prowler-cloud 5.16.1__py3-none-any.whl → 5.17.1__py3-none-any.whl

prowler/providers/aws/services/cognito/cognito_user_pool_password_policy_number/cognito_user_pool_password_policy_number.metadata.json

@@ -1,29 +1,42 @@
 {
   "Provider": "aws",
   "CheckID": "cognito_user_pool_password_policy_number",
-  "CheckTitle": "Ensure that the password policy for your user pool requires a number",
-  "CheckType": [],
+  "CheckTitle": "Cognito user pool password policy requires at least one number",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Credential Access"
+  ],
   "ServiceName": "cognito",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:cognito-idp:region:account:userpool/userpool-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsCognitoUserPool",
-  "Description": "Checks whether the password policy for your user pool requires a number.",
-  "Risk": "If the password policy for your user pool does not require a number, the user pool is less secure and more vulnerable to attacks.",
-  "RelatedUrl": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html",
+  "ResourceType": "Other",
+  "ResourceGroup": "IAM",
+  "Description": "Amazon Cognito user pools are evaluated for a password policy that **requires at least one number**. The assessment checks whether the policy enforces a numeric character via `RequireNumbers` and also identifies pools with no password policy configured.",
+  "Risk": "Absent a numeric requirement-or any password policy-reduces password entropy, enabling **brute force** and **credential stuffing**. Successful account takeover grants valid tokens to protected APIs, risking data **confidentiality**, unauthorized actions affecting **integrity**, and resource abuse impacting **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html",
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html",
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-passwordpolicy.html",
+    "https://support.icompaas.com/support/solutions/articles/62000233673-ensure-that-the-password-policy-for-your-user-pool-requires-a-number"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --policies '{\"PasswordPolicy\":{\"RequireNumbers\":true}}'",
+      "NativeIaC": "```yaml\n# CloudFormation: Set password policy to require at least one number\nResources:\n  <example_resource_name>:\n    Type: AWS::Cognito::UserPool\n    Properties:\n      Policies:\n        PasswordPolicy:\n          RequireNumbers: true  # Critical: enforces at least one numeric character in passwords\n```",
+      "Other": "1. In the AWS Console, go to Amazon Cognito > User pools\n2. Select your user pool\n3. Open Authentication (or Password policy) settings\n4. Enable Requires at least one number (Require numbers)\n5. Save changes",
+      "Terraform": "```hcl\n# Terraform: Enable number requirement in Cognito password policy\nresource \"aws_cognito_user_pool\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  password_policy {\n    require_numbers = true  # Critical: enforces at least one numeric character in passwords\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "To require a number in the password policy for your user pool, perform the following actions:",
-      "Url": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html"
+      "Text": "Enforce a strong password policy: require numbers (`RequireNumbers=true`), adequate length (e.g., `>=8`), and mixed case/symbols. Complement with **MFA**, login throttling/lockout, and password reuse limits for **defense in depth**. Apply **least privilege** to applications using tokens and monitor authentication activity.",
+      "Url": "https://hub.prowler.com/check/cognito_user_pool_password_policy_number"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/cognito/cognito_user_pool_password_policy_symbol/cognito_user_pool_password_policy_symbol.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "cognito_user_pool_password_policy_symbol",
-  "CheckTitle": "Ensure that the password policy for your Amazon Cognito user pool requires at least one symbol.",
-  "CheckType": [],
+  "CheckTitle": "Cognito user pool password policy requires at least one symbol",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Credential Access"
+  ],
   "ServiceName": "cognito",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:cognito-idp:region:account:userpool/userpool-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsCognitoUserPool",
-  "Description": "Check whether the password policy for your Amazon Cognito user pool requires at least one symbol.",
-  "Risk": "If the password policy for your Amazon Cognito user pool does not require at least one symbol, it can be easier for attackers to crack passwords.",
-  "RelatedUrl": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html",
+  "ResourceType": "Other",
+  "ResourceGroup": "IAM",
+  "Description": "**Amazon Cognito user pool** password policy includes a **symbol requirement** for user passwords.\n\nAssesses the presence of a policy and whether `require_symbols` is configured.",
+  "Risk": "Absent a **symbol requirement**, passwords have lower entropy, increasing success of **brute force** and **credential stuffing**.\n\nCompromised accounts enable unauthorized token issuance, data access, and profile changes, impacting **confidentiality** and **integrity** across apps relying on the pool.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html",
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies \"PasswordPolicy={RequireSymbols=true}\"",
+      "NativeIaC": "```yaml\n# CloudFormation: ensure Cognito User Pool requires at least one symbol in passwords\nResources:\n  <example_resource_name>:\n    Type: AWS::Cognito::UserPool\n    Properties:\n      Policies:\n        PasswordPolicy:\n          RequireSymbols: true  # Critical: enforce at least one symbol to pass the check\n```",
+      "Other": "1. Open the Amazon Cognito console and go to User pools\n2. Select the target user pool\n3. Go to Authentication (or Sign-in experience) > Password policy\n4. Enable Require special characters (Require symbols)\n5. Click Save changes",
+      "Terraform": "```hcl\n# Terraform: ensure Cognito User Pool requires at least one symbol in passwords\nresource \"aws_cognito_user_pool\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  password_policy {\n    require_symbols = true  # Critical: enforce at least one symbol to pass the check\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "To require at least one symbol in the password policy for your Amazon Cognito user pool, you can use the AWS Management Console or the AWS CLI.",
-      "Url": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html"
+      "Text": "Enforce a strong **password complexity** policy with `require_symbols=true`, adequate length, and mixed character sets. Combine with **MFA**, throttling or lockout, and credential hygiene to reduce takeover risk. Apply **defense in depth** and **least privilege** to limit blast radius if an account is compromised.",
+      "Url": "https://hub.prowler.com/check/cognito_user_pool_password_policy_symbol"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/cognito/cognito_user_pool_password_policy_uppercase/cognito_user_pool_password_policy_uppercase.metadata.json

