prowler-cloud 5.13.1__py3-none-any.whl → 5.14.1__py3-none-any.whl

prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.metadata.json

@@ -1,32 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "ecs_task_definitions_no_privileged_containers",
-  "CheckTitle": "ECS task definitions shouldn't have privileged containers",
+  "CheckTitle": "ECS task definition has no privileged containers",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS Host Hardening Benchmarks",
+    "TTPs/Privilege Escalation"
   ],
   "ServiceName": "ecs",
-  "SubServiceName": "taskDefinition",
-  "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-definition/{task-definition-name}",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEcsTaskDefinition",
-  "Description": "This control checks if the privileged parameter in the container definition of Amazon ECS Task Definitions is set to true. The control fails if this parameter is equal to true.",
-  "Risk": "Running containers with elevated privileges increases the risk of privilege escalation attacks, potentially allowing unauthorized access to the host and other containers.",
-  "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-containers-nonprivileged.html",
+  "Description": "**Amazon ECS task definitions** are evaluated for containers configured with **privileged mode** (`privileged: true`).\n\nThe outcome indicates whether any container definition enables this setting.",
+  "Risk": "**Privileged containers** can act with host-level root, breaking isolation. A foothold lets attackers achieve **container escape**, mount host devices, read secrets, alter configs, and control other workloads-impacting confidentiality, integrity, and availability via data theft, tampering, and service disruption.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/config/latest/developerguide/ecs-containers-nonprivileged.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-4",
+    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_security"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws ecs register-task-definition --family <task-family> --container-definitions '[{\"name\":\"<container-name>\",\"image\":\"<image>\",\"privileged\":false}]'",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-4",
-      "Terraform": ""
+      "CLI": "aws ecs deregister-task-definition --task-definition <task-family>:<revision>",
+      "NativeIaC": "```yaml\n# CloudFormation: ECS task definition with non-privileged container\nResources:\n  <example_resource_name>:\n    Type: AWS::ECS::TaskDefinition\n    Properties:\n      Family: <example_resource_name>\n      ContainerDefinitions:\n        - Name: <example_resource_name>\n          Image: <image>\n          Privileged: false  # Critical: ensures container is non-privileged to pass the check\n```",
+      "Other": "1. Open the Amazon ECS console and go to Task definitions\n2. Select the failing task definition family and open the failing revision\n3. Click Create new revision\n4. Edit the affected container and uncheck Privileged (set it to false)\n5. Click Create to register the new revision",
+      "Terraform": "```hcl\n# ECS task definition with non-privileged container\nresource \"aws_ecs_task_definition\" \"<example_resource_name>\" {\n  family                = \"<example_resource_name>\"\n  container_definitions = jsonencode([\n    {\n      name       = \"<example_resource_name>\"\n      image      = \"<image>\"\n      privileged = false # Critical: ensures container is non-privileged to pass the check\n    }\n  ])\n}\n```"
     },
     "Recommendation": {
-      "Text": "Ensure that containers are running without elevated privileges to minimize the risk of privilege escalation.",
-      "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_security"
+      "Text": "Run containers without elevated rights (`privileged: false`) and as non-root (`user`). Apply **least privilege**:\n- Grant only required Linux capabilities via `capDrop`/`capAdd`\n- Prefer `readonlyRootFilesystem: true`\n- Isolate networks and separate duties\n- Monitor with logging to support defense in depth",
+      "Url": "https://hub.prowler.com/check/ecs_task_definitions_no_privileged_containers"
     }
   },
   "Categories": [
-    "vulnerabilities"
+    "container-security"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.metadata.json

@@ -1,28 +1,34 @@
 {
   "Provider": "aws",
   "CheckID": "ecs_task_set_no_assign_public_ip",
-  "CheckTitle": "ECS task sets should not automatically assign public IP addresses",
+  "CheckTitle": "ECS task set does not automatically assign a public IP address",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ecs",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-set/{cluster-name}/{service-name}/{task-set-id}",
+  "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AwsEcsTaskSet",
-  "Description": "This control checks whether an Amazon ECS task set is configured to automatically assign public IP addresses. The control fails if AssignPublicIP is set to ENABLED.",
-  "Risk": "A public IP address is reachable from the internet, potentially exposing resources associated with the ECS task set. ECS task sets shouldn't be publicly accessible, as this may allow unintended access to container application servers.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskSet.html",
