user_existence_errors",
+   "title": "Amazon Cognito user pool client has Prevent User Existence Errors enabled",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_client_prevent_user_existence_errors (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cognito_user_pool_client_token_revocation_enabled",
+   "title": "Amazon Cognito user pool client has token revocation enabled",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_client_token_revocation_enabled (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cognito_user_pool_deletion_protection_enabled",
+   "title": "Cognito user pool has deletion protection enabled",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_deletion_protection_enabled (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cognito_user_pool_mfa_enabled",
+   "title": "Amazon Cognito user pool requires Multi-Factor Authentication (MFA)",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_mfa_enabled (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.cognito_user_pool_password_policy_lowercase",
    "title": "Cognito user pool password policy requires at least one lowercase letter",
@@ -749,6 +1134,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.cognito_user_pool_self_registration_disabled",
+   "title": "Amazon Cognito user pool has self registration disabled",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_self_registration_disabled (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.cognito_user_pool_temporary_password_expiration",
+   "title": "Cognito user pool has temporary password expiration set to 7 days or less",
+   "scope": "Prowler 5.47.0 check cognito_user_pool_temporary_password_expiration (AWS cognito, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.cognito_user_pool_waf_acl_attached",
    "title": "Amazon Cognito user pool is associated with a WAF Web ACL",
@@ -770,6 +1169,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.config_recorder_using_aws_service_role",
+   "title": "AWS Config recorder uses the AWSServiceRoleForConfig service-linked role",
+   "scope": "Prowler 5.47.0 check config_recorder_using_aws_service_role (AWS config, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.datapipeline_pipeline_no_secrets_in_definition",
    "title": "Data Pipeline definition has no sensitive credentials",
@@ -805,6 +1211,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.directoryservice_directory_monitor_notifications",
+   "title": "Directory Service directory has SNS notifications enabled",
+   "scope": "Prowler 5.47.0 check directoryservice_directory_monitor_notifications (AWS directoryservice, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.directoryservice_directory_snapshots_limit",
+   "title": "Directory Service directory has adequate remaining manual snapshot quota",
+   "scope": "Prowler 5.47.0 check directoryservice_directory_snapshots_limit (AWS directoryservice, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.directoryservice_ldap_certificate_expiration",
    "title": "Directory Service LDAP certificate expires in more than 90 days",
@@ -812,6 +1232,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.directoryservice_radius_server_security_protocol",
+   "title": "Directory Service directory RADIUS server uses MS-CHAPv2",
+   "scope": "Prowler 5.47.0 check directoryservice_radius_server_security_protocol (AWS directoryservice, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.directoryservice_supported_mfa_radius_enabled",
+   "title": "AWS Directory Service directory has RADIUS-based MFA enabled",
+   "scope": "Prowler 5.47.0 check directoryservice_supported_mfa_radius_enabled (AWS directoryservice, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.dlm_ebs_snapshot_lifecycle_policy_exists",
    "title": "Region with EBS snapshots has at least one EBS snapshot lifecycle policy defined",
@@ -819,6 +1253,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.dms_endpoint_mongodb_authentication_enabled",
+   "title": "DMS MongoDB endpoint has an authentication mechanism enabled",
+   "scope": "Prowler 5.47.0 check dms_endpoint_mongodb_authentication_enabled (AWS dms, resource type AwsDmsEndpoint): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.dms_endpoint_neptune_iam_authorization_enabled",
    "title": "DMS endpoint for Neptune has IAM authorization enabled",
@@ -840,6 +1281,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.dms_instance_minor_version_upgrade_enabled",
+   "title": "DMS replication instance has auto minor version upgrade enabled",
+   "scope": "Prowler 5.47.0 check dms_instance_minor_version_upgrade_enabled (AWS dms, resource type AwsDmsReplicationInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.dms_instance_multi_az_enabled",
    "title": "DMS replication instance has Multi-AZ enabled",
@@ -882,6 +1330,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.documentdb_cluster_deletion_protection",
+   "title": "DocumentDB cluster has deletion protection enabled",
+   "scope": "Prowler 5.47.0 check documentdb_cluster_deletion_protection (AWS documentdb, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.documentdb_cluster_multi_az_enabled",
    "title": "DocumentDB cluster has Multi-AZ enabled",
@@ -1055,63 +1510,210 @@
    "title": "EBS snapshot is encrypted",
    "scope": "Prowler 5.47.0 check ec2_ebs_snapshots_encrypted (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "high"
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_ebs_volume_encryption",
+   "title": "EBS volume is encrypted",
+   "scope": "Prowler 5.47.0 check ec2_ebs_volume_encryption (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_ebs_volume_protected_by_backup_plan",
+   "title": "EBS volume is protected by a backup plan",
+   "scope": "Prowler 5.47.0 check ec2_ebs_volume_protected_by_backup_plan (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_ebs_volume_snapshots_exists",
+   "title": "EBS volume has at least one snapshot",
+   "scope": "Prowler 5.47.0 check ec2_ebs_volume_snapshots_exists (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_elastic_ip_shodan",
+   "title": "EC2 Elastic IP address is not listed in Shodan",
+   "scope": "Prowler 5.47.0 check ec2_elastic_ip_shodan (AWS ec2, resource type AwsEc2Eip): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_elastic_ip_unassigned",
+   "title": "Elastic IP is associated with an instance or network interface",
+   "scope": "Prowler 5.47.0 check ec2_elastic_ip_unassigned (AWS ec2, resource type AwsEc2Eip): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_account_imdsv2_enabled",
+   "title": "IMDSv2 is required by default for EC2 instances at the account level",
+   "scope": "Prowler 5.47.0 check ec2_instance_account_imdsv2_enabled (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_detailed_monitoring_enabled",
+   "title": "EC2 instance has detailed monitoring enabled",
+   "scope": "Prowler 5.47.0 check ec2_instance_detailed_monitoring_enabled (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_imdsv2_enabled",
+   "title": "EC2 instance requires IMDSv2 or has the instance metadata service disabled",
