aws-security-mcp 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +118 -42
  2. package/dashboard/dist/assets/index-CQyERuqT.css +2 -0
  3. package/dashboard/dist/data.json +167 -758
  4. package/dashboard/dist/index.html +2 -2
  5. package/dist/bin/aws-security-mcp.js +2812 -3517
  6. package/dist/bin/aws-security-mcp.js.map +1 -1
  7. package/dist/src/index.d.ts +38 -1
  8. package/dist/src/index.js +2803 -3496
  9. package/dist/src/index.js.map +1 -1
  10. package/package.json +4 -4
  11. package/templates/stackset-audit-role.json +55 -0
  12. package/templates/stackset-audit-role.yaml +44 -0
  13. package/dashboard/dist/assets/index-DCplBiuM.css +0 -2
  14. /package/dashboard/dist/assets/{index-jFq0Af8S.js → index-BYE-UdjR.js} +0 -0
package/dashboard/dist/data.json CHANGED
@@ -5,887 +5,296 @@
5
5
  "region": "cn-north-1",
6
6
  "accountId": "468254682119",
7
7
  "summary": {
8
- "totalFindings": 48,
8
+ "totalFindings": 12,
9
9
  "critical": 0,
10
- "high": 3,
11
- "medium": 13,
12
- "low": 32,
13
- "modulesSuccess": 8,
10
+ "high": 2,
11
+ "medium": 5,
12
+ "low": 5,
13
+ "modulesSuccess": 14,
14
14
  "modulesError": 0
15
15
  },
16
16
  "modules": [
17
17
  {
18
- "module": "security_group",
19
- "findingsCount": 0,
20
- "status": "success"
21
- },
22
- {
23
- "module": "s3",
24
- "findingsCount": 33,
18
+ "module": "service_detection",
19
+ "findingsCount": 2,
25
20
  "status": "success"
26
21
  },
27
22
  {
28
- "module": "iam",
29
- "findingsCount": 1,
23
+ "module": "secret_exposure",
24
+ "findingsCount": 0,
30
25
  "status": "success"
31
26
  },
32
27
  {
33
- "module": "cloudtrail",
34
- "findingsCount": 3,
28
+ "module": "ssl_certificate",
29
+ "findingsCount": 0,
35
30
  "status": "success"
36
31
  },
37
32
  {
38
- "module": "rds",
33
+ "module": "dns_dangling",
39
34
  "findingsCount": 0,
40
35
  "status": "success"
41
36
  },
42
37
  {
43
- "module": "ebs",
44
- "findingsCount": 11,
38
+ "module": "network_reachability",
39
+ "findingsCount": 1,
45
40
  "status": "success"
46
41
  },
47
42
  {
48
- "module": "vpc",
49
- "findingsCount": 0,
43
+ "module": "iam_privilege_escalation",
44
+ "findingsCount": 1,
50
45
  "status": "success"
51
46
  },
52
47
  {
53
- "module": "service_detection",
48
+ "module": "public_access_verify",
54
49
  "findingsCount": 0,
55
50
  "status": "success"
56
- }
57
- ],
58
- "findings": [
59
- {
60
- "riskScore": 8.5,
61
- "title": "Account-level S3 Block Public Access is not configured",
62
- "resourceType": "AWS::S3::AccountPublicAccessBlock",
63
- "resourceId": "468254682119",
64
- "resourceArn": "arn:aws-cn:iam::468254682119:root",
65
- "region": "global",
66
- "description": "Account 468254682119 has no Block Public Access configuration set at the account level.",
67
- "impact": "There is no account-level safeguard against public S3 bucket access.",
68
- "remediationSteps": [
69
- "Enable all four Block Public Access settings at the account level."
70
- ],
71
- "severity": "HIGH",
72
- "priority": "P1",
73
- "module": "s3"
74
- },
75
- {
76
- "riskScore": 3,
77
- "title": "S3 bucket auto-sg-update-stack-cloudtraillogbucket-6xueze51oacf does not have versioning enabled",
78
- "resourceType": "AWS::S3::Bucket",
79
- "resourceId": "auto-sg-update-stack-cloudtraillogbucket-6xueze51oacf",
80
- "resourceArn": "arn:aws-cn:s3:::auto-sg-update-stack-cloudtraillogbucket-6xueze51oacf",
81
- "region": "cn-north-1",
82
- "description": "Bucket \"auto-sg-update-stack-cloudtraillogbucket-6xueze51oacf\" versioning is not set.",
83
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
84
- "remediationSteps": [
85
- "Enable versioning on the bucket.",
86
- "Consider adding lifecycle rules to manage version storage costs."
87
- ],
88
- "severity": "LOW",
89
- "priority": "P3",
90
- "module": "s3"
91
- },
92
- {
93
- "riskScore": 3,
94
- "title": "S3 bucket auto-sg-update-stack-cloudtraillogbucket-u990nisosy1p does not have versioning enabled",
95
- "resourceType": "AWS::S3::Bucket",
96
- "resourceId": "auto-sg-update-stack-cloudtraillogbucket-u990nisosy1p",
97
- "resourceArn": "arn:aws-cn:s3:::auto-sg-update-stack-cloudtraillogbucket-u990nisosy1p",
98
- "region": "cn-northwest-1",
99
- "description": "Bucket \"auto-sg-update-stack-cloudtraillogbucket-u990nisosy1p\" versioning is not set.",
100
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
101
- "remediationSteps": [
102
- "Enable versioning on the bucket.",
103
- "Consider adding lifecycle rules to manage version storage costs."
104
- ],
105
- "severity": "LOW",
106
- "priority": "P3",
107
- "module": "s3"
108
- },
109
- {
110
- "riskScore": 3,
111
- "title": "S3 bucket aws-announcements does not have versioning enabled",
112
- "resourceType": "AWS::S3::Bucket",
113
- "resourceId": "aws-announcements",
114
- "resourceArn": "arn:aws-cn:s3:::aws-announcements",
115
- "region": "cn-north-1",
116
- "description": "Bucket \"aws-announcements\" versioning is not set.",
117
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
118
- "remediationSteps": [
119
- "Enable versioning on the bucket.",
120
- "Consider adding lifecycle rules to manage version storage costs."