+  "ResourceType": "AwsEcsService",
+  "Description": "**ECS task sets** are assessed for **automatic public IP assignment** via `AssignPublicIP`. When set to `ENABLED`, tasks are given public addresses in their network configuration.",
+  "Risk": "Public IPs make tasks directly reachable from the Internet, enabling scanning, brute force, and exploit attempts.\n\nImpacts: **confidentiality** (data exposure), **integrity** (unauthorized actions), **availability** (DoS). Attackers can bypass internal controls and pivot for lateral movement.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html",
+    "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskSet.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-16"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws ecs update-service --cluster <cluster-name> --service <service-name> --network-configuration 'awsvpcConfiguration={assignPublicIp=\"DISABLED\"}'",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-16",
-      "Terraform": ""
+      "CLI": "",
+      "NativeIaC": "```yaml\n# CloudFormation to ensure ECS Task Set does not auto-assign public IP\nResources:\n  <example_resource_name>:\n    Type: AWS::ECS::TaskSet\n    Properties:\n      Cluster: \"<example_resource_id>\"\n      Service: \"<example_resource_id>\"\n      TaskDefinition: \"<example_resource_id>\"\n      NetworkConfiguration:\n        AwsvpcConfiguration:\n          AssignPublicIp: DISABLED  # CRITICAL: disables automatic public IP assignment\n          Subnets:\n            - \"<example_resource_id>\"\n```",
+      "Other": "1. In the AWS Console, go to ECS > Clusters > select your cluster\n2. Open your Service and choose Update (or Edit)\n3. In Networking, set Public IP assignment to Disabled\n4. Save/Deploy the update to create a new deployment/task set\n5. After the new task set is Primary and stable, delete the old task set that had Public IP enabled",
+      "Terraform": "```hcl\n# ECS Task Set with public IP assignment disabled\nresource \"aws_ecs_task_set\" \"<example_resource_name>\" {\n  cluster         = \"<example_resource_id>\"\n  service         = \"<example_resource_id>\"\n  task_definition = \"<example_resource_id>\"\n\n  network_configuration {\n    subnets          = [\"<example_resource_id>\"]\n    assign_public_ip = false  # CRITICAL: disables automatic public IP assignment\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Configure ECS task sets to not assign public IP addresses to prevent unintended public access to your containerized applications.",
-      "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html"
+      "Text": "Disable **automatic public IPs** on task sets.\n\nUse private subnets behind controlled entry points (load balancers, API gateways, or service discovery). Enforce **least privilege** security groups and **defense in depth**. Prefer private connectivity (VPC endpoints/VPN). *Expose only frontends, not tasks.*",
+      "Url": "https://hub.prowler.com/check/ecs_task_set_no_assign_public_ip"
     }
   },
   "Categories": [

prowler/providers/aws/services/eks/eks_cluster_deletion_protection_enabled/eks_cluster_deletion_protection_enabled.metadata.json

@@ -1,31 +1,38 @@
 {
   "Provider": "aws",
   "CheckID": "eks_cluster_deletion_protection_enabled",
-  "CheckTitle": "Ensure EKS clusters have deletion protection enabled",
+  "CheckTitle": "EKS cluster has deletion protection enabled",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices/Resource Management"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Effects/Data Destruction"
   ],
   "ServiceName": "eks",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure that your Amazon EKS clusters have deletion protection enabled to prevent accidental deletion of critical Kubernetes clusters.",
-  "Risk": "Without deletion protection, EKS clusters can be accidentally deleted through Terraform automation, AWS CLI commands, or the AWS console, leading to data loss and service disruption.",
-  "RelatedUrl": "https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html",
+  "Description": "**Amazon EKS clusters** have **deletion protection** enabled blocking cluster removal until protection is explicitly disabled.",
+  "Risk": "Without **deletion protection**, automation errors or a compromised admin can remove the cluster control plane, causing immediate **availability** loss and downtime. Destructive actions can also affect the **integrity** of deployments, leave orphaned resources, hinder recovery, and raise **operational cost**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws eks update-cluster-config --region <region_name> --name <cluster_name> --deletion-protection",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": "resource \"aws_eks_cluster\" \"example\" {\n  name     = \"example-cluster\"\n  role_arn = aws_iam_role.example.arn\n  deletion_protection = true\n  # ... other configuration\n}"
+      "CLI": "aws eks update-cluster-config --name <cluster_name> --region <region_name> --deletion-protection",