+   "scope": "Prowler 5.47.0 check ec2_instance_imdsv2_enabled (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_internet_facing_with_instance_profile",
+   "title": "EC2 instance is not internet-facing with an instance profile attached",
+   "scope": "Prowler 5.47.0 check ec2_instance_internet_facing_with_instance_profile (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_managed_by_ssm",
+   "title": "EC2 instance is managed by AWS Systems Manager or not running",
+   "scope": "Prowler 5.47.0 check ec2_instance_managed_by_ssm (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_older_than_specific_days",
+   "title": "EC2 instance is not older than the configured maximum age or is not running",
+   "scope": "Prowler 5.47.0 check ec2_instance_older_than_specific_days (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_paravirtual_type",
+   "title": "EC2 instance virtualization type is HVM",
+   "scope": "Prowler 5.47.0 check ec2_instance_paravirtual_type (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_cassandra_exposed_to_internet",
+   "title": "EC2 instance does not have Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160) open to the Internet",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_cassandra_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_cifs_exposed_to_internet",
+   "title": "EC2 instance does not allow Internet ingress to TCP ports 139 or 445 (CIFS)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_cifs_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_elasticsearch_kibana_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_elasticsearch_kibana_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_ftp_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP ports 20 or 21 (FTP)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_ftp_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_kafka_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 9092 (Kafka)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_kafka_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_kerberos_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP ports 88, 464, 749, or 750 (Kerberos)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_kerberos_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_ldap_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP ports 389 or 636 (LDAP/LDAPS)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_ldap_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_memcached_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 11211 (Memcached)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_memcached_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.ec2_instance_port_mongodb_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP ports 27017 or 27018 (MongoDB)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_mongodb_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_ebs_volume_encryption",
-   "title": "EBS volume is encrypted",
-   "scope": "Prowler 5.47.0 check ec2_ebs_volume_encryption (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_mysql_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 3306 (MySQL)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_mysql_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "high"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_ebs_volume_protected_by_backup_plan",
-   "title": "EBS volume is protected by a backup plan",
-   "scope": "Prowler 5.47.0 check ec2_ebs_volume_protected_by_backup_plan (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_oracle_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP ports 1521, 2483, or 2484 (Oracle)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_oracle_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "medium"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_ebs_volume_snapshots_exists",
-   "title": "EBS volume has at least one snapshot",
-   "scope": "Prowler 5.47.0 check ec2_ebs_volume_snapshots_exists (AWS ec2, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_postgresql_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 5432 (PostgreSQL)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_postgresql_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "high"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_elastic_ip_unassigned",
-   "title": "Elastic IP is associated with an instance or network interface",
-   "scope": "Prowler 5.47.0 check ec2_elastic_ip_unassigned (AWS ec2, resource type AwsEc2Eip): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_rdp_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 3389 (RDP)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_rdp_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "low"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_instance_imdsv2_enabled",
-   "title": "EC2 instance requires IMDSv2 or has the instance metadata service disabled",
-   "scope": "Prowler 5.47.0 check ec2_instance_imdsv2_enabled (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_redis_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 6379 (Redis)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_redis_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "high"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_instance_internet_facing_with_instance_profile",
-   "title": "EC2 instance is not internet-facing with an instance profile attached",
-   "scope": "Prowler 5.47.0 check ec2_instance_internet_facing_with_instance_profile (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_sqlserver_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP ports 1433 or 1434 (SQL Server)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_sqlserver_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "high"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_instance_managed_by_ssm",
-   "title": "EC2 instance is managed by AWS Systems Manager or not running",
-   "scope": "Prowler 5.47.0 check ec2_instance_managed_by_ssm (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_ssh_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 22 (SSH)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_ssh_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "medium"
+   "severity": "critical"
   },
   {
-   "id": "prowler.aws.ec2_instance_older_than_specific_days",
-   "title": "EC2 instance is not older than the configured maximum age or is not running",
-   "scope": "Prowler 5.47.0 check ec2_instance_older_than_specific_days (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "id": "prowler.aws.ec2_instance_port_telnet_exposed_to_internet",
+   "title": "EC2 instance does not allow ingress from the Internet to TCP port 23 (Telnet)",
+   "scope": "Prowler 5.47.0 check ec2_instance_port_telnet_exposed_to_internet (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "medium"
+   "severity": "critical"
   },
   {
    "id": "prowler.aws.ec2_instance_profile_attached",
@@ -1134,6 +1736,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.ec2_instance_stopped_older_than_specific_days",
+   "title": "EC2 instance has not been stopped longer than the configured maximum days",
