prowler 5.16.1__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.metadata.json

@@ -13,6 +13,7 @@
   "ResourceIdTemplate": "",
   "Severity": "critical",
   "ResourceType": "AwsDmsReplicationInstance",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS replication instances** are evaluated for **public exposure**. Exposure is identified when `PubliclyAccessible` is enabled and an attached security group allows inbound traffic from any address. Private or allowlisted instances are not considered exposed.",
   "Risk": "Publicly reachable replication instances threaten:\n- Confidentiality: migration data and credentials can be intercepted or exfiltrated.\n- Integrity: attackers may alter tasks or inject records.\n- Availability: abuse or DDoS can stall replication and delay cutovers.",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py

@@ -25,8 +25,8 @@ class dms_instance_no_public_access(Check):
                                 if check_security_group(
                                     ingress_rule,
                                     "-1",
-                                    ports=None,
                                     any_address=True,
+                                    all_ports=True,
                                 ):
                                     report.status = "FAIL"
                                     report.status_extended = f"DMS Replication Instance {instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) is open to the Internet."

prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsReplicationTask",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS replication tasks** have **logging enabled** and configure `SOURCE_CAPTURE` and `SOURCE_UNLOAD` with severity at least `LOGGER_SEVERITY_DEFAULT` (or higher: `LOGGER_SEVERITY_DEBUG`, `LOGGER_SEVERITY_DETAILED_DEBUG`).",
   "Risk": "Missing or low-severity source logs hinder visibility into **CDC** and full-load activity, risking undetected errors, stalls, or tampering. This can cause silent **data drift**, broken lineage, and failed recoveries, undermining **integrity** and **availability** and weakening auditability during investigations.",
   "RelatedUrl": "",

prowler/providers/aws/services/dms/dms_replication_task_target_logging_enabled/dms_replication_task_target_logging_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDmsReplicationTask",
+  "ResourceGroup": "database",
   "Description": "**AWS DMS replication tasks** have target logging enabled, including `TARGET_APPLY` and `TARGET_LOAD`, each set to at least `LOGGER_SEVERITY_DEFAULT`.",
   "Risk": "Insufficient target logging limits visibility into load/apply activity, masking failures and anomalies. This risks **data integrity** (silent drift, partial loads) and **availability** (longer incident resolution), and reduces **auditability** of migration events.",
   "RelatedUrl": "",

prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
+  "ResourceGroup": "database",
   "Description": "**Amazon DocumentDB clusters** are evaluated for **automated backups** and an adequate **backup retention period**. Clusters should have `backup_retention_period` set to at least the configured minimum (default `7` days). Values of `0` indicate backups are disabled; values below the threshold are considered insufficient.",
   "Risk": "Without adequate backups, clusters can't be reliably restored. Accidental deletes, logical corruption, or ransomware may cause irreversible data loss once a short retention window expires, leading to prolonged outages, missed RPO/RTO, and limited ability to roll back malicious or erroneous changes.",
   "RelatedUrl": "",

prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
+  "ResourceGroup": "database",
   "Description": "Amazon DocumentDB clusters are evaluated for exporting `audit` and `profiler` logs to **CloudWatch Logs**.\nClusters missing one or both log types are identified as lacking complete log export configuration.",
   "Risk": "Missing **audit** and/or **profiler** exports reduces observability of authentication, authorization, and data definition activity.\nAttacks like brute-force logins, privilege abuse, or destructive schema changes can go unnoticed, degrading **confidentiality** and **integrity** and delaying incident response.",
   "RelatedUrl": "",

prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
+  "ResourceGroup": "database",
   "Description": "**Amazon DocumentDB clusters** are evaluated for the `deletion_protection` setting on the cluster configuration.\n\nThe finding highlights clusters where this protection is not enabled.",
   "Risk": "Without **deletion protection**, clusters can be deleted by mistake or misuse, causing sudden outage and loss of recovery points, impacting **availability** and **data integrity**.\n\nCompromised accounts or faulty automation can remove databases or skip final snapshots, hindering restoration.",
   "RelatedUrl": "",

prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json

@@ -10,6 +10,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
+  "ResourceGroup": "database",
   "Description": "**Amazon DocumentDB clusters** with **Multi-AZ** (`multi_az`) indicate deployment of a primary and one or more replicas across Availability Zones.",
   "Risk": "Without Multi-AZ, the cluster depends on a single AZ/instance. An AZ or node failure-or maintenance-can stop reads and writes, causing downtime, timeouts, and SLA breaches. Availability degrades, RTO rises, and applications may experience failed or retried transactions until replacement capacity is created.",
   "RelatedUrl": "",

prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json

@@ -13,6 +13,7 @@
   "ResourceIdTemplate": "",
   "Severity": "critical",
   "ResourceType": "AwsRdsDbClusterSnapshot",
+  "ResourceGroup": "database",
   "Description": "**Amazon DocumentDB** manual cluster snapshot visibility is evaluated to detect snapshots marked as **public** instead of limited to specified AWS accounts.",
   "Risk": "**Public snapshots** weaken **confidentiality**: any AWS account can restore and read database contents, enabling data exfiltration.\n\nThey also aid **lateral movement** by revealing embedded secrets/config and reduce accountability when restores occur outside your account.",
   "RelatedUrl": "",

prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json

@@ -16,6 +16,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
+  "ResourceGroup": "database",
   "Description": "**Amazon DocumentDB clusters** are assessed for **storage encryption at rest** via the cluster's `encrypted` setting.\n\nIt identifies clusters where data volumes, automated backups, and snapshots aren't protected by AWS KMS-managed encryption.",
   "Risk": "Without at-rest encryption, cluster data, snapshots, and backups can be read in plaintext if copies are leaked, mis-shared, or underlying storage is accessed. This harms **confidentiality**, enables offline analysis and data exfiltration, and widens the blast radius of insider or backup repository compromise.",
   "RelatedUrl": "",

prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.metadata.json

@@ -10,6 +10,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "compute",
   "Description": "**AWS Elastic Disaster Recovery** is assessed per Region to verify the service is **initialized** and that at least one **recovery or drill job** exists, demonstrating that failover has been exercised.",
   "Risk": "Without DRS enabled or any prior jobs, workloads are **unprotected and untested**, undermining **availability**.\nDuring outages or ransomware, recovery may be delayed or fail, increasing RTO/RPO, causing **data loss** and prolonged downtime.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "database",
   "Description": "**Amazon DynamoDB Accelerator (DAX) clusters** are evaluated for **server-side `encryption at rest`**. The finding indicates whether the cluster's on-disk cache, configuration, and logs are encrypted using service-managed keys.",
   "Risk": "Without **encryption at rest**, DAX on-disk cache and logs can be extracted from underlying storage by those with low-level access, compromising **confidentiality** and enabling offline data mining.\n\nThreats:\n- Compromised host or admin\n- Lost/retired media\n- Unauthorized backups or snapshots",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "database",
   "Description": "**DAX clusters** have endpoint encryption set to `TLS`, enforcing **encryption in transit** for client connections to the cluster",
   "Risk": "Missing **TLS** enables interception and manipulation of DAX traffic, impacting:\n- Confidentiality: exposure of queries, data, or credentials\n- Integrity: tampered requests/responses and cache poisoning\n- Availability: session hijacking or replay causing service disruption",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Other",
+  "ResourceGroup": "database",
   "Description": "**Amazon DynamoDB Accelerator (DAX)** cluster node placement across **Availability Zones** is evaluated. Clusters with nodes in more than one AZ within the Region are recognized as multi-AZ; clusters whose nodes reside in a single AZ are recognized as single-AZ.",
   "Risk": "Without **multi-AZ DAX nodes**, an AZ outage or primary node failure can render the cache **unavailable**, harming **availability** and causing **latency spikes** and **throttling** as load shifts to DynamoDB. Loss of caching can drive higher costs and trigger **timeout cascades** in read-heavy workloads.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDynamoDbTable",
+  "ResourceGroup": "database",
   "Description": "**DynamoDB tables** use **automatic capacity scaling** via `on-demand` mode or `PROVISIONED` mode with **auto scaling** enabled for both `read` and `write` capacity units.\n\nProvisioned tables are evaluated for scaling on both dimensions.",
   "Risk": "**Insufficient capacity scaling** causes throttling that degrades **availability** and increases latency.\n\nSustained throttling can trigger retry storms, timeouts, and backlogs, risking missed writes or out-of-order processing that impacts **data integrity** and drives **operational costs**.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDynamoDbTable",
+  "ResourceGroup": "database",
   "Description": "**DynamoDB tables** are evaluated for **resource-based policies** that permit cross-account or public principals.\n\nTables without a resource policy, or with policies restricted to the same account, are identified as isolated configurations.",
   "Risk": "Allowing other accounts to access a table affects:\n- **Confidentiality**: unauthorized reads/data exfiltration\n- **Integrity**: writes or deletes by external principals\n- **Availability**: capacity exhaustion and throttling\n- **Cost**: owner pays for external requests\n\nIf public principals are allowed, exposure can be unrestricted.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDynamoDbTable",
+  "ResourceGroup": "database",
   "Description": "**DynamoDB tables** have **deletion protection** enabled via the `deletion protection` setting, meaning delete operations require this setting to be disabled first",
   "Risk": "Without **deletion protection**, tables can be removed by authorized actions or misconfigured automation, causing irrecoverable data loss and service outage. This impacts **integrity** and **availability**, and increases the blast radius of compromised credentials or mistaken runbooks.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDynamoDbTable",
+  "ResourceGroup": "database",
   "Description": "**DynamoDB tables** are evaluated for inclusion in an **AWS Backup backup plan** through resource assignments, including explicit tables, resource-type wildcards, or all-resources coverage.\n\nThe result indicates whether a table is governed by scheduled backups and retention defined by the plan.",
   "Risk": "Without a backup plan, table data lacks governed copies, harming **availability** and **integrity**. Accidental deletes, corrupt writes, or malicious actions can become unrecoverable, and RPO/RTO worsen. You also forfeit cross-Region/account copies and immutability features, increasing downtime and data loss.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.metadata.json