+      "NativeIaC": "```yaml\n# CloudFormation: enable deletion protection on the EKS cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::EKS::Cluster\n    Properties:\n      RoleArn: <example_role_arn>\n      ResourcesVpcConfig:\n        SubnetIds: [<example_subnet_id_1>, <example_subnet_id_2>]\n      DeletionProtection: true  # critical: prevents cluster deletion until disabled\n```",
+      "Other": "1. Open the AWS Management Console and go to Amazon EKS\n2. Select your cluster\n3. Go to the Configuration tab and click Edit\n4. Enable Deletion protection\n5. Click Save changes",
+      "Terraform": "```hcl\n# Enable deletion protection for the EKS cluster\nresource \"aws_eks_cluster\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  role_arn = \"<example_role_arn>\"\n\n  vpc_config {\n    subnet_ids = [\"<subnet_id_1>\", \"<subnet_id_2>\"]\n  }\n\n  deletion_protection = true  # critical: prevents cluster deletion until disabled\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable deletion protection on all EKS clusters to prevent accidental deletion. This is especially important for production clusters and those managed through Infrastructure as Code (IaC) tools.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html"
+      "Text": "Enable **deletion protection** on critical clusters (`deletionProtection=true`). Enforce **least privilege** so only narrowly scoped roles can disable or delete clusters. Require **change control** with approvals and **separation of duties**, and apply guardrails to prevent broad delete permissions.",
+      "Url": "https://hub.prowler.com/check/eks_cluster_deletion_protection_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "resilience"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled.metadata.json

@@ -1,33 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "eks_cluster_kms_cmk_encryption_in_secrets_enabled",
-  "CheckTitle": "Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs)",
+  "CheckTitle": "EKS cluster has Kubernetes secrets encryption enabled",
   "CheckType": [
-    "Protect",
-    "Data protection"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "eks",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs)",
-  "Risk": "Implementing envelope encryption is considered a security best practice for applications that store sensitive data and is part of a defense in depth security strategy.",
+  "Description": "**Amazon EKS** clusters configure **AWS KMS envelope encryption** so Kubernetes **Secrets** are stored in etcd as ciphertext at rest.",
+  "Risk": "Without KMS-backed encryption, etcd data and snapshots can reveal plaintext secrets. Attackers with API, node, or storage access can steal tokens, passwords, and keys, enabling impersonation, pod takeover, and lateral movement-compromising confidentiality and leading to privilege escalation.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/eks.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/enable-envelope-encryption.html",
+    "https://devoriales.com/post/329/aws-eks-secret-encryption-securing-your-eks-secrets-at-rest-with-aws-kms",
+    "https://docs.aws.amazon.com/eks/latest/userguide/enable-kms.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/kubernetes-policies-1/bc_aws_kubernetes_3#fix---builtime",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/enable-envelope-encryption.html",
-      "Terraform": ""
+      "CLI": "aws eks associate-encryption-config --cluster-name <example_resource_name> --encryption-config '[{\"resources\":[\"secrets\"],\"provider\":{\"keyArn\":\"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>\"}}]'",
+      "NativeIaC": "```yaml\n# CloudFormation: enable KMS envelope encryption for Kubernetes secrets\nResources:\n  EKSCluster:\n    Type: AWS::EKS::Cluster\n    Properties:\n      Name: \"<example_resource_name>\"\n      RoleArn: \"arn:aws:iam::<ACCOUNT_ID>:role/<example_resource_name>\"\n      ResourcesVpcConfig:\n        SubnetIds:\n          - \"<example_resource_id>\"\n          - \"<example_resource_id>\"\n      EncryptionConfig:                # Critical: enables KMS encryption for Kubernetes secrets\n        - Resources:\n            - secrets                  # Critical: encrypts only Kubernetes secrets\n          Provider:\n            KeyArn: \"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>\"  # Critical: KMS key used for encryption\n```",
+      "Other": "1. Open the AWS Management Console and go to Amazon EKS\n2. Select your cluster\n3. On the Overview tab, find Secrets encryption and click Enable\n4. Select the KMS key and click Enable\n5. Click Confirm to apply",
+      "Terraform": "```hcl\n# Enable KMS envelope encryption for Kubernetes secrets\nresource \"aws_eks_cluster\" \"main\" {\n  name     = \"<example_resource_name>\"\n  role_arn = \"arn:aws:iam::<ACCOUNT_ID>:role/<example_resource_name>\"\n\n  vpc_config {\n    subnet_ids = [\"<example_resource_id>\", \"<example_resource_id>\"]\n  }\n\n  encryption_config {                 # Critical: enables KMS encryption for secrets\n    resources = [\"secrets\"]          # Critical: scope to Kubernetes secrets\n    provider {\n      key_arn = \"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>\"  # Critical: KMS key\n    }\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Setup your own Customer Master Key (CMK) in KMS and link this key by providing the CMK ARN when you create an EKS cluster.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html"