+   "scope": "Prowler 5.47.0 check ec2_instance_stopped_older_than_specific_days (AWS ec2, resource type AwsEc2Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.ec2_instance_uses_single_eni",
    "title": "EC2 instance has no more than one Elastic Network Interface (ENI) attached",
@@ -1148,6 +1757,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.ec2_launch_template_imdsv2_required",
+   "title": "EC2 launch template has IMDSv2 enabled and required or instance metadata service disabled",
+   "scope": "Prowler 5.47.0 check ec2_launch_template_imdsv2_required (AWS ec2, resource type AwsEc2LaunchTemplate): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.ec2_launch_template_no_public_ip",
    "title": "Amazon EC2 launch template has no public IP addresses configured on network interfaces",
@@ -1183,6 +1799,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.ec2_networkacl_unused",
+   "title": "Non-default network ACL is associated with a subnet",
+   "scope": "Prowler 5.47.0 check ec2_networkacl_unused (AWS ec2, resource type AwsEc2NetworkAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
    "title": "Security group does not have all ports open to the Internet",
@@ -1225,6 +1848,83 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Cassandra TCP ports 7199, 9160, or 8888",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 9092 (Kafka)",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Memcached TCP port 11211",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MongoDB TCP ports 27017 and 27018",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Oracle TCP ports 1521 or 2483",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Postgres TCP port 5432",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Redis TCP port 6379",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
+   "title": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Microsoft SQL Server ports 1433 and 1434",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23",
+   "title": "Security group does not allow ingress from the Internet to TCP port 23 (Telnet)",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23 (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.ec2_securitygroup_allow_wide_open_public_ipv4",
    "title": "Security group has no ingress or egress rules with public IPv4 CIDR ranges from /1 to /23",
@@ -1239,6 +1939,34 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.ec2_securitygroup_from_launch_wizard",
+   "title": "Security group not created using the EC2 Launch Wizard",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_from_launch_wizard (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_not_used",
+   "title": "Non-default EC2 security group is in use",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_not_used (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.ec2_securitygroup_with_many_ingress_egress_rules",
+   "title": "Security group has 50 or fewer inbound rules and 50 or fewer outbound rules",
+   "scope": "Prowler 5.47.0 check ec2_securitygroup_with_many_ingress_egress_rules (AWS ec2, resource type AwsEc2SecurityGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.ec2_transitgateway_auto_accept_vpc_attachments",
+   "title": "Amazon EC2 Transit Gateway does not automatically accept shared VPC attachments",
+   "scope": "Prowler 5.47.0 check ec2_transitgateway_auto_accept_vpc_attachments (AWS ec2, resource type AwsEc2TransitGateway): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.ecr_registry_enhanced_scanning_enabled",
    "title": "ECR registry has enhanced scanning enabled",
@@ -1253,6 +1981,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.ecr_repositories_lifecycle_policy_enabled",
+   "title": "ECR repository has a lifecycle policy configured",
+   "scope": "Prowler 5.47.0 check ecr_repositories_lifecycle_policy_enabled (AWS ecr, resource type AwsEcrRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.ecr_repositories_not_publicly_accessible",
    "title": "ECR repository is not publicly accessible",
@@ -1260,6 +1995,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.ecr_repositories_scan_images_on_push_enabled",
+   "title": "[DEPRECATED] ECR repository has image scanning on push enabled",
+   "scope": "Prowler 5.47.0 check ecr_repositories_scan_images_on_push_enabled (AWS ecr, resource type AwsEcrRepository): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.ecr_repositories_scan_vulnerabilities_in_latest_image",
    "title": "ECR repository latest image is scanned with no vulnerabilities at or above the configured minimum severity",
@@ -1323,6 +2065,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.ecs_task_definitions_logging_block_mode",
+   "title": "ECS task definition has container logging in non-blocking mode",
+   "scope": "Prowler 5.47.0 check ecs_task_definitions_logging_block_mode (AWS ecs, resource type AwsEcsTaskDefinition): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.ecs_task_definitions_logging_enabled",
    "title": "ECS task definition has logging configured for all containers",
@@ -1400,6 +2149,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.eks_cluster_deletion_protection_enabled",
+   "title": "EKS cluster has deletion protection enabled",
+   "scope": "Prowler 5.47.0 check eks_cluster_deletion_protection_enabled (AWS eks, resource type AwsEksCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.eks_cluster_kms_cmk_encryption_in_secrets_enabled",
    "title": "EKS cluster has Kubernetes secrets encryption enabled",
@@ -1456,6 +2212,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.elasticache_redis_cluster_auto_minor_version_upgrades",
+   "title": "ElastiCache Redis cache cluster has automatic minor version upgrades enabled",
+   "scope": "Prowler 5.47.0 check elasticache_redis_cluster_auto_minor_version_upgrades (AWS elasticache, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.elasticache_redis_cluster_automatic_failover_enabled",
    "title": "ElastiCache Redis cluster has automatic failover enabled",
@@ -1505,6 +2268,20 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.elasticbeanstalk_environment_enhanced_health_reporting",
+   "title": "Elastic Beanstalk environment has enhanced health reporting enabled",
+   "scope": "Prowler 5.47.0 check elasticbeanstalk_environment_enhanced_health_reporting (AWS elasticbeanstalk, resource type AwsElasticBeanstalkEnvironment): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.elasticbeanstalk_environment_managed_updates_enabled",
+   "title": "Elastic Beanstalk environment has managed platform updates enabled",
+   "scope": "Prowler 5.47.0 check elasticbeanstalk_environment_managed_updates_enabled (AWS elasticbeanstalk, resource type AwsElasticBeanstalkEnvironment): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.elasticbeanstalk_environment_no_secrets_in_configuration",
    "title": "Elastic Beanstalk environment configuration has no hardcoded secrets",
@@ -1519,6 +2296,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.elb_connection_draining_enabled",