@@ -12,6 +12,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDynamoDbTable",
+  "ResourceGroup": "database",
   "Description": "**DynamoDB tables** use **AWS KMS keys** (`KMS`) for encryption at rest instead of the default service-owned key",
   "Risk": "Relying on the default service-owned key reduces control over **confidentiality**: no custom key policies, limited auditability, and no independent rotation or disablement. This weakens least-privilege enforcement and incident response, and can impede meeting mandates that require customer-controlled keys.",
   "RelatedUrl": "",

prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.metadata.json

@@ -11,6 +11,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsDynamoDbTable",
+  "ResourceGroup": "database",
   "Description": "**DynamoDB tables** have **Point-in-Time Recovery** (`PITR`) enabled",
   "Risk": "Without **PITR**, unintended or malicious writes/deletes cannot be precisely rolled back, leading to permanent data loss and corrupted state. Failures from buggy deployments, compromised credentials, or faulty batch jobs reduce data **integrity** and **availability**, and prolong incident recovery and forensic analysis.",
   "RelatedUrl": "",

prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.metadata.json

@@ -1,28 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_ami_public",
-  "CheckTitle": "Ensure there are no EC2 AMIs set as Public.",
+  "CheckTitle": "EC2 AMI owned by the account is not public",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "ami",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "critical",
   "ResourceType": "Other",
-  "Description": "Ensure there are no EC2 AMIs set as Public.",
-  "Risk": "When your AMIs are publicly accessible, they are available in the Community AMIs where everyone with an AWS account can use them to launch EC2 instances. Your AMIs could contain snapshots of your applications (including their data), therefore exposing your snapshots in this manner is not advised.",
+  "ResourceGroup": "compute",
+  "Description": "**EC2 AMIs owned by the account** are evaluated for **public visibility** via their launch permissions. Images shared with all accounts (`Group=all`) are treated as publicly accessible.",
+  "Risk": "Public AMIs expose image contents to any AWS account, undermining **confidentiality** and **integrity**:\n- Leakage of embedded secrets, configs, or data from referenced snapshots\n- Adversaries can fingerprint your stack, aiding targeted exploits or repackaging for supply chain abuse",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html",
+    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html",
+    "https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html",
+    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws ec2 modify-image-attribute --region <REGION> --image-id <EC2_AMI_ID> --launch-permission {\"Remove\":[{\"Group\":\"all\"}]}",
+      "CLI": "aws ec2 modify-image-attribute --image-id <EC2_AMI_ID> --launch-permission \"Remove=[{Group=all}]\"",
       "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/aws/public-policies/public_8",
+      "Other": "1. Open the Amazon EC2 console and go to AMIs\n2. Select the AMI with Visibility = Public\n3. Click Actions > Edit AMI permissions\n4. Under AMI availability, select Private\n5. Click Save changes",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "We recommend your EC2 AMIs are not publicly accessible, or generally available in the Community AMIs.",
-      "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html"
+      "Text": "Keep AMIs **private** and enforce **least privilege** launch permissions. Share only with specific accounts and review access routinely. Enable **block public access for AMIs**, sanitize images to remove secrets, encrypt backing snapshots, and apply lifecycle governance to retire outdated images.",
+      "Url": "https://hub.prowler.com/check/ec2_ami_public"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.metadata.json

@@ -1,29 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_client_vpn_endpoint_connection_logging_enabled",
-  "CheckTitle": "EC2 Client VPN endpoints should have client connection logging enabled.",
-  "CheckType": [],