@@ -1,29 +1,42 @@
 {
   "Provider": "aws",
   "CheckID": "cognito_user_pool_password_policy_uppercase",
-  "CheckTitle": "Ensure that the password policy for your user pool requires at least one uppercase letter",
-  "CheckType": [],
+  "CheckTitle": "Cognito user pool password policy requires at least one uppercase letter",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)",
+    "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
+    "TTPs/Initial Access"
+  ],
   "ServiceName": "cognito",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:cognito-idp:region:account:userpool/userpool-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsCognitoUserPool",
-  "Description": "User pools allow you to configure a password policy for your user pool to specify requirements for user passwords. You can require that passwords have a minimum length, contain at least one uppercase letter, and contain at least one number. You can also require that passwords have at least one special character. You can also set the password policy to require that passwords be case-sensitive.",
-  "Risk": "If the password policy for your user pool does not require at least one uppercase letter, it may be easier for an attacker to guess or crack user passwords.",
-  "RelatedUrl": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html",
+  "ResourceType": "Other",
+  "ResourceGroup": "IAM",
+  "Description": "Amazon Cognito user pool password policy is evaluated for an uppercase character requirement (`require_uppercase`). The check also identifies user pools that have no password policy configured.",
+  "Risk": "Missing an **uppercase requirement** lowers password entropy, easing **password spraying**, **brute force**, and offline cracking. Account takeover risks user data (**confidentiality**), enables unauthorized changes (**integrity**), and may disrupt services through abuse or lockouts (**availability**).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --policies PasswordPolicy={RequireUppercase=true}",
+      "NativeIaC": "```yaml\n# CloudFormation to require uppercase in Cognito User Pool password policy\nResources:\n  <example_resource_name>:\n    Type: AWS::Cognito::UserPool\n    Properties:\n      Policies:\n        PasswordPolicy:\n          RequireUppercase: true  # Critical: enforce at least one uppercase letter\n```",
+      "Other": "1. Open the Amazon Cognito console and go to User pools\n2. Select your user pool\n3. Go to Authentication methods (or Sign-in experience) > Password policy\n4. Check Requires at least one uppercase letter\n5. Click Save changes",
+      "Terraform": "```hcl\n# Require uppercase in Cognito User Pool password policy\nresource \"aws_cognito_user_pool\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  password_policy {\n    require_uppercase = true  # Critical: enforce at least one uppercase letter\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "To require that the password policy for your user pool requires at least one uppercase letter, you can use the AWS Management Console or the AWS CLI. For more information, see the documentation on user pool settings and policies.",
-      "Url": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html"
+      "Text": "Enforce a **strong password policy** requiring **uppercase characters**, sufficient `minimum_length`, and diverse character sets. Layer defenses: **MFA**, **rate limiting/lockout**, and **password reuse history**. *Where feasible*, prefer long passphrases and monitor authentication events to prevent account takeover.",
+      "Url": "https://hub.prowler.com/check/cognito_user_pool_password_policy_uppercase"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/cognito/cognito_user_pool_self_registration_disabled/cognito_user_pool_self_registration_disabled.metadata.json