+   "title": "Classic Load Balancer has connection draining enabled",
+   "scope": "Prowler 5.47.0 check elb_connection_draining_enabled (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.elb_cross_zone_load_balancing_enabled",
    "title": "Classic Load Balancer has cross-zone load balancing enabled",
@@ -1568,6 +2352,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.elb_ssl_listeners_use_acm_certificate",
+   "title": "Classic Load Balancer HTTPS/SSL listeners use ACM-issued certificates",
+   "scope": "Prowler 5.47.0 check elb_ssl_listeners_use_acm_certificate (AWS elb, resource type AwsElbLoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.elbv2_alb_drop_invalid_header_fields_enabled",
+   "title": "Application Load Balancer should be configured to drop invalid HTTP header fields",
+   "scope": "Prowler 5.47.0 check elbv2_alb_drop_invalid_header_fields_enabled (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.elbv2_cross_zone_load_balancing_enabled",
    "title": "ELBv2 Network or Gateway Load Balancer has cross-zone load balancing enabled",
@@ -1610,6 +2408,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.elbv2_listener_fips_tls_enabled",
+   "title": "ELBv2 HTTPS/TLS listeners use a FIPS TLS security policy",
+   "scope": "Prowler 5.47.0 check elbv2_listener_fips_tls_enabled (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.elbv2_listener_pqc_tls_enabled",
    "title": "ELBv2 HTTPS/TLS listeners use a post-quantum TLS security policy",
@@ -1617,6 +2422,13 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.elbv2_listeners_underneath",
+   "title": "ELBv2 load balancer has at least one listener",
+   "scope": "Prowler 5.47.0 check elbv2_listeners_underneath (AWS elbv2, resource type AwsElbv2LoadBalancer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.elbv2_logging_enabled",
    "title": "ELBv2 Application Load Balancer has access logs to S3 configured",
@@ -1687,6 +2499,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.eventbridge_schema_registry_cross_account_access",
+   "title": "AWS EventBridge schema registry does not allow cross-account access",
+   "scope": "Prowler 5.47.0 check eventbridge_schema_registry_cross_account_access (AWS eventbridge, resource type AwsEventSchemasRegistry): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.firehose_stream_encrypted_at_rest",
    "title": "Kinesis Data Firehose delivery stream is encrypted at rest",
@@ -1701,6 +2520,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.fsx_file_system_copy_tags_to_backups_enabled",
+   "title": "FSx file system has copy tags to backups enabled",
+   "scope": "Prowler 5.47.0 check fsx_file_system_copy_tags_to_backups_enabled (AWS fsx, resource type AwsFSxFileSystem): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.fsx_file_system_copy_tags_to_volumes_enabled",
+   "title": "FSx file system has copy tags to volumes enabled",
+   "scope": "Prowler 5.47.0 check fsx_file_system_copy_tags_to_volumes_enabled (AWS fsx, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.fsx_windows_file_system_multi_az_enabled",
    "title": "FSx Windows file system is configured for Multi-AZ deployment",
@@ -1722,6 +2555,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.glue_data_catalogs_connection_passwords_encryption_enabled",
+   "title": "Glue data catalog connection password is encrypted with a KMS key",
+   "scope": "Prowler 5.47.0 check glue_data_catalogs_connection_passwords_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.glue_data_catalogs_metadata_encryption_enabled",
    "title": "Glue Data Catalog metadata is encrypted with KMS",
@@ -1743,6 +2583,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.glue_development_endpoints_cloudwatch_logs_encryption_enabled",
+   "title": "Glue development endpoint has CloudWatch Logs encryption enabled",
+   "scope": "Prowler 5.47.0 check glue_development_endpoints_cloudwatch_logs_encryption_enabled (AWS glue, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.glue_development_endpoints_job_bookmark_encryption_enabled",
    "title": "Glue development endpoint has Job Bookmark encryption enabled",
@@ -1764,6 +2611,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.glue_etl_jobs_cloudwatch_logs_encryption_enabled",
+   "title": "Glue ETL job has CloudWatch Logs encryption enabled",
+   "scope": "Prowler 5.47.0 check glue_etl_jobs_cloudwatch_logs_encryption_enabled (AWS glue, resource type AwsGlueJob): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.glue_etl_jobs_job_bookmark_encryption_enabled",
    "title": "Glue ETL job has Job bookmark encryption enabled",
@@ -1792,6 +2646,48 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.guardduty_ai_protection_enabled",
+   "title": "GuardDuty detector has AI Protection enabled",
+   "scope": "Prowler 5.47.0 check guardduty_ai_protection_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.guardduty_centrally_managed",
+   "title": "GuardDuty detector is managed by an administrator account or is the administrator with member accounts",
+   "scope": "Prowler 5.47.0 check guardduty_centrally_managed (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.guardduty_delegated_admin_enabled_all_regions",
+   "title": "GuardDuty has delegated admin configured and is enabled in all regions with organization auto-enable",
+   "scope": "Prowler 5.47.0 check guardduty_delegated_admin_enabled_all_regions (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.guardduty_ec2_malware_protection_enabled",
+   "title": "GuardDuty detector has Malware Protection for EC2 enabled",
+   "scope": "Prowler 5.47.0 check guardduty_ec2_malware_protection_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.guardduty_eks_audit_log_enabled",
+   "title": "GuardDuty detector has EKS Audit Log Monitoring enabled",
+   "scope": "Prowler 5.47.0 check guardduty_eks_audit_log_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.guardduty_eks_runtime_monitoring_enabled",
+   "title": "GuardDuty detector has EKS Runtime Monitoring enabled",
+   "scope": "Prowler 5.47.0 check guardduty_eks_runtime_monitoring_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.guardduty_is_enabled",
    "title": "GuardDuty detector is enabled and not suspended",
@@ -1799,6 +2695,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.guardduty_lambda_protection_enabled",
+   "title": "GuardDuty detector has Lambda Protection enabled",
+   "scope": "Prowler 5.47.0 check guardduty_lambda_protection_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.guardduty_no_high_severity_findings",
    "title": "GuardDuty detector has no high severity findings",
@@ -1806,6 +2709,41 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.guardduty_rds_protection_enabled",
+   "title": "GuardDuty detector has RDS Protection enabled",
+   "scope": "Prowler 5.47.0 check guardduty_rds_protection_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.guardduty_runtime_monitoring_enabled",
+   "title": "GuardDuty detector has Runtime Monitoring enabled",
+   "scope": "Prowler 5.47.0 check guardduty_runtime_monitoring_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.guardduty_s3_protection_enabled",