121
- ],
122
- "severity": "LOW",
123
- "priority": "P3",
124
- "module": "s3"
125
51
  },
126
52
  {
127
- "riskScore": 3,
128
- "title": "S3 bucket aws-cloudtrail-logs-468254682119-f51cea71 does not have versioning enabled",
129
- "resourceType": "AWS::S3::Bucket",
130
- "resourceId": "aws-cloudtrail-logs-468254682119-f51cea71",
131
- "resourceArn": "arn:aws-cn:s3:::aws-cloudtrail-logs-468254682119-f51cea71",
132
- "region": "cn-north-1",
133
- "description": "Bucket \"aws-cloudtrail-logs-468254682119-f51cea71\" versioning is not set.",
134
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
135
- "remediationSteps": [
136
- "Enable versioning on the bucket.",
137
- "Consider adding lifecycle rules to manage version storage costs."
138
- ],
139
- "severity": "LOW",
140
- "priority": "P3",
141
- "module": "s3"
142
- },
143
- {
144
- "riskScore": 3,
145
- "title": "S3 bucket aws-logs-468254682119-cn-north-1 does not have versioning enabled",
146
- "resourceType": "AWS::S3::Bucket",
147
- "resourceId": "aws-logs-468254682119-cn-north-1",
148
- "resourceArn": "arn:aws-cn:s3:::aws-logs-468254682119-cn-north-1",
149
- "region": "cn-north-1",
150
- "description": "Bucket \"aws-logs-468254682119-cn-north-1\" versioning is not set.",
151
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
152
- "remediationSteps": [
153
- "Enable versioning on the bucket.",
154
- "Consider adding lifecycle rules to manage version storage costs."
155
- ],
156
- "severity": "LOW",
157
- "priority": "P3",
158
- "module": "s3"
159
- },
160
- {
161
- "riskScore": 3,
162
- "title": "S3 bucket cf-templates-sa18zsjm1j5a-cn-north-1 does not have versioning enabled",
163
- "resourceType": "AWS::S3::Bucket",
164
- "resourceId": "cf-templates-sa18zsjm1j5a-cn-north-1",
165
- "resourceArn": "arn:aws-cn:s3:::cf-templates-sa18zsjm1j5a-cn-north-1",
166
- "region": "cn-north-1",
167
- "description": "Bucket \"cf-templates-sa18zsjm1j5a-cn-north-1\" versioning is not set.",
168
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
169
- "remediationSteps": [
170
- "Enable versioning on the bucket.",
171
- "Consider adding lifecycle rules to manage version storage costs."
172
- ],
173
- "severity": "LOW",
174
- "priority": "P3",
175
- "module": "s3"
176
- },
177
- {
178
- "riskScore": 3,
179
- "title": "S3 bucket cf-templates-sa18zsjm1j5a-cn-northwest-1 does not have versioning enabled",
180
- "resourceType": "AWS::S3::Bucket",
181
- "resourceId": "cf-templates-sa18zsjm1j5a-cn-northwest-1",
182
- "resourceArn": "arn:aws-cn:s3:::cf-templates-sa18zsjm1j5a-cn-northwest-1",
183
- "region": "cn-northwest-1",
184
- "description": "Bucket \"cf-templates-sa18zsjm1j5a-cn-northwest-1\" versioning is not set.",
185
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
186
- "remediationSteps": [
187
- "Enable versioning on the bucket.",
188
- "Consider adding lifecycle rules to manage version storage costs."
189
- ],
190
- "severity": "LOW",
191
- "priority": "P3",
192
- "module": "s3"
193
- },
194
- {
195
- "riskScore": 3,
196
- "title": "S3 bucket config-bucket-468254682119 does not have versioning enabled",
197
- "resourceType": "AWS::S3::Bucket",
198
- "resourceId": "config-bucket-468254682119",
199
- "resourceArn": "arn:aws-cn:s3:::config-bucket-468254682119",
200
- "region": "cn-northwest-1",
201
- "description": "Bucket \"config-bucket-468254682119\" versioning is not set.",
202
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
203
- "remediationSteps": [
204
- "Enable versioning on the bucket.",
205
- "Consider adding lifecycle rules to manage version storage costs."
206
- ],
207
- "severity": "LOW",
208
- "priority": "P3",
209
- "module": "s3"
210
- },
211
- {
212
- "riskScore": 3,
213
- "title": "S3 bucket customer-test does not have versioning enabled",
214
- "resourceType": "AWS::S3::Bucket",
215
- "resourceId": "customer-test",
216
- "resourceArn": "arn:aws-cn:s3:::customer-test",
217
- "region": "cn-north-1",
218
- "description": "Bucket \"customer-test\" versioning is not set.",
219
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
220
- "remediationSteps": [
221
- "Enable versioning on the bucket.",
222
- "Consider adding lifecycle rules to manage version storage costs."
223
- ],
224
- "severity": "LOW",
225
- "priority": "P3",
226
- "module": "s3"
227
- },
228
- {
229
- "riskScore": 3,
230
- "title": "S3 bucket deletetest does not have versioning enabled",
231
- "resourceType": "AWS::S3::Bucket",
232
- "resourceId": "deletetest",
233
- "resourceArn": "arn:aws-cn:s3:::deletetest",
234
- "region": "cn-northwest-1",
235
- "description": "Bucket \"deletetest\" versioning is not set.",
236
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
237
- "remediationSteps": [
238
- "Enable versioning on the bucket.",
239
- "Consider adding lifecycle rules to manage version storage costs."
240
- ],
241
- "severity": "LOW",
242
- "priority": "P3",
243
- "module": "s3"
244
- },
245
- {
246
- "riskScore": 3,
247
- "title": "S3 bucket elasticbeanstalk-cn-north-1-468254682119 does not have versioning enabled",
248
- "resourceType": "AWS::S3::Bucket",
249
- "resourceId": "elasticbeanstalk-cn-north-1-468254682119",
250
- "resourceArn": "arn:aws-cn:s3:::elasticbeanstalk-cn-north-1-468254682119",
251
- "region": "cn-north-1",
252
- "description": "Bucket \"elasticbeanstalk-cn-north-1-468254682119\" versioning is not set.",
253
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
254
- "remediationSteps": [
255
- "Enable versioning on the bucket.",
256
- "Consider adding lifecycle rules to manage version storage costs."