+  "CheckTitle": "EC2 Client VPN endpoint has client connection logging enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)"
+  ],
   "ServiceName": "ec2",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "low",
   "ResourceType": "AwsEc2ClientVpnEndpoint",
-  "Description": "This control checks whether an AWS Client VPN endpoint has client connection logging enabled. The control fails if the endpoint doesn't have client connection logging enabled.",
-  "Risk": "Client VPN endpoints allow remote clients to securely connect to resources in a Virtual Private Cloud (VPC) in AWS. Connection logs allow you to track user activity on the VPN endpoint and provides visibility.",
-  "RelatedUrl": "https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html",
+  "ResourceGroup": "network",
+  "Description": "**AWS Client VPN endpoints** are evaluated for **client connection logging** that records client connect/disconnect events to CloudWatch Logs. The evaluation detects endpoints where this logging is disabled.",
+  "Risk": "Without **Client VPN connection logs**, remote access lacks an **audit trail**, reducing detection and accountability.\n- Stolen credentials can be used unnoticed\n- Lateral movement and data exfiltration persist\nImpacts **confidentiality** and **integrity**; delayed investigation can degrade **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-51",
+    "https://docs.aws.amazon.com/config/latest/developerguide/ec2-client-vpn-connection-log-enabled.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-51",
-      "Terraform": ""
+      "CLI": "aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --connection-log-options Enabled=true,CloudWatchLogGroup=<CLOUDWATCH_LOG_GROUP_NAME>",
+      "NativeIaC": "```yaml\n# CloudFormation: enable connection logging on a Client VPN endpoint\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::ClientVpnEndpoint\n    Properties:\n      ClientCidrBlock: 10.0.0.0/22\n      ServerCertificateArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\n      AuthenticationOptions:\n        - Type: certificate-authentication\n          MutualAuthentication:\n            ClientRootCertificateChainArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\n      ConnectionLogOptions:               # CRITICAL: enables client connection logging\n        Enabled: true                     # CRITICAL: turns on logging\n        CloudWatchLogGroup: <example_resource_name>  # CRITICAL: destination log group\n```",
+      "Other": "1. Open the Amazon VPC console and go to Client VPN Endpoints\n2. Select the endpoint and choose Actions > Modify client VPN endpoint\n3. Under Connection logging, check Enable\n4. For CloudWatch log group, select an existing log group\n5. Click Save changes",
+      "Terraform": "```hcl\n# Terraform: enable connection logging on a Client VPN endpoint\nresource \"aws_ec2_client_vpn_endpoint\" \"<example_resource_name>\" {\n  server_certificate_arn = \"arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\"\n  client_cidr_block      = \"10.0.0.0/22\"\n\n  authentication_options {\n    type                       = \"certificate-authentication\"\n    root_certificate_chain_arn = \"arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\"\n  }\n\n  connection_log_options {                # CRITICAL: enables client connection logging\n    enabled             = true            # CRITICAL: turns on logging\n    cloudwatch_log_group = \"<example_resource_name>\"  # CRITICAL: destination log group\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "To enable connection logging, see Enable connection logging for an existing Client VPN endpoint in the AWS Client VPN Administrator Guide.",
-      "Url": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-client-vpn-connection-log-enabled.html"
+      "Text": "Enable **client connection logging** on all Client VPN endpoints and send events to a centralized log group.\n- Enforce least privilege on log access\n- Define retention and immutability\n- Integrate with monitoring/alerts\n- Separate VPN operations from log administration\n- Review anomalous login patterns",
+      "Url": "https://hub.prowler.com/check/ec2_client_vpn_endpoint_connection_logging_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.metadata.json