@@ -1,29 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "cognito_user_pool_self_registration_disabled",
-  "CheckTitle": "Ensure self registration is disabled for Amazon Cognito User Pools",
-  "CheckType": [],
+  "CheckTitle": "Amazon Cognito user pool has self registration disabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Initial Access"
+  ],
   "ServiceName": "cognito",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:cognito-idp:region:account:userpool/userpool-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsCognitoUserPool",
-  "Description": "Checks whether self registration is disabled for the Amazon Cognito User Pool. Self registration allows users to sign up for an account in the user pool. If self registration is enabled, users can sign up for an account in the user pool without any intervention from the administrator. This can lead to unauthorized access to the application.",
-  "Risk": "If self registration is enabled, users can sign up for an account in the user pool without any intervention from the administrator. This can lead to unauthorized access to the application.",
-  "RelatedUrl": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignUp.html",
+  "ResourceType": "Other",
+  "ResourceGroup": "IAM",
+  "Description": "**Amazon Cognito user pools** are evaluated for **self-service sign-up**. The expected configuration is `AllowAdminCreateUserOnly=true` so only administrators create accounts.\n\n*When self sign-up is allowed*, the check also highlights any linked identity pools and the authenticated role(s) that new users could assume.",
+  "Risk": "Open sign-up lets untrusted users gain **authenticated identities**, potentially assuming **identity pool roles**. This can expose data (**confidentiality**), enable unauthorized actions (**integrity**), and drive abuse or cost via resource use (**availability**). Mass registrations and token harvesting increase the chance of lateral access.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html",
+    "https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html",
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-admin-create-user-policy.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --admin-create-user-config AllowAdminCreateUserOnly=true",
+      "NativeIaC": "```yaml\n# CloudFormation: Disable self-registration in a Cognito User Pool\nResources:\n  <example_resource_name>:\n    Type: AWS::Cognito::UserPool\n    Properties:\n      AdminCreateUserConfig:\n        AllowAdminCreateUserOnly: true  # Critical: disables self sign-up; only admins can create users\n```",
+      "Other": "1. Open the AWS Console and go to Amazon Cognito > User pools\n2. Select the user pool\n3. Go to the Sign-up tab\n4. In Self-service sign-up, click Edit and disable (uncheck) Enable self-registration\n5. Click Save changes",
+      "Terraform": "```hcl\n# Terraform: Disable self-registration in a Cognito User Pool\nresource \"aws_cognito_user_pool\" \"<example_resource_name>\" {\n  admin_create_user_config {\n    allow_admin_create_user_only = true  # Critical: disables self sign-up; only admins can create users\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "To disable self registration for the Amazon Cognito User Pool, perform the following actions:",
-      "Url": "https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html"
+      "Text": "Enforce **admin-only user creation**. If self sign-up is necessary, require **verification**, **MFA**, and bot protections; restrict app clients. Apply **least privilege** to any roles for authenticated users and minimize scopes. Use approval/invite flows, add **rate limits**, monitor sign-ups, and audit access for **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/cognito_user_pool_self_registration_disabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/cognito/cognito_user_pool_temporary_password_expiration/cognito_user_pool_temporary_password_expiration.metadata.json