257
- ],
258
- "severity": "LOW",
259
- "priority": "P3",
260
- "module": "s3"
261
- },
262
- {
263
- "riskScore": 3,
264
- "title": "S3 bucket flowlog-query does not have versioning enabled",
265
- "resourceType": "AWS::S3::Bucket",
266
- "resourceId": "flowlog-query",
267
- "resourceArn": "arn:aws-cn:s3:::flowlog-query",
268
- "region": "cn-north-1",
269
- "description": "Bucket \"flowlog-query\" versioning is not set.",
270
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
271
- "remediationSteps": [
272
- "Enable versioning on the bucket.",
273
- "Consider adding lifecycle rules to manage version storage costs."
274
- ],
275
- "severity": "LOW",
276
- "priority": "P3",
277
- "module": "s3"
278
- },
279
- {
280
- "riskScore": 3,
281
- "title": "S3 bucket gluetest123 does not have versioning enabled",
282
- "resourceType": "AWS::S3::Bucket",
283
- "resourceId": "gluetest123",
284
- "resourceArn": "arn:aws-cn:s3:::gluetest123",
285
- "region": "cn-northwest-1",
286
- "description": "Bucket \"gluetest123\" versioning is not set.",
287
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
288
- "remediationSteps": [
289
- "Enable versioning on the bucket.",
290
- "Consider adding lifecycle rules to manage version storage costs."
291
- ],
292
- "severity": "LOW",
293
- "priority": "P3",
294
- "module": "s3"
295
- },
296
- {
297
- "riskScore": 3,
298
- "title": "S3 bucket new-announcement-1-layerbucket-qq68fwstawit does not have versioning enabled",
299
- "resourceType": "AWS::S3::Bucket",
300
- "resourceId": "new-announcement-1-layerbucket-qq68fwstawit",
301
- "resourceArn": "arn:aws-cn:s3:::new-announcement-1-layerbucket-qq68fwstawit",
302
- "region": "cn-north-1",
303
- "description": "Bucket \"new-announcement-1-layerbucket-qq68fwstawit\" versioning is not set.",
304
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
305
- "remediationSteps": [
306
- "Enable versioning on the bucket.",
307
- "Consider adding lifecycle rules to manage version storage costs."
308
- ],
309
- "severity": "LOW",
310
- "priority": "P3",
311
- "module": "s3"
312
- },
313
- {
314
- "riskScore": 3,
315
- "title": "S3 bucket new-announcement-layerbucket-mrdnacn5wydm does not have versioning enabled",
316
- "resourceType": "AWS::S3::Bucket",
317
- "resourceId": "new-announcement-layerbucket-mrdnacn5wydm",
318
- "resourceArn": "arn:aws-cn:s3:::new-announcement-layerbucket-mrdnacn5wydm",
319
- "region": "cn-north-1",
320
- "description": "Bucket \"new-announcement-layerbucket-mrdnacn5wydm\" versioning is not set.",
321
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
322
- "remediationSteps": [
323
- "Enable versioning on the bucket.",
324
- "Consider adding lifecycle rules to manage version storage costs."
325
- ],
326
- "severity": "LOW",
327
- "priority": "P3",
328
- "module": "s3"
329
- },
330
- {
331
- "riskScore": 3,
332
- "title": "S3 bucket niodbr does not have versioning enabled",
333
- "resourceType": "AWS::S3::Bucket",
334
- "resourceId": "niodbr",
335
- "resourceArn": "arn:aws-cn:s3:::niodbr",
336
- "region": "cn-north-1",
337
- "description": "Bucket \"niodbr\" versioning is not set.",
338
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
339
- "remediationSteps": [
340
- "Enable versioning on the bucket.",
341
- "Consider adding lifecycle rules to manage version storage costs."
342
- ],
343
- "severity": "LOW",
344
- "priority": "P3",
345
- "module": "s3"
346
- },
347
- {
348
- "riskScore": 3,
349
- "title": "S3 bucket s3-proxy-test does not have versioning enabled",
350
- "resourceType": "AWS::S3::Bucket",
351
- "resourceId": "s3-proxy-test",
352
- "resourceArn": "arn:aws-cn:s3:::s3-proxy-test",
353
- "region": "cn-north-1",
354
- "description": "Bucket \"s3-proxy-test\" versioning is not set.",
355
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
356
- "remediationSteps": [
357
- "Enable versioning on the bucket.",
358
- "Consider adding lifecycle rules to manage version storage costs."
359
- ],
360
- "severity": "LOW",
361
- "priority": "P3",
362
- "module": "s3"
363
- },
364
- {
365
- "riskScore": 3,
366
- "title": "S3 bucket s3-sync-source does not have versioning enabled",
367
- "resourceType": "AWS::S3::Bucket",
368
- "resourceId": "s3-sync-source",
369
- "resourceArn": "arn:aws-cn:s3:::s3-sync-source",
370
- "region": "cn-northwest-1",
371
- "description": "Bucket \"s3-sync-source\" versioning is not set.",
372
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
373
- "remediationSteps": [
374
- "Enable versioning on the bucket.",
375
- "Consider adding lifecycle rules to manage version storage costs."
376
- ],
377
- "severity": "LOW",
378
- "priority": "P3",
379
- "module": "s3"
380
- },
381
- {
382
- "riskScore": 3,
383
- "title": "S3 bucket sagemaker-studio-468254682119-4buvn7imlhw does not have versioning enabled",
384
- "resourceType": "AWS::S3::Bucket",
385
- "resourceId": "sagemaker-studio-468254682119-4buvn7imlhw",
386
- "resourceArn": "arn:aws-cn:s3:::sagemaker-studio-468254682119-4buvn7imlhw",
387
- "region": "cn-north-1",
388
- "description": "Bucket \"sagemaker-studio-468254682119-4buvn7imlhw\" versioning is not set.",
389
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
390
- "remediationSteps": [
391
- "Enable versioning on the bucket.",
392
- "Consider adding lifecycle rules to manage version storage costs."
393
- ],
394
- "severity": "LOW",
395
- "priority": "P3",
396
- "module": "s3"
397
- },
398
- {
399
- "riskScore": 3,
400
- "title": "S3 bucket sagemaker-studio-468254682119-5rby7mo1jdj does not have versioning enabled",
401
- "resourceType": "AWS::S3::Bucket",
402
- "resourceId": "sagemaker-studio-468254682119-5rby7mo1jdj",
403
- "resourceArn": "arn:aws-cn:s3:::sagemaker-studio-468254682119-5rby7mo1jdj",
404
- "region": "cn-north-1",
405
- "description": "Bucket \"sagemaker-studio-468254682119-5rby7mo1jdj\" versioning is not set.",
406
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
407
- "remediationSteps": [
408
- "Enable versioning on the bucket.",
409
- "Consider adding lifecycle rules to manage version storage costs."