@@ -1,28 +1,37 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_ebs_default_encryption",
-  "CheckTitle": "Check if EBS Default Encryption is activated.",
+  "CheckTitle": "EBS default encryption is enabled",
   "CheckType": [
-    "Data Protection"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "ebs",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "medium",
-  "ResourceType": "Other",
-  "Description": "Check if EBS Default Encryption is activated.",
-  "Risk": "If not enabled sensitive information at rest is not protected.",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsEc2Volume",
+  "ResourceGroup": "compute",
+  "Description": "**EBS** uses `encryption by default` at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen **KMS key**",
+  "Risk": "Without `encryption by default`, data on new **EBS volumes** and **snapshots** may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of **confidentiality**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/",
+    "https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/configure-default-encryption.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws ec2 enable-ebs-encryption-by-default",
-      "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/aws/general-policies/ensure-ebs-default-encryption-is-enabled#aws-console",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-ebs-default-encryption-is-enabled#terraform"
+      "CLI": "aws ec2 enable-ebs-encryption-by-default --region <REGION>",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::EBSEncryptionByDefault\n    Properties:\n      Enabled: true  # Critical: turns on default EBS encryption in this region\n```",
+      "Other": "1. In the AWS console, switch to the affected Region\n2. Go to EC2 > Settings (or Account attributes) > EBS encryption\n3. Click Enable default encryption and Save",
+      "Terraform": "```hcl\nresource \"aws_ebs_encryption_by_default\" \"<example_resource_name>\" {\n  enabled = true  # Critical: enables default EBS encryption in this region\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.",
-      "Url": "https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/"
+      "Text": "Enable `EBS encryption by default` in every region and select a **customer-managed KMS key**. Apply **least privilege** to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/ec2_ebs_default_encryption"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.metadata.json

@@ -1,28 +1,35 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_ebs_public_snapshot",
-  "CheckTitle": "Ensure there are no EBS Snapshots set as Public.",
+  "CheckTitle": "EBS snapshot is not public",
   "CheckType": [
-    "Data Protection"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "snapshot",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "critical",
-  "ResourceType": "Other",
-  "Description": "Ensure there are no EBS Snapshots set as Public.",
-  "Risk": "When you share a snapshot, you are giving others access to all of the data on the snapshot. Share snapshots only with people with whom you want to share all of your snapshot data.",
+  "ResourceType": "AwsEc2Volume",
+  "ResourceGroup": "compute",
+  "Description": "**EBS snapshots** with **public sharing** permissions (accessible by all AWS accounts) are identified, as opposed to snapshots shared privately with specific accounts.",
+  "Risk": "Public snapshots expose full volume contents, harming **confidentiality**. Any account can create a volume from the snapshot to read files, secrets, or database data, enabling **data exfiltration**, broad reconnaissance, and facilitating **lateral movement**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/public-snapshots.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws ec2 modify-snapshot-attribute --region <REGION> --snapshot-id <EC2_SNAPSHOT_ID> --attribute createVolumePermission --operation remove --user-ids all",
+      "CLI": "aws ec2 modify-snapshot-attribute --snapshot-id <EC2_SNAPSHOT_ID> --attribute createVolumePermission --operation-type remove --group-names all",
       "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/aws/public-policies/public_7",
+      "Other": "1. Open the AWS Management Console and go to EC2\n2. In the left menu, select Snapshots\n3. Select the snapshot <EC2_SNAPSHOT_ID>\n4. Click Actions > Modify permissions\n5. Choose Private (remove Public/all if present)\n6. Click Save changes",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Ensure the snapshot should be shared.",
-      "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html"
+      "Text": "Keep snapshots **private** and share only with specific accounts under **least privilege**. Enable `Block public access for Amazon EBS snapshots` regionally. Prefer **CMEK encryption** and avoid sharing keys broadly. Regularly review sharing permissions and monitor snapshot usage.",
+      "Url": "https://hub.prowler.com/check/ec2_ebs_public_snapshot"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.metadata.json