@@ -1,29 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "cognito_user_pool_temporary_password_expiration",
-  "CheckTitle": "Ensure that the user pool has a temporary password expiration period of 7 days or less",
-  "CheckType": [],
+  "CheckTitle": "Cognito user pool has temporary password expiration set to 7 days or less",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "TTPs/Initial Access",
+    "TTPs/Credential Access"
+  ],
   "ServiceName": "cognito",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:cognito-idp:region:account:userpool/userpool-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsCognitoUserPool",
-  "Description": "Temporary passwords are set by the administrator and are used to allow users to sign in and change their password. Temporary passwords are valid for a limited period of time, after which they expire. Temporary passwords are used when an administrator creates a new user account or resets a user password. The temporary password expiration period is the length of time that the temporary password is valid. The default value is 7 days. You can set the expiration period to a value between 0 and 365 days.",
-  "Risk": "If the temporary password expiration period is too long, it increases the risk of unauthorized access to the user account. If the temporary password expiration period is too short, it increases the risk of users being unable to sign in and change their password.",
-  "RelatedUrl": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html",
+  "ResourceType": "Other",
+  "ResourceGroup": "IAM",
+  "Description": "**Amazon Cognito user pools** use **administrator-issued temporary passwords**. This evaluates whether a user pool defines a **password policy** and sets the temporary password validity to `7 days` or fewer.",
+  "Risk": "**Long-lived temporary passwords** or an **absent policy** expand the window for credential reuse or interception. An attacker who obtains a temp password can complete first sign-in and set a new secret, enabling account takeover, unauthorized data access, and changes that impact confidentiality and integrity.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies \"PasswordPolicy={TemporaryPasswordValidityDays=7}\"",
+      "NativeIaC": "```yaml\n# CloudFormation: Set Cognito temporary password expiration to 7 days or less\nResources:\n  <example_resource_name>:\n    Type: AWS::Cognito::UserPool\n    Properties:\n      Policies:\n        PasswordPolicy:\n          TemporaryPasswordValidityDays: 7  # Critical: ensures temp passwords expire in 7 days (PASS)\n```",
+      "Other": "1. Open the Amazon Cognito console and select **User pools**\n2. Choose your user pool\n3. Go to **Authentication** (or **Authentication methods**) > **Password policy**\n4. Set **Temporary passwords set by administrators expire in** to **7** (or fewer) days\n5. Click **Save changes**",
+      "Terraform": "```hcl\n# Terraform: Set Cognito temporary password expiration to 7 days or less\nresource \"aws_cognito_user_pool\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  password_policy {\n    temporary_password_validity_days = 7  # Critical: 7 or less to pass the check\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Set the temporary password expiration period to 7 days or less.",
-      "Url": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html"
+      "Text": "Define a **password policy** with temporary password validity `<= 7 days` (use the shortest practical). Require change on first sign-in, enable **MFA** during enrollment, and deliver secrets via secure channels. Apply **least privilege** and revoke or reissue unused temporary credentials promptly.",
+      "Url": "https://hub.prowler.com/check/cognito_user_pool_temporary_password_expiration"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/cognito/cognito_user_pool_waf_acl_attached/cognito_user_pool_waf_acl_attached.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "cognito_user_pool_waf_acl_attached",