410
- ],
411
- "severity": "LOW",
412
- "priority": "P3",
413
- "module": "s3"
414
- },
415
- {
416
- "riskScore": 3,
417
- "title": "S3 bucket sagemaker-studio-468254682119-ki9n6806iyk does not have versioning enabled",
418
- "resourceType": "AWS::S3::Bucket",
419
- "resourceId": "sagemaker-studio-468254682119-ki9n6806iyk",
420
- "resourceArn": "arn:aws-cn:s3:::sagemaker-studio-468254682119-ki9n6806iyk",
421
- "region": "cn-northwest-1",
422
- "description": "Bucket \"sagemaker-studio-468254682119-ki9n6806iyk\" versioning is not set.",
423
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
424
- "remediationSteps": [
425
- "Enable versioning on the bucket.",
426
- "Consider adding lifecycle rules to manage version storage costs."
427
- ],
428
- "severity": "LOW",
429
- "priority": "P3",
430
- "module": "s3"
431
- },
432
- {
433
- "riskScore": 3,
434
- "title": "S3 bucket sagemaker-studio-468254682119-xfg0l0rg8s does not have versioning enabled",
435
- "resourceType": "AWS::S3::Bucket",
436
- "resourceId": "sagemaker-studio-468254682119-xfg0l0rg8s",
437
- "resourceArn": "arn:aws-cn:s3:::sagemaker-studio-468254682119-xfg0l0rg8s",
438
- "region": "cn-north-1",
439
- "description": "Bucket \"sagemaker-studio-468254682119-xfg0l0rg8s\" versioning is not set.",
440
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
441
- "remediationSteps": [
442
- "Enable versioning on the bucket.",
443
- "Consider adding lifecycle rules to manage version storage costs."
444
- ],
445
- "severity": "LOW",
446
- "priority": "P3",
447
- "module": "s3"
448
- },
449
- {
450
- "riskScore": 3,
451
- "title": "S3 bucket terraform-states-test does not have versioning enabled",
452
- "resourceType": "AWS::S3::Bucket",
453
- "resourceId": "terraform-states-test",
454
- "resourceArn": "arn:aws-cn:s3:::terraform-states-test",
455
- "region": "cn-north-1",
456
- "description": "Bucket \"terraform-states-test\" versioning is not set.",
457
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
458
- "remediationSteps": [
459
- "Enable versioning on the bucket.",
460
- "Consider adding lifecycle rules to manage version storage costs."
461
- ],
462
- "severity": "LOW",
463
- "priority": "P3",
464
- "module": "s3"
465
- },
466
- {
467
- "riskScore": 3,
468
- "title": "S3 bucket tesla-cur does not have versioning enabled",
469
- "resourceType": "AWS::S3::Bucket",
470
- "resourceId": "tesla-cur",
471
- "resourceArn": "arn:aws-cn:s3:::tesla-cur",
472
- "region": "cn-north-1",
473
- "description": "Bucket \"tesla-cur\" versioning is not set.",
474
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
475
- "remediationSteps": [
476
- "Enable versioning on the bucket.",
477
- "Consider adding lifecycle rules to manage version storage costs."
478
- ],
479
- "severity": "LOW",
480
- "priority": "P3",
481
- "module": "s3"
482
- },
483
- {
484
- "riskScore": 3,
485
- "title": "S3 bucket tesla-dbr does not have versioning enabled",
486
- "resourceType": "AWS::S3::Bucket",
487
- "resourceId": "tesla-dbr",
488
- "resourceArn": "arn:aws-cn:s3:::tesla-dbr",
489
- "region": "cn-north-1",
490
- "description": "Bucket \"tesla-dbr\" versioning is not set.",
491
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
492
- "remediationSteps": [
493
- "Enable versioning on the bucket.",
494
- "Consider adding lifecycle rules to manage version storage costs."
495
- ],
496
- "severity": "LOW",
497
- "priority": "P3",
498
- "module": "s3"
499
- },
500
- {
501
- "riskScore": 3,
502
- "title": "S3 bucket test-s3-access-log does not have versioning enabled",
503
- "resourceType": "AWS::S3::Bucket",
504
- "resourceId": "test-s3-access-log",
505
- "resourceArn": "arn:aws-cn:s3:::test-s3-access-log",
506
- "region": "cn-north-1",
507
- "description": "Bucket \"test-s3-access-log\" versioning is not set.",
508
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
509
- "remediationSteps": [
510
- "Enable versioning on the bucket.",
511
- "Consider adding lifecycle rules to manage version storage costs."
512
- ],
513
- "severity": "LOW",
514
- "priority": "P3",
515
- "module": "s3"
53
+ "module": "tag_compliance",
54
+ "findingsCount": 3,
55
+ "status": "success"
516
56
  },
517
57
  {
518
- "riskScore": 3,
519
- "title": "S3 bucket test-volvo does not have versioning enabled",
520
- "resourceType": "AWS::S3::Bucket",
521
- "resourceId": "test-volvo",
522
- "resourceArn": "arn:aws-cn:s3:::test-volvo",
523
- "region": "cn-north-1",
524
- "description": "Bucket \"test-volvo\" versioning is not set.",
525
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
526
- "remediationSteps": [
527
- "Enable versioning on the bucket.",
528
- "Consider adding lifecycle rules to manage version storage costs."
529
- ],
530
- "severity": "LOW",
531
- "priority": "P3",
532
- "module": "s3"
58
+ "module": "idle_resources",
59
+ "findingsCount": 2,
60
+ "status": "success"
533
61
  },
534
62
  {
535
- "riskScore": 3,
536
- "title": "S3 bucket volvo123 does not have versioning enabled",
537
- "resourceType": "AWS::S3::Bucket",
538
- "resourceId": "volvo123",
539
- "resourceArn": "arn:aws-cn:s3:::volvo123",
540
- "region": "cn-north-1",
541
- "description": "Bucket \"volvo123\" versioning is not set.",
542
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
543
- "remediationSteps": [
544
- "Enable versioning on the bucket.",
545
- "Consider adding lifecycle rules to manage version storage costs."