+      "Text": "Enable cluster-level secrets encryption with **AWS KMS** and prefer a **customer managed KMS key** for control and rotation. Apply **least privilege** to key policies and cluster roles, monitor key usage, and combine with strict **RBAC** to limit who can read or create secrets as part of **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/eks_cluster_kms_cmk_encryption_in_secrets_enabled"
     }
   },
   "Categories": [
-    "encryption"
+    "encryption",
+    "cluster-security"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/eks/eks_cluster_network_policy_enabled/eks_cluster_network_policy_enabled.metadata.json

@@ -1,33 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "eks_cluster_network_policy_enabled",
-  "CheckTitle": "Ensure Network Policy is Enabled and Set as Appropriate",
+  "CheckTitle": "EKS cluster has network policy enabled",
   "CheckType": [
-    "Security",
-    "Configuration"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "TTPs/Lateral Movement"
   ],
   "ServiceName": "eks",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure that Network Policy is enabled and set as appropriate in Amazon EKS clusters. Network Policy provides pod-level firewalling to restrict traffic between sources, enhancing network security within the cluster.",
-  "Risk": "Without proper Network Policy settings, pods within the cluster may be vulnerable to unauthorized access and communication.",
-  "RelatedUrl": "https://docs.aws.amazon.com/eks/latest/userguide/eks-networking-add-ons.html",
+  "Description": "**Amazon EKS clusters** are evaluated for **pod-level network isolation** via Kubernetes `NetworkPolicy`, indicating whether traffic between pods and namespaces is restricted according to defined rules.",
+  "Risk": "Without **NetworkPolicy**, pods can communicate freely, enabling **lateral movement**, **data exfiltration**, and abuse of internal services. Unrestricted east-west traffic undermines confidentiality and integrity and enlarges the blast radius of a single compromised pod.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/security-groups.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/eks-networking-add-ons.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/cni-network-policy.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/security-groups.html",
-      "Terraform": "https://docs.prowler.com/checks/aws/kubernetes-policies-1/bc_aws_kubernetes_1#terraform"
+      "CLI": "aws eks update-cluster-config --name <example_cluster_name> --resources-vpc-config securityGroupIds=<example_security_group_id>",
+      "NativeIaC": "```yaml\n# CloudFormation: attach a security group to the EKS cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::EKS::Cluster\n    Properties:\n      RoleArn: <example_role_arn>\n      ResourcesVpcConfig:\n        SubnetIds:\n          - <example_subnet_id>\n        SecurityGroupIds:\n          - <example_security_group_id>  # Critical: sets a security group for the cluster, satisfying the check\n```",
+      "Other": "1. Open the AWS Console and go to EKS > Clusters\n2. Select <your cluster> and open the Networking tab\n3. Click Edit (or Update) in the Networking section\n4. Under Security groups, add/select <example_security_group_id>\n5. Click Save to apply",
+      "Terraform": "```hcl\n# Minimal EKS cluster config with a security group attached\nresource \"aws_eks_cluster\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  role_arn = \"<example_role_arn>\"\n\n  vpc_config {\n    subnet_ids         = [\"<example_subnet_id>\"]\n    security_group_ids = [\"<example_security_group_id>\"]  # Critical: attaches a security group to pass the check\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable and configure Network Policy to enhance network security within the EKS cluster.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/eks-networking-add-ons.html"
+      "Text": "Enforce **least privilege** `NetworkPolicy` with a `default-deny` for ingress and egress, then explicitly allow required flows by labels and namespaces. Apply **defense in depth** with security groups for pods and private access, and continuously test and monitor policy effectiveness.",
+      "Url": "https://hub.prowler.com/check/eks_cluster_network_policy_enabled"
     }
   },
   "Categories": [
-    "internet-exposed"
+    "trust-boundaries",
+    "cluster-security"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/eks/eks_cluster_not_publicly_accessible/eks_cluster_not_publicly_accessible.metadata.json

@@ -1,36 +1,45 @@
 {
   "Provider": "aws",
   "CheckID": "eks_cluster_not_publicly_accessible",
-  "CheckTitle": "Ensure EKS Clusters are not publicly accessible",
+  "CheckTitle": "EKS cluster endpoint is not publicly accessible from 0.0.0.0/0",
   "CheckAliases": [
     "eks_endpoints_not_publicly_accessible",
     "eks_control_plane_endpoint_access_restricted"
   ],