+   "title": "GuardDuty detector has S3 Protection enabled",
+   "scope": "Prowler 5.47.0 check guardduty_s3_protection_enabled (AWS guardduty, resource type AwsGuardDutyDetector): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.iam_administrator_access_with_mfa",
+   "title": "IAM group members granted AdministratorAccess have MFA enabled",
+   "scope": "Prowler 5.47.0 check iam_administrator_access_with_mfa (AWS iam, resource type AwsIamGroup): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.iam_avoid_root_usage",
+   "title": "AWS account root user has not been used in the last day",
+   "scope": "Prowler 5.47.0 check iam_avoid_root_usage (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.iam_aws_attached_policy_no_administrative_privileges",
    "title": "Attached AWS-managed IAM policy does not allow '*:*' administrative privileges",
@@ -1813,6 +2751,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.iam_check_saml_providers_sts",
+   "title": "IAM SAML provider exists in the account",
+   "scope": "Prowler 5.47.0 check iam_check_saml_providers_sts (AWS iam, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.iam_customer_attached_policy_no_administrative_privileges",
    "title": "Attached IAM customer-managed policy does not allow '*:*' administrative privileges",
@@ -1855,6 +2800,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.iam_inline_policy_no_full_access_to_kms",
+   "title": "Inline IAM policy does not allow kms:* privileges",
+   "scope": "Prowler 5.47.0 check iam_inline_policy_no_full_access_to_kms (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.iam_inline_policy_no_wildcard_marketplace_subscribe",
    "title": "Inline IAM policy does not allow 'aws-marketplace:Subscribe' on all resources",
@@ -1883,6 +2835,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.iam_password_policy_expires_passwords_within_90_days_or_less",
+   "title": "IAM account password policy enforces password expiration within 90 days or less",
+   "scope": "Prowler 5.47.0 check iam_password_policy_expires_passwords_within_90_days_or_less (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.iam_password_policy_lowercase",
    "title": "IAM password policy requires at least one lowercase letter",
@@ -1995,6 +2954,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.iam_role_cross_account_readonlyaccess_policy",
+   "title": "IAM role does not grant ReadOnlyAccess to external AWS accounts",
+   "scope": "Prowler 5.47.0 check iam_role_cross_account_readonlyaccess_policy (AWS iam, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.iam_role_cross_service_confused_deputy_prevention",
    "title": "IAM service role prevents cross-service confused deputy attack",
@@ -2035,7 +3001,21 @@
    "title": "IAM user does not have active access keys older than 90 days",
    "scope": "Prowler 5.47.0 check iam_rotate_access_key_90_days (AWS iam, resource type AwsIamUser): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
-   "severity": "medium"
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.iam_securityaudit_role_created",
+   "title": "At least one IAM role has the SecurityAudit AWS managed policy attached",
+   "scope": "Prowler 5.47.0 check iam_securityaudit_role_created (AWS iam, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.iam_support_role_created",
+   "title": "At least one IAM role has the AWSSupportAccess managed policy attached",
+   "scope": "Prowler 5.47.0 check iam_support_role_created (AWS iam, resource type AwsIamRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
   },
   {
    "id": "prowler.aws.iam_user_access_not_stale_to_bedrock",
@@ -2114,6 +3094,41 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.inspector2_active_findings_kev_within_due_date",
+   "title": "Inspector2 has no active findings for CISA Known Exploited Vulnerabilities past their remediation due date",
+   "scope": "Prowler 5.47.0 check inspector2_active_findings_kev_within_due_date (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.inspector2_active_findings_no_known_exploited_vulnerabilities",
+   "title": "Inspector2 has no active findings for CISA Known Exploited Vulnerabilities",
+   "scope": "Prowler 5.47.0 check inspector2_active_findings_no_known_exploited_vulnerabilities (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.inspector2_active_findings_within_max_age",
+   "title": "Inspector2 has no active findings older than the configured maximum age",
+   "scope": "Prowler 5.47.0 check inspector2_active_findings_within_max_age (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.inspector2_coverage_recently_scanned",
+   "title": "Inspector2 covered resource was scanned within the configured number of days",
+   "scope": "Prowler 5.47.0 check inspector2_coverage_recently_scanned (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.inspector2_coverage_scan_status_active",
+   "title": "Inspector2 covered resource is actively scanned",
+   "scope": "Prowler 5.47.0 check inspector2_coverage_scan_status_active (AWS inspector2, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.inspector2_is_enabled",
    "title": "Inspector2 is enabled for Amazon EC2 instances, ECR container images, Lambda functions, and Lambda code",
@@ -2128,6 +3143,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.kafka_cluster_enhanced_monitoring_enabled",
+   "title": "Amazon MSK cluster has enhanced monitoring enabled",
+   "scope": "Prowler 5.47.0 check kafka_cluster_enhanced_monitoring_enabled (AWS kafka, resource type AwsMskCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.kafka_cluster_in_transit_encryption_enabled",
    "title": "Kafka cluster has encryption in transit enabled",
@@ -2170,6 +3192,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.kinesis_stream_data_retention_period",
+   "title": "Kinesis stream retains data for at least the required minimum hours",
+   "scope": "Prowler 5.47.0 check kinesis_stream_data_retention_period (AWS kinesis, resource type AwsKinesisStream): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.kinesis_stream_encrypted_at_rest",
    "title": "Kinesis stream is encrypted at rest with KMS",
@@ -2177,6 +3206,27 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.kms_cmk_are_used",
+   "title": "KMS customer managed key is enabled or scheduled for deletion",
+   "scope": "Prowler 5.47.0 check kms_cmk_are_used (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.kms_cmk_not_deleted_unintentionally",
+   "title": "AWS KMS customer managed key is not scheduled for deletion",
+   "scope": "Prowler 5.47.0 check kms_cmk_not_deleted_unintentionally (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "critical"
+  },
+  {
+   "id": "prowler.aws.kms_cmk_not_multi_region",
+   "title": "AWS KMS customer managed key is single-Region",
+   "scope": "Prowler 5.47.0 check kms_cmk_not_multi_region (AWS kms, resource type AwsKmsKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.kms_cmk_rotation_enabled",
    "title": "KMS customer-managed symmetric CMK has automatic rotation enabled",