546
- ],
547
- "severity": "LOW",
548
- "priority": "P3",
549
- "module": "s3"
63
+ "module": "disaster_recovery",
64
+ "findingsCount": 1,
65
+ "status": "success"
550
66
  },
551
67
  {
552
- "riskScore": 3,
553
- "title": "S3 bucket webtest does not have versioning enabled",
554
- "resourceType": "AWS::S3::Bucket",
555
- "resourceId": "webtest",
556
- "resourceArn": "arn:aws-cn:s3:::webtest",
557
- "region": "cn-north-1",
558
- "description": "Bucket \"webtest\" versioning is not set.",
559
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
560
- "remediationSteps": [
561
- "Enable versioning on the bucket.",
562
- "Consider adding lifecycle rules to manage version storage costs."
563
- ],
564
- "severity": "LOW",
565
- "priority": "P3",
566
- "module": "s3"
68
+ "module": "security_hub_findings",
69
+ "findingsCount": 2,
70
+ "status": "success"
567
71
  },
568
72
  {
569
- "riskScore": 3,
570
- "title": "S3 bucket will does not have versioning enabled",
571
- "resourceType": "AWS::S3::Bucket",
572
- "resourceId": "will",
573
- "resourceArn": "arn:aws-cn:s3:::will",
574
- "region": "cn-north-1",
575
- "description": "Bucket \"will\" versioning is not set.",
576
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
577
- "remediationSteps": [
578
- "Enable versioning on the bucket.",
579
- "Consider adding lifecycle rules to manage version storage costs."
580
- ],
581
- "severity": "LOW",
582
- "priority": "P3",
583
- "module": "s3"
73
+ "module": "guardduty_findings",
74
+ "findingsCount": 0,
75
+ "status": "success"
584
76
  },
585
77
  {
586
- "riskScore": 3,
587
- "title": "S3 bucket will-flowlog does not have versioning enabled",
588
- "resourceType": "AWS::S3::Bucket",
589
- "resourceId": "will-flowlog",
590
- "resourceArn": "arn:aws-cn:s3:::will-flowlog",
591
- "region": "cn-north-1",
592
- "description": "Bucket \"will-flowlog\" versioning is not set.",
593
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
594
- "remediationSteps": [
595
- "Enable versioning on the bucket.",
596
- "Consider adding lifecycle rules to manage version storage costs."
597
- ],
598
- "severity": "LOW",
599
- "priority": "P3",
600
- "module": "s3"
78
+ "module": "inspector_findings",
79
+ "findingsCount": 0,
80
+ "status": "success"
601
81
  },
602
82
  {
603
- "riskScore": 3,
604
- "title": "S3 bucket will-pc-backup does not have versioning enabled",
605
- "resourceType": "AWS::S3::Bucket",
606
- "resourceId": "will-pc-backup",
607
- "resourceArn": "arn:aws-cn:s3:::will-pc-backup",
608
- "region": "cn-north-1",
609
- "description": "Bucket \"will-pc-backup\" versioning is not set.",
610
- "impact": "Accidental deletion or overwrite of objects cannot be recovered.",
611
- "remediationSteps": [
612
- "Enable versioning on the bucket.",
613
- "Consider adding lifecycle rules to manage version storage costs."
614
- ],
615
- "severity": "LOW",
616
- "priority": "P3",
617
- "module": "s3"
618
- },
83
+ "module": "trusted_advisor_findings",
84
+ "findingsCount": 0,
85
+ "status": "success"
86
+ }
87
+ ],
88
+ "findings": [
619
89
  {
620
90
  "riskScore": 7.5,
621
- "title": "IAM user hzhaoam has access key older than 90 days",
622
- "resourceType": "AWS::IAM::AccessKey",
623
- "resourceId": "AKIAW2BRHNQD6OGWH6VQ",
624
- "resourceArn": "arn:aws-cn:iam::468254682119:user/hzhaoam",
625
- "region": "global",
626
- "description": "Access key AKIAW2BRHNQD6OGWH6VQ for user \"hzhaoam\" is 1800 days old.",
627
- "impact": "Old access keys are more likely to have been exposed or leaked over time.",
91
+ "title": "GuardDuty is not enabled",
92
+ "resourceType": "AWS::GuardDuty::Detector",
93
+ "resourceId": "guardduty-cn-north-1",
94
+ "resourceArn": "arn:aws-cn:guardduty:cn-north-1:468254682119:detector/not-enabled",
95
+ "region": "cn-north-1",
96
+ "description": "Amazon GuardDuty is not enabled in cn-north-1.",
97
+ "impact": "No continuous threat detection for account compromise, instance compromise, or reconnaissance.",
628
98
  "remediationSteps": [
629
- "Rotate the access key by creating a new key and deleting the old one.",
630
- "Implement an access key rotation policy (maximum 90 days).",
631
- "Consider using IAM roles or temporary credentials instead."
99
+ "Enable GuardDuty in the AWS console or via API.",
100
+ "GuardDuty offers a 30-day free trial."
632
101
  ],
633
102
  "severity": "HIGH",
634
103
  "priority": "P1",
635
- "module": "iam"
104
+ "module": "service_detection"
636
105
  },
637
106
  {
638
- "riskScore": 5.5,
639
- "title": "CloudTrail trail nwcd-org-cloudtrail-logs not integrated with CloudWatch Logs",
640
- "resourceType": "AWS::CloudTrail::Trail",
641
- "resourceId": "nwcd-org-cloudtrail-logs",
642
- "resourceArn": "arn:aws-cn:cloudtrail:cn-northwest-1:362115975032:trail/nwcd-org-cloudtrail-logs",
643
- "region": "cn-north-1",
644
- "description": "Trail \"nwcd-org-cloudtrail-logs\" is not configured to deliver logs to CloudWatch Logs.",
645
- "impact": "Real-time monitoring and alerting on API activity is not possible without CloudWatch Logs integration.",
646
- "remediationSteps": [
647
- "Configure the trail to deliver logs to a CloudWatch Logs log group.",
648
- "Create metric filters and alarms for critical security events."