-  "CheckTitle": "Ensure that Amazon Cognito User Pool is associated with a WAF Web ACL",
-  "CheckType": [],
+  "CheckTitle": "Amazon Cognito user pool is associated with a WAF Web ACL",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Denial of Service"
+  ],
   "ServiceName": "cognito",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:cognito-idp:region:account:userpool/userpool-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsCognitoUserPool",
-  "Description": "Web ACLs are used to control access to your content. You can use a Web ACL to control who can access your content. You can also use a Web ACL to block requests based on IP address, HTTP headers, HTTP body, URI, or URI query string parameters. You can associate a Web ACL with a Cognito User Pool to control access to your content.",
-  "Risk": "If a Web ACL is not associated with a Cognito User Pool, then the content is not protected by the Web ACL. This could lead to unauthorized access to your content.",
-  "RelatedUrl": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html",
+  "ResourceType": "AwsWafv2WebAcl",
+  "ResourceGroup": "IAM",
+  "Description": "Amazon Cognito user pools are evaluated for an association with an **AWS WAFv2 web ACL** that filters and controls requests to the hosted UI and public user pool API endpoints.",
+  "Risk": "Without a web ACL, Cognito endpoints lack layer-7 filtering, enabling:\n- Credential stuffing and account enumeration\n- Bot abuse and high-rate requests degrading service\n- Malicious payload probes\n\nThis threatens **availability**, risks unauthorized access to user data (**confidentiality**), and undermines session **integrity**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws wafv2 associate-web-acl --web-acl-arn <WEB_ACL_ARN> --resource-arn <COGNITO_USER_POOL_ARN>",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::WAFv2::WebACLAssociation\n    Properties:\n      ResourceArn: <example_resource_arn>  # Critical: Cognito User Pool ARN to protect\n      WebACLArn: <example_web_acl_arn>     # Critical: WAF Web ACL ARN to associate\n```",
+      "Other": "1. Open the AWS Console and go to Cognito > User pools\n2. Select the user pool\n3. In Security, open the AWS WAF tab and click Edit\n4. Check Use AWS WAF with your user pool\n5. Select the existing regional Web ACL\n6. Click Save changes",
+      "Terraform": "```hcl\nresource \"aws_wafv2_web_acl_association\" \"<example_resource_name>\" {\n  resource_arn = \"<example_resource_arn>\"  # Critical: Cognito User Pool ARN\n  web_acl_arn  = \"<example_web_acl_arn>\"   # Critical: WAF Web ACL ARN\n}\n```"
     },
     "Recommendation": {
-      "Text": "The Web ACL should be associated with the Cognito User Pool. To associate a Web ACL with a Cognito User Pool, use the AWS Management Console.",
-      "Url": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html"
+      "Text": "Associate an **AWS WAFv2 web ACL** with each user pool to enforce layer-7 controls. Use defense-in-depth: managed rule groups, `rate-based` limits, IP reputation, and bot mitigation. Enable request logging and continuously tune rules to reduce false positives. *Avoid rule sets incompatible with Cognito endpoints.*",
+      "Url": "https://hub.prowler.com/check/cognito_user_pool_waf_acl_attached"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "threat-detection",
+    "internet-exposed"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "monitoring",
   "Description": "**AWS accounts** have **AWS Config recorders** active and healthy in each Region. It identifies Regions with no recorder, a disabled recorder, or a recorder in a failure state.",
   "Risk": "**Gaps in Config recording** create **blind spots**. Changes in unmonitored Regions aren't captured, weakening **integrity** and **auditability**. Adversaries can alter resources or stage assets unnoticed, enabling misconfigurations and delaying **incident response**.",
   "RelatedUrl": "",