@@ -2247,6 +3297,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.lightsail_instance_php_blueprint_updated",
+   "title": "Lightsail instance created from a PHP blueprint runs a fixed PHP release",
+   "scope": "Prowler 5.47.0 check lightsail_instance_php_blueprint_updated (AWS lightsail, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.lightsail_instance_public",
    "title": "Lightsail instance has no publicly accessible ports",
@@ -2261,6 +3318,27 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.macie_automated_sensitive_data_discovery_enabled",
+   "title": "Macie automated sensitive data discovery is enabled",
+   "scope": "Prowler 5.47.0 check macie_automated_sensitive_data_discovery_enabled (AWS macie, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.aws.macie_is_enabled",
+   "title": "Amazon Macie is enabled",
+   "scope": "Prowler 5.47.0 check macie_is_enabled (AWS macie, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.memorydb_cluster_auto_minor_version_upgrades",
+   "title": "MemoryDB cluster has automatic minor version upgrades enabled",
+   "scope": "Prowler 5.47.0 check memorydb_cluster_auto_minor_version_upgrades (AWS memorydb, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.memorydb_cluster_in_transit_encryption_enabled",
    "title": "MemoryDB cluster has in-transit encryption enabled",
@@ -2275,6 +3353,13 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.mq_broker_auto_minor_version_upgrades",
+   "title": "Amazon MQ broker has automated minor version upgrades enabled",
+   "scope": "Prowler 5.47.0 check mq_broker_auto_minor_version_upgrades (AWS mq, resource type AwsAmazonMQBroker): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.mq_broker_cluster_deployment_mode",
    "title": "MQ RabbitMQ broker has cluster (multi-AZ) deployment mode",
@@ -2303,6 +3388,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.neptune_cluster_copy_tags_to_snapshots",
+   "title": "Neptune DB cluster is configured to copy tags to snapshots.",
+   "scope": "Prowler 5.47.0 check neptune_cluster_copy_tags_to_snapshots (AWS neptune, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.neptune_cluster_deletion_protection",
+   "title": "Neptune cluster has deletion protection enabled",
+   "scope": "Prowler 5.47.0 check neptune_cluster_deletion_protection (AWS neptune, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.neptune_cluster_iam_authentication_enabled",
    "title": "Neptune cluster has IAM authentication enabled",
@@ -2352,6 +3451,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.networkfirewall_deletion_protection",
+   "title": "Network Firewall has deletion protection enabled",
+   "scope": "Prowler 5.47.0 check networkfirewall_deletion_protection (AWS networkfirewall, resource type AwsNetworkFirewallFirewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.networkfirewall_in_all_vpc",
    "title": "VPC has Network Firewall enabled",
@@ -2443,6 +3549,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.opensearch_service_domains_internal_user_database_enabled",
+   "title": "Amazon OpenSearch Service domain has internal user database disabled",
+   "scope": "Prowler 5.47.0 check opensearch_service_domains_internal_user_database_enabled (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.opensearch_service_domains_node_to_node_encryption_enabled",
    "title": "Amazon OpenSearch Service domain has node-to-node encryption enabled",
@@ -2464,6 +3577,20 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.opensearch_service_domains_use_cognito_authentication_for_kibana",
+   "title": "Amazon OpenSearch Service domain has either Amazon Cognito or SAML authentication enabled for Kibana",
+   "scope": "Prowler 5.47.0 check opensearch_service_domains_use_cognito_authentication_for_kibana (AWS opensearch, resource type AwsOpenSearchServiceDomain): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.organizations_account_part_of_organizations",
+   "title": "AWS account is a member of an active AWS Organization",
+   "scope": "Prowler 5.47.0 check organizations_account_part_of_organizations (AWS organizations, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.organizations_delegated_administrators",
    "title": "AWS Organization has only trusted delegated administrators",
@@ -2471,6 +3598,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.organizations_opt_out_ai_services_policy",
+   "title": "AWS Organization has opted out of all AI services and child accounts cannot override the policy",
+   "scope": "Prowler 5.47.0 check organizations_opt_out_ai_services_policy (AWS organizations, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.organizations_scp_check_deny_regions",
    "title": "AWS Organization restricts operations to only the configured AWS Regions with SCP policies",
@@ -2478,6 +3612,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.organizations_tags_policies_enabled_and_attached",
+   "title": "AWS Organization has tag policies enabled and attached",
+   "scope": "Prowler 5.47.0 check organizations_tags_policies_enabled_and_attached (AWS organizations, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.rds_cluster_backtrack_enabled",
    "title": "RDS Aurora MySQL cluster has Backtrack enabled",
@@ -2485,6 +3626,34 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.rds_cluster_copy_tags_to_snapshots",
+   "title": "RDS DB cluster has copy tags to snapshots enabled",
+   "scope": "Prowler 5.47.0 check rds_cluster_copy_tags_to_snapshots (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.rds_cluster_critical_event_subscription",
+   "title": "RDS cluster event subscription is enabled for maintenance and failure categories",
+   "scope": "Prowler 5.47.0 check rds_cluster_critical_event_subscription (AWS rds, resource type AwsRdsEventSubscription): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.rds_cluster_default_admin",
+   "title": "RDS cluster master username is not admin or postgres",
+   "scope": "Prowler 5.47.0 check rds_cluster_default_admin (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.rds_cluster_deletion_protection",
+   "title": "RDS cluster has deletion protection enabled",
+   "scope": "Prowler 5.47.0 check rds_cluster_deletion_protection (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.rds_cluster_iam_authentication_enabled",
    "title": "RDS cluster has IAM authentication enabled",
@@ -2499,6 +3668,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.rds_cluster_minor_version_upgrade_enabled",
+   "title": "RDS cluster has automatic minor version upgrades enabled",
+   "scope": "Prowler 5.47.0 check rds_cluster_minor_version_upgrade_enabled (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.rds_cluster_multi_az",
    "title": "RDS cluster has Multi-AZ enabled",
@@ -2506,6 +3682,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.rds_cluster_non_default_port",
+   "title": "RDS cluster uses a non-default port for its database engine",
+   "scope": "Prowler 5.47.0 check rds_cluster_non_default_port (AWS rds, resource type AwsRdsDbCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.rds_cluster_protected_by_backup_plan",