649
- ],
650
- "severity": "MEDIUM",
651
- "priority": "P2",
652
- "module": "cloudtrail"
653
- },
654
- {
655
- "riskScore": 6,
656
- "title": "CloudTrail trail test-management-events has no log file validation",
657
- "resourceType": "AWS::CloudTrail::Trail",
658
- "resourceId": "test-management-events",
659
- "resourceArn": "arn:aws-cn:cloudtrail:cn-north-1:468254682119:trail/test-management-events",
107
+ "riskScore": 6.0,
108
+ "title": "Inspector is not enabled",
109
+ "resourceType": "AWS::Inspector2::Inspector",
110
+ "resourceId": "inspector-cn-north-1",
111
+ "resourceArn": "arn:aws-cn:inspector2:cn-north-1:468254682119:inspector/not-enabled",
660
112
  "region": "cn-north-1",
661
- "description": "Trail \"test-management-events\" does not have log file validation enabled.",
662
- "impact": "Log files could be modified or deleted without detection, undermining audit integrity.",
113
+ "description": "Amazon Inspector is not enabled in cn-north-1.",
114
+ "impact": "No automated vulnerability scanning for EC2 instances, Lambda functions, or container images.",
663
115
  "remediationSteps": [
664
- "Enable log file validation on the trail.",
665
- "This creates digest files that can be used to verify log integrity."
116
+ "Enable Inspector in the AWS console.",
117
+ "Inspector offers a 15-day free trial."
666
118
  ],
667
119
  "severity": "MEDIUM",
668
120
  "priority": "P2",
669
- "module": "cloudtrail"
121
+ "module": "service_detection"
670
122
  },
671
123
  {
672
- "riskScore": 5.5,
673
- "title": "CloudTrail trail test-management-events not integrated with CloudWatch Logs",
674
- "resourceType": "AWS::CloudTrail::Trail",
675
- "resourceId": "test-management-events",
676
- "resourceArn": "arn:aws-cn:cloudtrail:cn-north-1:468254682119:trail/test-management-events",
124
+ "riskScore": 8.0,
125
+ "title": "EC2 instance i-0abc123 has SSH (22) reachable from 0.0.0.0/0",
126
+ "resourceType": "AWS::EC2::Instance",
127
+ "resourceId": "i-0abc123",
128
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:instance/i-0abc123",
677
129
  "region": "cn-north-1",
678
- "description": "Trail \"test-management-events\" is not configured to deliver logs to CloudWatch Logs.",
679
- "impact": "Real-time monitoring and alerting on API activity is not possible without CloudWatch Logs integration.",
130
+ "description": "Instance i-0abc123 has SSH port 22 reachable from the internet via SG + NACL analysis.",
131
+ "impact": "SSH exposed to the internet increases brute-force and credential stuffing risk.",
680
132
  "remediationSteps": [
681
- "Configure the trail to deliver logs to a CloudWatch Logs log group.",
682
- "Create metric filters and alarms for critical security events."
683
- ],
684
- "severity": "MEDIUM",
685
- "priority": "P2",
686
- "module": "cloudtrail"
687
- },
688
- {
689
- "riskScore": 7,
690
- "title": "EBS default encryption is not enabled in cn-north-1",
691
- "resourceType": "AWS::EC2::EBSDefaultEncryption",
692
- "resourceId": "ebs-default-cn-north-1",
693
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:ebs-default-encryption",
694
- "region": "cn-north-1",
695
- "description": "EBS default encryption is not enabled in region cn-north-1.",
696
- "impact": "Newly created EBS volumes will not be encrypted by default, requiring manual encryption per volume.",
697
- "remediationSteps": [
698
- "Enable EBS encryption by default for the region using the EC2 console or API.",
699
- "This ensures all new volumes and snapshots are automatically encrypted."
133
+ "Restrict port 22 to known IP ranges.",
134
+ "Use AWS Systems Manager Session Manager instead of SSH."
700
135
  ],
701
136
  "severity": "HIGH",
702
137
  "priority": "P1",
703
- "module": "ebs"
704
- },
705
- {
706
- "riskScore": 6,
707
- "title": "EBS volume vol-0eac0a11ed76b3c38 is not encrypted",
708
- "resourceType": "AWS::EC2::Volume",
709
- "resourceId": "vol-0eac0a11ed76b3c38",
710
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:volume/vol-0eac0a11ed76b3c38",
711
- "region": "cn-north-1",
712
- "description": "EBS volume \"vol-0eac0a11ed76b3c38\" (200GB, in-use) is not encrypted.",
713
- "impact": "Data on this volume is stored unencrypted. A compromised snapshot or physical media could expose data.",
714
- "remediationSteps": [
715
- "Create an encrypted snapshot of this volume.",
716
- "Create a new encrypted volume from the snapshot.",
717
- "Migrate data to the new encrypted volume and delete the old one."
718
- ],
719
- "severity": "MEDIUM",
720
- "priority": "P2",
721
- "module": "ebs"
138
+ "module": "network_reachability"
722
139
  },
723
140
  {
724
- "riskScore": 6,
725
- "title": "EBS volume vol-0df6a1e35847c7e77 is not encrypted",
726
- "resourceType": "AWS::EC2::Volume",
727
- "resourceId": "vol-0df6a1e35847c7e77",
728
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:volume/vol-0df6a1e35847c7e77",
729
- "region": "cn-north-1",
730
- "description": "EBS volume \"vol-0df6a1e35847c7e77\" (40GB, in-use) is not encrypted.",
731
- "impact": "Data on this volume is stored unencrypted. A compromised snapshot or physical media could expose data.",
141
+ "riskScore": 7.0,
142
+ "title": "IAM user admin-user can escalate privileges via iam:CreatePolicyVersion",
143
+ "resourceType": "AWS::IAM::User",
144
+ "resourceId": "admin-user",
145
+ "resourceArn": "arn:aws-cn:iam::468254682119:user/admin-user",
146
+ "region": "global",
147
+ "description": "User admin-user has iam:CreatePolicyVersion permission which allows creating a new policy version with full admin access.",
148
+ "impact": "Privilege escalation to full administrator access.",
732
149
  "remediationSteps": [
733
- "Create an encrypted snapshot of this volume.",
734
- "Create a new encrypted volume from the snapshot.",
735
- "Migrate data to the new encrypted volume and delete the old one."
150
+ "Remove iam:CreatePolicyVersion from the user's permissions.",
151
+ "Use AWS Organizations SCPs to prevent privilege escalation."