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Initial Access/Unauthorized Access",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "eks",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure that your Amazon EKS cluster's Kubernetes API server endpoint is not publicly accessible from the Internet in order to avoid exposing private data and minimizing security risks.",
-  "Risk": "By default, this API server endpoint is publicly accessible, meaning any machine on the internet can potentially connect to your EKS cluster using its public endpoint. This exposes your cluster to a higher risk of malicious activities and attacks.",
-  "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html#eks-1",
+  "Description": "**Amazon EKS** cluster API server endpoint is evaluated for **unrestricted Internet access**, specifically when the public endpoint permits connections from `0.0.0.0/0` instead of private access or limited CIDR ranges.",
+  "Risk": "An openly reachable API endpoint enables Internet-wide probing, brute force, and enumeration, increasing exposure to RBAC misconfigurations or API flaws. Successful access can drive secret exfiltration (confidentiality), workload tampering (integrity), and control-plane disruption or scaling abuse (availability, cost).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/eks/latest/eksctl/vpc-cluster-access.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/config-cluster-endpoint.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/endpoint-access.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws eks update-cluster-config --region <region_name> --name <cluster_name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true,publicAccessCidrs=[\"123.123.123.123/32\"]",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/endpoint-access.html",
-      "Terraform": ""
+      "CLI": "aws eks update-cluster-config --region <region_name> --name <cluster_name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true",
+      "NativeIaC": "```yaml\n# CloudFormation: Disable public endpoint and enable private endpoint\nResources:\n  <example_resource_name>:\n    Type: AWS::EKS::Cluster\n    Properties:\n      RoleArn: <example_role_arn>\n      ResourcesVpcConfig:\n        SubnetIds:\n          - <example_subnet_id_1>\n          - <example_subnet_id_2>\n        EndpointPublicAccess: false  # critical: disables public API endpoint\n        EndpointPrivateAccess: true  # critical: enables private API endpoint\n```",
+      "Other": "1. Open the Amazon EKS console\n2. Select your cluster\n3. Go to the Networking tab and click Manage endpoint access\n4. Enable Private access and Disable Public access\n5. Click Update/Save",
+      "Terraform": "```hcl\n# Terraform: Disable public endpoint and enable private endpoint\nresource \"aws_eks_cluster\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  role_arn = \"<example_role_arn>\"\n\n  vpc_config {\n    subnet_ids              = [\"<example_subnet_id_1>\", \"<example_subnet_id_2>\"]\n    endpoint_public_access  = false  # critical: disables public API endpoint\n    endpoint_private_access = true   # critical: enables private API endpoint\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Restricting public access to the Kubernetes API endpoint managed by the EKS cluster is a security best practice that helps protect your cluster from unauthorized access and potential security threats. By not allowing public access to the cluster's Kubernetes API endpoint, you ensure that only authorized entities can interact with your Amazon EKS cluster.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html"
+      "Text": "Prefer **private endpoint access** and avoid broad exposure. *If public access is required*, restrict to trusted admin CIDRs (not `0.0.0.0/0`), reach the API via **VPN/Direct Connect or bastions**, and enforce **least privilege** with IAM/RBAC. Apply **defense in depth** through network segmentation and continuous monitoring.",
+      "Url": "https://hub.prowler.com/check/eks_cluster_not_publicly_accessible"
     }
   },
   "Categories": [
-    "internet-exposed"
+    "internet-exposed",
+    "cluster-security"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/eks/eks_cluster_private_nodes_enabled/eks_cluster_private_nodes_enabled.metadata.json

@@ -1,33 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "eks_cluster_private_nodes_enabled",
-  "CheckTitle": "Ensure Clusters are created with Private Nodes",
+  "CheckTitle": "EKS cluster has private endpoint access enabled",
   "CheckType": [
-    "Security",
-    "Configuration"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Initial Access/Unauthorized Access"
   ],
   "ServiceName": "eks",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure that clusters are created with private nodes, disabling public IP addresses for cluster nodes. Private nodes have no public IP addresses, restricting access to internal networks and enhancing security.",
-  "Risk": "Without private nodes, cluster nodes may have public IP addresses, increasing the attack surface and exposing them to potential threats from the internet.",
-  "RelatedUrl": "https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html",