prowler/providers/aws/services/config/config_recorder_using_aws_service_role/config_recorder_using_aws_service_role.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "monitoring",
   "Description": "**AWS Config recorders** are evaluated for use of the service‑linked IAM role `AWSServiceRoleForConfig` linked to `config.amazonaws.com` rather than a custom role.\n\nThe evaluation inspects active recorders and their role ARN to confirm the AWS‑managed service‑linked role is in use.",
   "Risk": "Using a custom or incorrect role can break recording or create blind spots, undermining the **integrity** and **availability** of configuration history. Over‑privileged roles weaken **least privilege**, increasing risk of unauthorized access, stealthy changes, and delayed incident response.",
   "RelatedUrl": "",

prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.metadata.json

@@ -1,28 +1,34 @@
 {
   "Provider": "aws",
   "CheckID": "datasync_task_logging_enabled",
-  "CheckTitle": "DataSync tasks should have logging enabled",
+  "CheckTitle": "DataSync task has CloudWatch Logs log group configured for logging",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "datasync",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:datasync:{region}:{account-id}:task/{task-id}",
+  "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AwsDataSyncTask",
-  "Description": "This control checks if AWS DataSync tasks have logging enabled. The control fails if the task doesn't have the CloudWatchLogGroupArn property defined.",
-  "Risk": "Without logging enabled, important operational data may be lost, making it difficult to troubleshoot issues, monitor performance, and ensure compliance with auditing requirements.",
-  "RelatedUrl": "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging",
+  "ResourceType": "Other",
+  "ResourceGroup": "storage",
+  "Description": "**AWS DataSync tasks** are evaluated for a configured **CloudWatch Logs** destination (`CloudWatchLogGroupArn`).\n\nTasks that specify a log group are recognized as logging-enabled; those without one are identified as not publishing execution events.",
+  "Risk": "**Absent DataSync task logs** create blind spots, preventing timely detection of **failed or partial transfers**, unexpected deletions, or anomalies. This undermines data **integrity** verification, obscures potential **exfiltration** indicators, and slows forensics and recovery, reducing **availability** during incidents.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://support.icompaas.com/support/solutions/articles/62000233637-ensure-datasync-tasks-should-have-logging-enabled",
+    "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws datasync update-task --task-arn <task-arn> --cloud-watch-log-group-arn <log-group-arn>",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: Enable CloudWatch Logs for a DataSync task\nResources:\n  <example_resource_name>:\n    Type: AWS::DataSync::Task\n    Properties:\n      SourceLocationArn: <example_source_location_arn>\n      DestinationLocationArn: <example_destination_location_arn>\n      CloudWatchLogGroupArn: <example_log_group_arn>  # Critical: attaches a CloudWatch Logs group to enable task logging\n```",
+      "Other": "1. In the AWS Console, go to DataSync > Tasks\n2. Select the task and click Edit\n3. In the Logging section, set CloudWatch Log group to an existing log group\n4. Click Save",
+      "Terraform": "```hcl\n# Enable CloudWatch Logs for a DataSync task\nresource \"aws_datasync_task\" \"<example_resource_name>\" {\n  source_location_arn      = \"<example_source_location_arn>\"\n  destination_location_arn = \"<example_destination_location_arn>\"\n  cloudwatch_log_group_arn = \"<example_log_group_arn>\"  # Critical: attaches a CloudWatch Logs group to enable task logging\n}\n```"
     },
     "Recommendation": {
-      "Text": "Configure logging for your DataSync tasks to ensure that operational data is captured and available for debugging, monitoring, and auditing purposes.",
-      "Url": "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging"
+      "Text": "Configure each task to publish logs to a dedicated CloudWatch Logs group. Select an appropriate log level (e.g., `BASIC` or `TRANSFER`), enforce **least privilege** for log access, set **retention** and immutability, and integrate alerts. Centralize and monitor logs to support **defense in depth** and incident response.",
+      "Url": "https://hub.prowler.com/check/datasync_task_logging_enabled"
     }
   },
   "Categories": [

prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "network",
   "Description": "**AWS Direct Connect** connectivity is provisioned with **connection and location redundancy**-multiple connections spread across **at least two distinct Direct Connect locations** in each Region.",
   "Risk": "Missing **connection/location redundancy** creates a **single point of failure**, degrading **availability**. A router, fiber, or site outage can sever private paths to AWS, stalling app traffic, data replication, and admin access, leading to timeouts or extended downtime until alternate paths are restored.",
   "RelatedUrl": "",

prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "network",
   "Description": "**Direct Connect gateways** and **virtual private gateways** are assessed for **interface redundancy**: multiple virtual interfaces (`VIFs`) distributed across more than one **Direct Connect connection**.\n\n*Gateways with only one VIF or with all VIFs on a single connection are identified.*",
   "Risk": "Missing connection diversity undermines **availability**. A single device, fiber, or location failure can cut on-prem to VPC connectivity, causing **outages**, **packet loss**, or routing blackholes. Fallback to internet VPN can add latency and throttle throughput, delaying recovery and impacting operations.",
   "RelatedUrl": "",

prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "IAM",
   "Description": "**AWS Directory Service directories** are configured to forward domain controller security event logs to **CloudWatch Logs** using log subscriptions.\n\nEvaluation identifies directories with or without this forwarding in place.",
   "Risk": "Without forwarding, visibility into AD security events is lost, delaying detection of suspicious authentications, policy changes, or privilege grants. Attackers can escalate and persist unnoticed, risking unauthorized access (confidentiality) and identity/policy manipulation (integrity), while hampering forensics and response.",
   "RelatedUrl": "",

prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.metadata.json

@@ -10,6 +10,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "IAM",
   "Description": "**AWS Directory Service** directories are associated with **Amazon SNS topics** to send status change notifications (e.g., `Active`  `Impaired`).\n\nThe evaluation looks for directories that have SNS event topics configured for monitoring alerts.",
   "Risk": "Missing directory notifications reduces visibility into health changes, causing delayed response to `Impaired` states. This threatens availability of authentication, Kerberos/LDAP lookups, and domain joins; increases MTTR; and can enable silent replication or trust failures that impact integrity across dependent workloads.",
   "RelatedUrl": "",

prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "low",
   "ResourceType": "Other",
+  "ResourceGroup": "IAM",
   "Description": "**AWS Directory Service** directories with **manual snapshot capacity** fully consumed or nearly exhausted, based on current snapshot count relative to the directory's maximum allowed.",
   "Risk": "With no remaining snapshot capacity, you cannot create new recovery points:\n- Reduced availability during outages or ransomware\n- Higher RPO from failed scheduled backups\n- Greater change risk (schema/OS updates) without a safe rollback",
   "RelatedUrl": "",

prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "IAM",
   "Description": "**AWS Directory Service** Secure LDAP (LDAPS) certificates are assessed for upcoming expiration by comparing each directory's certificate expiration to the current time and identifying those with `<= 90` days remaining.",
   "Risk": "Expired LDAPS certificates cause TLS handshakes to fail, blocking directory binds and queries and disrupting authentication and app integrations (availability). If clients fall back to plain LDAP, credentials and directory data can be intercepted or altered (confidentiality and integrity).",
   "RelatedUrl": "",

prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "IAM",
   "Description": "AWS Directory Service RADIUS configuration uses the **authentication protocol** defined for MFA integration. The finding evaluates whether directories with RADIUS enabled are set to `MS-CHAPv2` instead of weaker options like `PAP`, `CHAP`, or `MS-CHAPv1`.",
   "Risk": "Using `PAP`, `CHAP`, or `MS-CHAPv1` weakens RADIUS-based MFA.\n\n`PAP` exposes cleartext credentials, while legacy CHAP variants permit offline cracking and replay, enabling unauthorized access to AD-integrated services and lateral movement, degrading confidentiality and integrity.",
   "RelatedUrl": "",

prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.metadata.json

@@ -13,6 +13,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "IAM",
   "Description": "**AWS Directory Service directories** are evaluated for **RADIUS-backed multi-factor authentication**, confirming that MFA is configured and the RADIUS integration is active.",
   "Risk": "Without **RADIUS MFA**, directory-based sign-ins to AWS-integrated services rely on a single factor, enabling credential stuffing and phishing to succeed. Compromised passwords can grant unauthorized access, drive data exfiltration, and enable privilege escalation, undermining confidentiality and integrity.",
   "RelatedUrl": "",

prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "storage",
   "Description": "**EBS snapshots** are expected to be governed by **Data Lifecycle Manager (DLM) policies** in each Region where snapshots exist.\n\nThe evaluation looks for lifecycle policies that automate snapshot creation, retention, and cleanup for those snapshots.",
   "Risk": "Without **automated lifecycle policies**, backups become inconsistent and error-prone, reducing availability and weakening recovery objectives. Missing retention rules cause premature deletion or snapshot sprawl, increasing cost and exposing stale data. Lack of cross-Region/account copies limits resilience to regional outages and malicious deletion.",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsEndpoint",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS MongoDB endpoints** use an authentication mechanism. Configuration expects `AuthType` not `no` (e.g., `password`) with an `authMechanism` such as `scram_sha_1` or `mongodb_cr`.",
   "Risk": "Without authentication, unauthenticated connections can access the source, degrading **confidentiality** and **integrity**. Adversaries could read or modify migrated documents, hijack CDC, inject data, or exfiltrate records during replication.",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsEndpoint",
+  "ResourceGroup": "database",
   "Description": "**DMS Neptune endpoints** have **IAM authorization** enabled via the endpoint setting `IamAuthEnabled`.",
   "Risk": "Without **IAM authorization**, migration components can interact with Neptune using broad trust, enabling unauthorized data loads, reads, or alterations.\n\nThis degrades **confidentiality** and **integrity** and increases the chance of privilege abuse and data exfiltration.",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.metadata.json

@@ -13,6 +13,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsEndpoint",
+  "ResourceGroup": "database",
   "Description": "**DMS Redis OSS endpoints** are assessed for the presence of **TLS** in their endpoint settings, such as `ssl-encryption`, indicating encrypted connections between the DMS replication instance and Redis.",
   "Risk": "Without **TLS**, traffic between DMS and Redis can be intercepted or altered, compromising **confidentiality** and **integrity**.\n\nAttackers can perform **man-in-the-middle** interception, steal auth tokens, and inject or corrupt migrated data.",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsDmsEndpoint",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS endpoints** have their SSL/TLS mode inspected; any value other than `none` denotes encrypted connections between the replication instance and databases.\n\nSupported modes include `require`, `verify-ca`, and `verify-full`.",
   "Risk": "Without TLS, data in transit can be read or altered, affecting:\n- **Confidentiality** via packet sniffing and credential leakage\n- **Integrity** through **MITM** tampering of migration streams\n- **Availability** from session hijack or task disruption",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsReplicationInstance",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS replication instances** are evaluated for the `auto_minor_version_upgrade` setting to confirm **automatic minor engine updates** are enabled during the maintenance window.",
   "Risk": "Without **automatic minor upgrades**, DMS engines can miss security patches and fixes, enabling exploitation of known flaws and instability.\n- Confidentiality: exposure via unpatched components\n- Integrity: replication errors or data drift\n- Availability: outages during migration or CDC",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsReplicationInstance",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS replication instances** are evaluated for **Multi-AZ** configuration. Instances with `multi_az` enabled are treated as having a cross-AZ standby; those without it are identified as single-AZ.",
   "Risk": "Without **Multi-AZ**, a single-AZ failure or maintenance event can halt migrations, causing extended downtime (**availability**) and replication gaps or rollbacks (**integrity**). Tasks may stall, increase cutover risk, and require manual recovery when the replication instance is unavailable.",
   "RelatedUrl": "",