736
152
  ],
737
153
  "severity": "MEDIUM",
738
154
  "priority": "P2",
739
- "module": "ebs"
155
+ "module": "iam_privilege_escalation"
740
156
  },
741
157
  {
742
- "riskScore": 6,
743
- "title": "EBS volume vol-0c92b56ebb3aa05ae is not encrypted",
744
- "resourceType": "AWS::EC2::Volume",
745
- "resourceId": "vol-0c92b56ebb3aa05ae",
746
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:volume/vol-0c92b56ebb3aa05ae",
158
+ "riskScore": 3.5,
159
+ "title": "EC2 instance i-0def456 missing required tag: Environment",
160
+ "resourceType": "AWS::EC2::Instance",
161
+ "resourceId": "i-0def456",
162
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:instance/i-0def456",
747
163
  "region": "cn-north-1",
748
- "description": "EBS volume \"vol-0c92b56ebb3aa05ae\" (500GB, in-use) is not encrypted.",
749
- "impact": "Data on this volume is stored unencrypted. A compromised snapshot or physical media could expose data.",
164
+ "description": "Instance i-0def456 is missing the required 'Environment' tag.",
165
+ "impact": "Cannot determine resource environment for cost allocation and access control.",
750
166
  "remediationSteps": [
751
- "Create an encrypted snapshot of this volume.",
752
- "Create a new encrypted volume from the snapshot.",
753
- "Migrate data to the new encrypted volume and delete the old one."
167
+ "Add the 'Environment' tag with an appropriate value (e.g., production, staging, dev)."
754
168
  ],
755
- "severity": "MEDIUM",
756
- "priority": "P2",
757
- "module": "ebs"
169
+ "severity": "LOW",
170
+ "priority": "P3",
171
+ "module": "tag_compliance"
758
172
  },
759
173
  {
760
- "riskScore": 5.5,
761
- "title": "EBS snapshot snap-055bc19828e4e3092 is not encrypted",
762
- "resourceType": "AWS::EC2::Snapshot",
763
- "resourceId": "snap-055bc19828e4e3092",
764
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-055bc19828e4e3092",
174
+ "riskScore": 3.5,
175
+ "title": "EC2 instance i-0def456 missing required tag: Project",
176
+ "resourceType": "AWS::EC2::Instance",
177
+ "resourceId": "i-0def456",
178
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:instance/i-0def456",
765
179
  "region": "cn-north-1",
766
- "description": "EBS snapshot \"snap-055bc19828e4e3092\" (volume: vol-05f6c4160ac0a93e6) is not encrypted.",
767
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
180
+ "description": "Instance i-0def456 is missing the required 'Project' tag.",
181
+ "impact": "Cannot determine project ownership for cost allocation.",
768
182
  "remediationSteps": [
769
- "Copy the snapshot with encryption enabled.",
770
- "Delete the unencrypted snapshot after verifying the encrypted copy."
183
+ "Add the 'Project' tag with the appropriate project name."
771
184
  ],
772
- "severity": "MEDIUM",
773
- "priority": "P2",
774
- "module": "ebs"
185
+ "severity": "LOW",
186
+ "priority": "P3",
187
+ "module": "tag_compliance"
775
188
  },
776
189
  {
777
- "riskScore": 5.5,
778
- "title": "EBS snapshot snap-031bfc4c9db6428ef is not encrypted",
779
- "resourceType": "AWS::EC2::Snapshot",
780
- "resourceId": "snap-031bfc4c9db6428ef",
781
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-031bfc4c9db6428ef",
190
+ "riskScore": 3.5,
191
+ "title": "EC2 instance i-0def456 missing required tag: Owner",
192
+ "resourceType": "AWS::EC2::Instance",
193
+ "resourceId": "i-0def456",
194
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:instance/i-0def456",
782
195
  "region": "cn-north-1",
783
- "description": "EBS snapshot \"snap-031bfc4c9db6428ef\" (volume: vol-0d6aaae479efcf0b0) is not encrypted.",
784
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
196
+ "description": "Instance i-0def456 is missing the required 'Owner' tag.",
197
+ "impact": "Cannot determine resource ownership.",
785
198
  "remediationSteps": [
786
- "Copy the snapshot with encryption enabled.",
787
- "Delete the unencrypted snapshot after verifying the encrypted copy."
199
+ "Add the 'Owner' tag with the responsible team or individual."
788
200
  ],
789
- "severity": "MEDIUM",
790
- "priority": "P2",
791
- "module": "ebs"
201
+ "severity": "LOW",
202
+ "priority": "P3",
203
+ "module": "tag_compliance"
792
204
  },
793
205
  {
794
- "riskScore": 5.5,
795
- "title": "EBS snapshot snap-0f4dbd4e045f4f9e3 is not encrypted",
796
- "resourceType": "AWS::EC2::Snapshot",
797
- "resourceId": "snap-0f4dbd4e045f4f9e3",
798
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-0f4dbd4e045f4f9e3",
206
+ "riskScore": 4.0,
207
+ "title": "Unattached EBS volume vol-0aaa111",
208
+ "resourceType": "AWS::EC2::Volume",
209
+ "resourceId": "vol-0aaa111",
210
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:volume/vol-0aaa111",
799
211
  "region": "cn-north-1",
800
- "description": "EBS snapshot \"snap-0f4dbd4e045f4f9e3\" (volume: vol-0be166f626acbc0c3) is not encrypted.",
801
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
212
+ "description": "EBS volume vol-0aaa111 (100GB, gp3) is not attached to any instance.",
213
+ "impact": "Unused volume incurs storage costs and may contain stale data.",
802
214
  "remediationSteps": [
803
- "Copy the snapshot with encryption enabled.",
804
- "Delete the unencrypted snapshot after verifying the encrypted copy."
215
+ "Snapshot the volume if data is needed, then delete it.",
216
+ "Attach it to an instance if still required."