+  "Description": "**Amazon EKS cluster** has **private endpoint access** enabled for the **Kubernetes API server**, allowing control plane traffic to use a VPC-resolved private endpoint.\n\nThe check evaluates the cluster's `endpointPrivateAccess` setting.",
+  "Risk": "Without **private endpoint access**, the API server is exposed on the public internet. This expands attack surface and weakens **confidentiality** and **integrity**: stolen creds or mis-scoped CIDRs can enable unauthorized API calls, secret reads, pod deployments, and config changes. **Availability** also depends on internet egress, increasing failure modes.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws eks update-cluster-config --region region-code --name my-cluster --resources-vpc-config endpointPrivateAccess=true",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws eks update-cluster-config --region <REGION> --name <CLUSTER_NAME> --resources-vpc-config endpointPrivateAccess=true",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable private endpoint access for an EKS cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::EKS::Cluster\n    Properties:\n      RoleArn: <example_resource_id>\n      ResourcesVpcConfig:\n        SubnetIds:\n          - <example_resource_id>\n        EndpointPrivateAccess: true  # Critical: enables private endpoint access to pass the check\n```",
+      "Other": "1. In the AWS Console, open Amazon EKS and select your cluster\n2. Go to the Networking tab\n3. Click Edit next to Cluster endpoint access\n4. Enable Private access\n5. Click Save",
+      "Terraform": "```hcl\n# Terraform: Enable private endpoint access for an EKS cluster\nresource \"aws_eks_cluster\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  role_arn = \"<example_resource_id>\"\n\n  vpc_config {\n    subnet_ids              = [\"<example_resource_id>\"]\n    endpoint_private_access = true  # Critical: enables private API endpoint access to pass the check\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Update the cluster configuration to enable private nodes, disabling public IP addresses for cluster nodes.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html"
+      "Text": "Enable **private endpoint access** and disable or tightly restrict the public endpoint.\n\nRequire administration from private networks, enforce **least privilege** with IAM/RBAC, and apply **defense in depth** via segmentation and logging. *If external access is needed*, allow only specific CIDRs and monitor API activity.",
+      "Url": "https://hub.prowler.com/check/eks_cluster_private_nodes_enabled"
     }
   },
   "Categories": [
-    "internet-exposed"
+    "internet-exposed",
+    "trust-boundaries"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/eks/eks_cluster_uses_a_supported_version/eks_cluster_uses_a_supported_version.metadata.json

@@ -1,26 +1,35 @@
 {
   "Provider": "aws",
   "CheckID": "eks_cluster_uses_a_supported_version",
-  "CheckTitle": "Ensure Kubernetes cluster runs on a supported Kubernetes version",
-  "CheckType": [],
+  "CheckTitle": "EKS cluster uses a supported Kubernetes version",
+  "CheckType": [
+    "Software and Configuration Checks/Patch Management",
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "eks",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure Kubernetes cluster runs on a supported Kubernetes version",
-  "Risk": "Running an Amazon EKS cluster on an unsupported Kubernetes version exposes it to common security vulnerabilities",
-  "RelatedUrl": "https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.html",
+  "Description": "Amazon EKS clusters use a **supported Kubernetes version** at or above the defined baseline (e.g., `1.28+`). The evaluation compares each cluster's Kubernetes minor version to the minimum supported level and highlights clusters running below that baseline.",
+  "Risk": "Running an **unsupported Kubernetes version** removes upstream and EKS security fixes, exposing clusters to known CVEs and privilege escalation bugs (**confidentiality/integrity**). Deprecated or removed APIs can break controllers and add-ons, causing outages (**availability**).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/kubernetes-version.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html#eks-2",
+    "https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws eks update-cluster-version --region <region> --name <cluster_name> --kubernetes-version <latest_supported_version>",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/kubernetes-version.html",
-      "Terraform": ""
+      "CLI": "aws eks update-cluster-version --name <cluster_name> --kubernetes-version <supported_version>",
+      "NativeIaC": "```yaml\n# CloudFormation: update EKS cluster to a supported Kubernetes version\nResources:\n  <example_resource_name>:\n    Type: AWS::EKS::Cluster\n    Properties:\n      Name: <example_resource_name>\n      RoleArn: <example_role_arn>\n      ResourcesVpcConfig:\n        SubnetIds: [\"<example_subnet_id>\"]\n      Version: \"<supported_version>\"  # Critical: set a supported Kubernetes version to pass the check\n```",