    "title": "RDS cluster is protected by an AWS Backup plan",
@@ -2534,6 +3717,27 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.rds_instance_copy_tags_to_snapshots",
+   "title": "RDS DB instance has copy tags to snapshots enabled",
+   "scope": "Prowler 5.47.0 check rds_instance_copy_tags_to_snapshots (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.rds_instance_critical_event_subscription",
+   "title": "RDS instance event subscription is enabled for maintenance, configuration change, and failure categories",
+   "scope": "Prowler 5.47.0 check rds_instance_critical_event_subscription (AWS rds, resource type AwsRdsEventSubscription): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.rds_instance_default_admin",
+   "title": "RDS instance does not use the default master username (admin or postgres)",
+   "scope": "Prowler 5.47.0 check rds_instance_default_admin (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.rds_instance_deletion_protection",
    "title": "RDS instance has deletion protection enabled",
@@ -2555,6 +3759,27 @@
    "evidenceType": "Configuration",
    "severity": "low"
   },
+  {
+   "id": "prowler.aws.rds_instance_event_subscription_parameter_groups",
+   "title": "RDS DB parameter group event subscription is enabled and subscribes to configuration change events or all categories",
+   "scope": "Prowler 5.47.0 check rds_instance_event_subscription_parameter_groups (AWS rds, resource type AwsRdsEventSubscription): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.rds_instance_event_subscription_security_groups",
+   "title": "RDS event subscription for DB security groups is enabled for configuration change and failure events",
+   "scope": "Prowler 5.47.0 check rds_instance_event_subscription_security_groups (AWS rds, resource type AwsRdsEventSubscription): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.rds_instance_extended_support",
+   "title": "RDS instance is not enrolled in RDS Extended Support",
+   "scope": "Prowler 5.47.0 check rds_instance_extended_support (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.rds_instance_iam_authentication_enabled",
    "title": "RDS instance has IAM database authentication enabled",
@@ -2562,6 +3787,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.rds_instance_inside_vpc",
+   "title": "RDS instance is deployed in a VPC",
+   "scope": "Prowler 5.47.0 check rds_instance_inside_vpc (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.rds_instance_integration_cloudwatch_logs",
    "title": "RDS instance exports logs to CloudWatch Logs",
@@ -2569,6 +3801,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.rds_instance_minor_version_upgrade_enabled",
+   "title": "RDS instance has minor version upgrade enabled",
+   "scope": "Prowler 5.47.0 check rds_instance_minor_version_upgrade_enabled (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.rds_instance_multi_az",
    "title": "RDS instance has Multi-AZ enabled",
@@ -2583,6 +3822,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.rds_instance_non_default_port",
+   "title": "RDS instance uses a non-default port for its engine",
+   "scope": "Prowler 5.47.0 check rds_instance_non_default_port (AWS rds, resource type AwsRdsDbInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.rds_instance_protected_by_backup_plan",
    "title": "RDS instance is protected by an AWS Backup plan",
@@ -2646,6 +3892,13 @@
    "evidenceType": "Configuration",
    "severity": "critical"
   },
+  {
+   "id": "prowler.aws.redshift_cluster_enhanced_vpc_routing",
+   "title": "Redshift cluster has Enhanced VPC Routing enabled",
+   "scope": "Prowler 5.47.0 check redshift_cluster_enhanced_vpc_routing (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.redshift_cluster_in_transit_encryption_enabled",
    "title": "Redshift cluster is encrypted in transit",
@@ -2660,6 +3913,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.redshift_cluster_non_default_database_name",
+   "title": "Redshift cluster does not use the default database name dev",
+   "scope": "Prowler 5.47.0 check redshift_cluster_non_default_database_name (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.redshift_cluster_non_default_username",
+   "title": "Amazon Redshift cluster does not use the default admin username",
+   "scope": "Prowler 5.47.0 check redshift_cluster_non_default_username (AWS redshift, resource type AwsRedshiftCluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.redshift_cluster_public_access",
    "title": "Redshift cluster is not publicly exposed to the Internet",
@@ -2681,6 +3948,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.rolesanywhere_trust_anchor_pqc_pki",
+   "title": "IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI",
+   "scope": "Prowler 5.47.0 check rolesanywhere_trust_anchor_pqc_pki (AWS rolesanywhere, resource type AwsRolesAnywhereTrustAnchor): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.route53_dangling_ip_subdomain_takeover",
    "title": "Route53 record does not point to a dangling AWS resource",
@@ -2688,6 +3962,20 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.route53_domains_privacy_protection_enabled",
+   "title": "Route 53 domain has admin contact privacy protection enabled",
+   "scope": "Prowler 5.47.0 check route53_domains_privacy_protection_enabled (AWS route53, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.aws.route53_domains_transferlock_enabled",
+   "title": "Route 53 domain has Transfer Lock enabled",
+   "scope": "Prowler 5.47.0 check route53_domains_transferlock_enabled (AWS route53, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.route53_public_hosted_zones_cloudwatch_logging_enabled",
    "title": "Route53 public hosted zone has query logging enabled to a CloudWatch Logs log group",
@@ -2737,6 +4025,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.s3_bucket_event_notifications_enabled",
+   "title": "S3 bucket has event notifications enabled",
+   "scope": "Prowler 5.47.0 check s3_bucket_event_notifications_enabled (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.s3_bucket_kms_encryption",
    "title": "S3 bucket has server-side encryption with AWS KMS",
@@ -2751,6 +4046,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.s3_bucket_lifecycle_enabled",
+   "title": "S3 bucket has a lifecycle configuration enabled",
+   "scope": "Prowler 5.47.0 check s3_bucket_lifecycle_enabled (AWS s3, resource type AwsS3Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.s3_bucket_no_mfa_delete",
    "title": "S3 bucket has MFA Delete enabled",
@@ -2835,6 +4137,20 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.sagemaker_clarify_exists",
+   "title": "Amazon SageMaker Clarify processing jobs exist in the region",
+   "scope": "Prowler 5.47.0 check sagemaker_clarify_exists (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.sagemaker_domain_sso_configured",
+   "title": "SageMaker domains use SSO authentication instead of IAM mode",
+   "scope": "Prowler 5.47.0 check sagemaker_domain_sso_configured (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.sagemaker_endpoint_config_kms_encryption_enabled",