805
217
  ],
806
218
  "severity": "MEDIUM",
807
219
  "priority": "P2",
808
- "module": "ebs"
220
+ "module": "idle_resources"
809
221
  },
810
222
  {
811
- "riskScore": 5.5,
812
- "title": "EBS snapshot snap-0ef0b31b558e620d4 is not encrypted",
813
- "resourceType": "AWS::EC2::Snapshot",
814
- "resourceId": "snap-0ef0b31b558e620d4",
815
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-0ef0b31b558e620d4",
223
+ "riskScore": 3.5,
224
+ "title": "Unused Elastic IP 1.2.3.4",
225
+ "resourceType": "AWS::EC2::EIP",
226
+ "resourceId": "eipalloc-0bbb222",
227
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:elastic-ip/eipalloc-0bbb222",
816
228
  "region": "cn-north-1",
817
- "description": "EBS snapshot \"snap-0ef0b31b558e620d4\" (volume: vol-0df6a1e35847c7e77) is not encrypted.",
818
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
229
+ "description": "Elastic IP 1.2.3.4 is not associated with any instance or network interface.",
230
+ "impact": "Unused EIPs incur hourly charges.",
819
231
  "remediationSteps": [
820
- "Copy the snapshot with encryption enabled.",
821
- "Delete the unencrypted snapshot after verifying the encrypted copy."
232
+ "Release the Elastic IP if no longer needed."
822
233
  ],
823
- "severity": "MEDIUM",
824
- "priority": "P2",
825
- "module": "ebs"
234
+ "severity": "LOW",
235
+ "priority": "P3",
236
+ "module": "idle_resources"
826
237
  },
827
238
  {
828
239
  "riskScore": 5.5,
829
- "title": "EBS snapshot snap-0e0f19b1ae5393d69 is not encrypted",
830
- "resourceType": "AWS::EC2::Snapshot",
831
- "resourceId": "snap-0e0f19b1ae5393d69",
832
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-0e0f19b1ae5393d69",
240
+ "title": "RDS instance mydb-prod does not have Multi-AZ enabled",
241
+ "resourceType": "AWS::RDS::DBInstance",
242
+ "resourceId": "mydb-prod",
243
+ "resourceArn": "arn:aws-cn:rds:cn-north-1:468254682119:db:mydb-prod",
833
244
  "region": "cn-north-1",
834
- "description": "EBS snapshot \"snap-0e0f19b1ae5393d69\" (volume: vol-0df6a1e35847c7e77) is not encrypted.",
835
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
245
+ "description": "RDS instance mydb-prod is not configured for Multi-AZ deployment.",
246
+ "impact": "Single point of failure — an AZ outage will cause database downtime.",
836
247
  "remediationSteps": [
837
- "Copy the snapshot with encryption enabled.",
838
- "Delete the unencrypted snapshot after verifying the encrypted copy."
248
+ "Enable Multi-AZ for the RDS instance.",
249
+ "This provides automatic failover to a standby in a different AZ."
839
250
  ],
840
251
  "severity": "MEDIUM",
841
252
  "priority": "P2",
842
- "module": "ebs"
253
+ "module": "disaster_recovery"
843
254
  },
844
255
  {
845
256
  "riskScore": 5.5,
846
- "title": "EBS snapshot snap-050d8b9be81aa28a7 is not encrypted",
847
- "resourceType": "AWS::EC2::Snapshot",
848
- "resourceId": "snap-050d8b9be81aa28a7",
849
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-050d8b9be81aa28a7",
257
+ "title": "[Security Hub] S3.8 — S3 Block Public Access setting should be enabled at the bucket level",
258
+ "resourceType": "AWS::S3::Bucket",
259
+ "resourceId": "example-bucket",
260
+ "resourceArn": "arn:aws-cn:s3:::example-bucket",
850
261
  "region": "cn-north-1",
851
- "description": "EBS snapshot \"snap-050d8b9be81aa28a7\" (volume: vol-019b7411771fdd09d) is not encrypted.",
852
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
262
+ "description": "FSBP control S3.8: S3 Block Public Access not enabled at bucket level.",
263
+ "impact": "Bucket may be publicly accessible.",
853
264
  "remediationSteps": [
854
- "Copy the snapshot with encryption enabled.",
855
- "Delete the unencrypted snapshot after verifying the encrypted copy."
265
+ "Enable S3 Block Public Access at the bucket level."
856
266
  ],
857
267
  "severity": "MEDIUM",
858
268
  "priority": "P2",
859
- "module": "ebs"
269
+ "module": "security_hub_findings"
860
270
  },
861
271
  {
862
272
  "riskScore": 5.5,
863
- "title": "EBS snapshot snap-00b95c437eab79cf6 is not encrypted",
864
- "resourceType": "AWS::EC2::Snapshot",
865
- "resourceId": "snap-00b95c437eab79cf6",
866
- "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:snapshot/snap-00b95c437eab79cf6",
273
+ "title": "[Security Hub] EC2.2 — VPC default security group should not allow inbound or outbound traffic",
274
+ "resourceType": "AWS::EC2::SecurityGroup",
275
+ "resourceId": "sg-default",
276
+ "resourceArn": "arn:aws-cn:ec2:cn-north-1:468254682119:security-group/sg-default",
867
277
  "region": "cn-north-1",
868
- "description": "EBS snapshot \"snap-00b95c437eab79cf6\" (volume: vol-0eac0a11ed76b3c38) is not encrypted.",
869
- "impact": "Unencrypted snapshots can be copied or shared, exposing data without encryption protection.",
278
+ "description": "FSBP control EC2.2: Default VPC security group allows traffic.",
279
+ "impact": "Resources using the default security group may have unintended network access.",
870
280
  "remediationSteps": [
871
- "Copy the snapshot with encryption enabled.",
872
- "Delete the unencrypted snapshot after verifying the encrypted copy."
281
+ "Remove all inbound and outbound rules from the default security group."
873
282
  ],
874
283
  "severity": "MEDIUM",
875
284
  "priority": "P2",
876
- "module": "ebs"
285
+ "module": "security_hub_findings"
877
286
  }
878
287
  ]
879
288
  },
880
289
  "history": [
881
290
  {
882
291
  "date": "2026-04-10",
883
- "score": 43,
292
+ "score": 72,
884
293
  "critical": 0,
885
- "high": 3,
886
- "medium": 13,
887
- "low": 32,
888
- "totalFindings": 48
294
+ "high": 2,
295
+ "medium": 5,
296
+ "low": 5,
297
+ "totalFindings": 12
889
298
  }
890
299
  ],
891
300
  "meta": {
@@ -893,4 +302,4 @@
893
302
  "version": "1.0.0",
894
303
  "dataRetentionDays": 30
895
304
  }
896
- }
305
+ }