+      "Other": "1. Open the AWS Management Console and go to Amazon EKS\n2. Select your cluster (<cluster_name>)\n3. Click Update (or Edit) next to Kubernetes version\n4. Choose a supported version (>= required) and confirm the update\n5. Wait for the control plane update to complete",
+      "Terraform": "```hcl\n# Terraform: update EKS cluster to a supported Kubernetes version\nresource \"aws_eks_cluster\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  role_arn = \"<example_role_arn>\"\n\n  version = \"<supported_version>\" # Critical: set a supported Kubernetes version to pass the check\n\n  vpc_config {\n    subnet_ids = [\"<example_subnet_id>\"]\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "If your application doesn't require a specific version of Kubernetes, we recommend that you use the latest available Kubernetes version that is supported by EKS for your clusters.",
-      "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html#eks-2"
+      "Text": "Adopt a **version management policy**: keep clusters on a supported minor version, schedule regular upgrades, and test workloads for API deprecations. Upgrade nodes and add-ons with the control plane. Track EKS releases, automate drift alerts, and favor **defense in depth** over deprecated features.",
+      "Url": "https://hub.prowler.com/check/eks_cluster_uses_a_supported_version"
     }
   },
   "Categories": [

prowler/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled.metadata.json

@@ -1,33 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "eks_control_plane_logging_all_types_enabled",
-  "CheckTitle": "Ensure EKS Control Plane Logging is enabled for all required log types",
+  "CheckTitle": "EKS cluster has control plane logging enabled for api, audit, authenticator, controllerManager, and scheduler",
   "CheckType": [
-    "Logging and Monitoring"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "eks",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsEksCluster",
-  "Description": "Ensure EKS Control Plane Logging is enabled for all required log types",
-  "Risk": "If logs are not enabled, monitoring of service use or threat analysis is not possible.",
+  "Description": "**Amazon EKS clusters** are evaluated for **control plane logging** coverage of required types: `api`, `audit`, `authenticator`, `controllerManager`, `scheduler`.\n\nThe finding identifies clusters where any of these log types are not configured.",
+  "Risk": "Gaps in **control plane logging** reduce visibility across the cluster.\n- Confidentiality: undetected API access, RBAC abuse, token misuse\n- Integrity: untraceable config changes and policy edits\n- Availability: scheduler/controller issues lack evidence, delaying recovery and masking attacker persistence",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/eks/latest/userguide/logging-monitoring.html",
+    "https://support.icompaas.com/support/solutions/articles/62000233623-ensure-eks-control-plane-logging-is-enabled-for-all-required-log-types",
+    "https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html",
+    "https://docs.aws.amazon.com/prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/kubernetes-eks-logging.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws eks update-cluster-config --region <region_name> --name <cluster_name> --logging '{\"clusterLogging\":[{\"types\":[\"api\",\"audit\",\"authenticator\",\"controllerManager\",\"scheduler\"],\"enabled\":true}]}'",
-      "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/aws/kubernetes-policies-1/bc_aws_kubernetes_4#aws-console",
-      "Terraform": "https://docs.prowler.com/checks/aws/kubernetes-policies-1/bc_aws_kubernetes_4#fix---buildtime"
+      "CLI": "aws eks update-cluster-config --name <cluster_name> --logging '{\"clusterLogging\":[{\"types\":[\"api\",\"audit\",\"authenticator\",\"controllerManager\",\"scheduler\"],\"enabled\":true}]}'",
+      "NativeIaC": "```yaml\n# CloudFormation: enable all EKS control plane log types\nResources:\n  <example_resource_name>:\n    Type: AWS::EKS::Cluster\n    Properties:\n      RoleArn: <example_role_arn>\n      ResourcesVpcConfig:\n        SubnetIds: [<example_subnet_id>]\n      Logging:\n        ClusterLogging:\n          - EnabledTypes:\n              - Type: api            # Critical: enable required control plane log types\n              - Type: audit          # Critical: enable required control plane log types\n              - Type: authenticator  # Critical: enable required control plane log types\n              - Type: controllerManager  # Critical: enable required control plane log types\n              - Type: scheduler      # Critical: enable required control plane log types\n```",
+      "Other": "1. In the AWS console, go to Amazon EKS and open your cluster\n2. Open the Observability (or Logging) tab and click Manage logging\n3. Turn on: api, audit, authenticator, controllerManager, scheduler\n4. Click Save changes",
+      "Terraform": "```hcl\n# Enable all required EKS control plane log types\nresource \"aws_eks_cluster\" \"<example_resource_name>\" {\n  enabled_cluster_log_types = [\n    \"api\",            # Critical: required control plane log types\n    \"audit\",          # Critical: required control plane log types\n    \"authenticator\",  # Critical: required control plane log types\n    \"controllerManager\", # Critical: required control plane log types\n    \"scheduler\"       # Critical: required control plane log types\n  ]\n}\n```"