    "title": "SageMaker endpoint configuration is encrypted with a KMS key",
@@ -2849,6 +4165,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.sagemaker_models_monitor_enabled",
+   "title": "Amazon SageMaker has a monitoring schedule scheduled",
+   "scope": "Prowler 5.47.0 check sagemaker_models_monitor_enabled (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.sagemaker_models_network_isolation_enabled",
    "title": "Amazon SageMaker model has network isolation enabled",
@@ -2856,6 +4179,20 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.sagemaker_models_registry_in_use",
+   "title": "Amazon SageMaker Model Registry should have at least one approved model package",
+   "scope": "Prowler 5.47.0 check sagemaker_models_registry_in_use (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.sagemaker_models_vpc_settings_configured",
+   "title": "Amazon SageMaker model has VPC settings enabled",
+   "scope": "Prowler 5.47.0 check sagemaker_models_vpc_settings_configured (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.sagemaker_notebook_instance_encryption_enabled",
    "title": "SageMaker notebook instance is encrypted with a KMS key",
@@ -2877,6 +4214,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.sagemaker_notebook_instance_vpc_settings_configured",
+   "title": "Amazon SageMaker notebook instance has VPC settings configured",
+   "scope": "Prowler 5.47.0 check sagemaker_notebook_instance_vpc_settings_configured (AWS sagemaker, resource type AwsSageMakerNotebookInstance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.sagemaker_notebook_instance_without_direct_internet_access_configured",
    "title": "Amazon SageMaker notebook instance has direct internet access disabled",
@@ -2905,6 +4249,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.sagemaker_training_jobs_vpc_settings_configured",
+   "title": "Amazon SageMaker training job has VPC configuration enabled",
+   "scope": "Prowler 5.47.0 check sagemaker_training_jobs_vpc_settings_configured (AWS sagemaker, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.secretsmanager_automatic_rotation_enabled",
    "title": "Secrets Manager secret has rotation enabled",
@@ -2940,6 +4291,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.securityhub_delegated_admin_enabled_all_regions",
+   "title": "Security Hub has delegated admin configured and is enabled in all regions with organization auto-enable",
+   "scope": "Prowler 5.47.0 check securityhub_delegated_admin_enabled_all_regions (AWS securityhub, resource type AwsSecurityHubHub): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.securityhub_enabled",
    "title": "Security Hub is enabled with standards or integrations configured",
@@ -2947,6 +4305,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.servicecatalog_portfolio_shared_within_organization_only",
+   "title": "Service Catalog portfolio is shared only within the AWS Organization",
+   "scope": "Prowler 5.47.0 check servicecatalog_portfolio_shared_within_organization_only (AWS servicecatalog, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.ses_identity_dkim_enabled",
    "title": "SES identity has DKIM signing enabled",
@@ -2954,6 +4319,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.ses_identity_not_publicly_accessible",
+   "title": "SES identity resource policy does not allow public access",
+   "scope": "Prowler 5.47.0 check ses_identity_not_publicly_accessible (AWS ses, resource type AwsIamPolicy): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
   {
    "id": "prowler.aws.shield_advanced_protection_in_associated_elastic_ips",
    "title": "Elastic IP address is protected by AWS Shield Advanced",
@@ -3052,6 +4424,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.ssmincidents_enabled_with_plans",
+   "title": "SSM Incidents replication set is ACTIVE and has at least one response plan",
+   "scope": "Prowler 5.47.0 check ssmincidents_enabled_with_plans (AWS ssmincidents, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.stepfunctions_statemachine_encrypted_with_cmk",
    "title": "Step Functions state machine is encrypted at rest with a customer-managed KMS key",
@@ -3087,6 +4466,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.transfer_server_fips_security_policy_enabled",
+   "title": "AWS Transfer Family server uses a FIPS security policy",
+   "scope": "Prowler 5.47.0 check transfer_server_fips_security_policy_enabled (AWS transfer, resource type AwsTransferServer): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
   {
    "id": "prowler.aws.transfer_server_in_transit_encryption_enabled",
    "title": "Transfer Family server has encryption in transit enabled",
@@ -3108,6 +4494,20 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.trustedadvisor_premium_support_plan_subscribed",
+   "title": "AWS account is subscribed to an AWS Premium Support plan",
+   "scope": "Prowler 5.47.0 check trustedadvisor_premium_support_plan_subscribed (AWS trustedadvisor, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.aws.vpc_different_regions",
+   "title": "VPCs are present in more than one region",
+   "scope": "Prowler 5.47.0 check vpc_different_regions (AWS vpc, resource type AwsEc2Vpc): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.vpc_endpoint_connections_trust_boundaries",
    "title": "VPC endpoint policy allows access only from trusted AWS accounts",
@@ -3115,6 +4515,13 @@
    "evidenceType": "Configuration",
    "severity": "high"
   },
+  {
+   "id": "prowler.aws.vpc_endpoint_for_ec2_enabled",
+   "title": "VPC has an Amazon EC2 VPC endpoint",
+   "scope": "Prowler 5.47.0 check vpc_endpoint_for_ec2_enabled (AWS vpc, resource type AwsEc2VpcEndpointService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.vpc_endpoint_multi_az_enabled",
    "title": "Amazon VPC interface endpoint has subnets in multiple Availability Zones",
@@ -3241,6 +4648,13 @@
    "evidenceType": "Configuration",
    "severity": "medium"
   },
+  {
+   "id": "prowler.aws.wafv2_webacl_rule_logging_enabled",
+   "title": "AWS WAFv2 Web ACL has Amazon CloudWatch metrics enabled for all rules and rule groups",
+   "scope": "Prowler 5.47.0 check wafv2_webacl_rule_logging_enabled (AWS wafv2, resource type AwsWafv2WebAcl): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
   {
    "id": "prowler.aws.wafv2_webacl_with_rules",
    "title": "AWS WAFv2 Web ACL has at least one rule or rule group attached",
@@ -3261,6 +4675,13 @@
    "scope": "Prowler 5.47.0 check workspaces_volume_encryption_enabled (AWS workspaces, resource type AwsEc2Volume): one result per resource Prowler evaluates; shows one setting, not the whole control.",
    "evidenceType": "Configuration",
    "severity": "high"
+  },
+  {
+   "id": "prowler.aws.workspaces_vpc_2private_1public_subnets_nat",
+   "title": "Workspace is in a private subnet and its VPC has at least 1 public subnet, 2 private subnets, and a NAT Gateway",
+   "scope": "Prowler 5.47.0 check workspaces_vpc_2private_1public_subnets_nat (AWS workspaces, resource type Other): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
   }
  ]
 }