     },
     "Recommendation": {
-      "Text": "Make sure logging for EKS control plane is enabled for all required log types.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/logging-monitoring.html"
+      "Text": "Enable and standardize **EKS control plane logging** for all required types `[\"api\",\"audit\",\"authenticator\",\"controllerManager\",\"scheduler\"]`.\n\nApply least privilege to log access, set retention and alerts, and centralize analysis to support defense in depth, rapid detection, and reliable forensics.",
+      "Url": "https://hub.prowler.com/check/eks_control_plane_logging_all_types_enabled"
     }
   },
   "Categories": [
-    "forensics-ready",
-    "logging"
+    "logging",
+    "forensics-ready"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet.metadata.json

@@ -1,26 +1,34 @@
 {
   "Provider": "aws",
   "CheckID": "elasticache_cluster_uses_public_subnet",
-  "CheckTitle": "Ensure Elasticache Cluster is not using a public subnet",
-  "CheckType": [],
+  "CheckTitle": "ElastiCache cluster is not using public subnets",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Exposure"
+  ],
   "ServiceName": "elasticache",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
-  "Description": "Ensure Elasticache Cluster is not using a public subnet",
-  "Risk": "There is a risk of exposing sensitive data if Elasticache Cluster uses a public subnet.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/VPCs.html",
+  "Description": "**ElastiCache resources** (Redis nodes and Memcached clusters) are assessed for placement in **public subnets**.\n\nThe finding identifies cache subnet groups that include subnets configured with Internet routing instead of private-only subnets.",
+  "Risk": "Hosting caches in **public subnets** can permit direct or misconfigured Internet access, impacting CIA:\n- Confidentiality: unauthorized reads and key dumps\n- Integrity: cache poisoning or key tampering\n- Availability: scanning and DDoS\n\nAttackers may pivot from the cache to **lateral movement** within the VPC.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SubnetGroups.html",
+    "https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/VPCs.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws elasticache modify-cache-cluster --cache-cluster-id my-elasticache-cluster --cache-subnet-group-name my-private-subnet-group",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws elasticache modify-cache-cluster --cache-cluster-id <example_resource_id> --cache-subnet-group-name <example_resource_name> --apply-immediately",
+      "NativeIaC": "```yaml\n# CloudFormation: move ElastiCache into private subnets via a private subnet group\nResources:\n  PrivateCacheSubnetGroup:\n    Type: AWS::ElastiCache::SubnetGroup\n    Properties:\n      Description: Private subnets only\n      SubnetIds:\n        - <example_resource_id>  # private subnet\n        - <example_resource_id>  # private subnet\n\n  CacheCluster:\n    Type: AWS::ElastiCache::CacheCluster\n    Properties:\n      CacheClusterId: <example_resource_id>\n      Engine: redis\n      CacheNodeType: cache.t3.micro\n      NumCacheNodes: 1\n      CacheSubnetGroupName: !Ref PrivateCacheSubnetGroup  # CRITICAL: forces the cluster to use only private subnets\n```",
+      "Other": "1. In the AWS Console, go to ElastiCache > Subnet groups\n2. Click Create cache subnet group and select only private subnets (no route to an Internet Gateway)\n3. Go to ElastiCache > Redis or Memcached, select your cluster\n4. Click Modify, set Subnet group to the private subnet group\n5. Check Apply immediately and click Modify to save",
+      "Terraform": "```hcl\n# Terraform: ensure the cluster uses a subnet group with only private subnets\nresource \"aws_elasticache_subnet_group\" \"private\" {\n  name       = \"<example_resource_name>\"\n  subnet_ids = [\"<example_resource_id>\", \"<example_resource_id>\"] # private subnets only\n}\n\nresource \"aws_elasticache_cluster\" \"cache\" {\n  cluster_id      = \"<example_resource_id>\"\n  engine          = \"redis\"\n  node_type       = \"cache.t3.micro\"\n  num_cache_nodes = 1\n  subnet_group_name = aws_elasticache_subnet_group.private.name  # CRITICAL: restricts cluster to private subnets\n}\n```"
     },
     "Recommendation": {
-      "Text": "To ensure your Elasticache cluster is not using a public subnet, follow the recommended remediation steps based on your preferred method.",
-      "Url": "https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/VPCs.html"
+      "Text": "Place caches in **private subnets** only and ensure route tables lack Internet egress. Apply **least privilege** with tight **security groups** limited to required ports and trusted sources.\n\nFor external access, use **VPC peering**, **VPN**, or **PrivateLink**. Enable encryption in transit and Redis `AUTH` for layered controls.",
+      "Url": "https://hub.prowler.com/check/elasticache_cluster_uses_public_subnet"
     }
   },
   "Categories": [