@@ -1,28 +1,35 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_ebs_snapshot_account_block_public_access",
-  "CheckTitle": "Ensure that public access to EBS snapshots is disabled",
+  "CheckTitle": "All EBS snapshots have public access blocked",
   "CheckType": [
-    "Data Protection"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "snapshot",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AwsAccount",
-  "Description": "EBS snapshots can be shared with other AWS accounts or made public. By default, EBS snapshots are private and only the AWS account that created the snapshot can access it. If an EBS snapshot is shared with another AWS account or made public, the data in the snapshot can be accessed by the other account or by anyone on the internet. Ensure that public access to EBS snapshots is disabled.",
-  "Risk": "If public access to EBS snapshots is enabled, the data in the snapshot can be accessed by anyone on the internet.",
-  "RelatedUrl": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable",
+  "ResourceType": "AwsEc2Volume",
+  "ResourceGroup": "compute",
+  "Description": "**EBS snapshots** account/Region configuration for **Block Public Access** is assessed to see whether public sharing is fully blocked (`block-all-sharing`) versus only new sharing (`block-new-sharing`) or unblocked. The state indicates if any snapshot can be publicly shared.",
+  "Risk": "Without `block-all-sharing`, previously public snapshots can remain accessible, exposing raw disk data.\n\nImpacts:\n- Loss of **confidentiality** (PII, keys, configs)\n- Unauthorized cloning enabling **lateral movement**\n- Cross-account copies create **irreversible data leakage**",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable",
+    "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws ec2 enable-snapshot-block-public-access --state block-all-sharing",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SnapshotBlockPublicAccess\n    Properties:\n      State: block-all-sharing  # CRITICAL: Blocks all public sharing of EBS snapshots in this Region to pass the check\n```",
+      "Other": "1. In the AWS console, select the target Region in the top-right.\n2. Go to EC2 > Snapshots.\n3. Click Settings > Block public access for snapshots.\n4. Select Block all sharing.\n5. Click Save changes.",
+      "Terraform": "```hcl\nresource \"aws_ebs_snapshot_block_public_access\" \"<example_resource_name>\" {\n  state = \"block-all-sharing\" # CRITICAL: Blocks all public sharing of EBS snapshots in this Region\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use the following procedures to configure and monitor block public access for snapshots.",
-      "Url": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable"
+      "Text": "Set **Block Public Access** for EBS snapshots to `block-all-sharing` in all active Regions.\n\nApply **least privilege** and guardrails (SCPs) to prevent changes. Regularly inventory snapshots, remove public sharing, and use segregated accounts with strict reviews for any necessary external sharing.",
+      "Url": "https://hub.prowler.com/check/ec2_ebs_snapshot_account_block_public_access"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.metadata.json

@@ -1,28 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_ebs_snapshots_encrypted",
-  "CheckTitle": "Check if EBS snapshots are encrypted.",
+  "CheckTitle": "EBS snapshot is encrypted",
   "CheckType": [
-    "Data Protection"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "snapshot",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "medium",
-  "ResourceType": "Other",
-  "Description": "Check if EBS snapshots are encrypted.",
-  "Risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsEc2Volume",
+  "ResourceGroup": "compute",
+  "Description": "**EBS snapshots** are evaluated for **encryption at rest** with AWS KMS. The finding identifies snapshots where encryption is not enabled.",
+  "Risk": "Unencrypted snapshots expose complete disk images to anyone with snapshot access or if mis-shared. Attackers can exfiltrate data, harvest credentials, and clone volumes for offline analysis, compromising **confidentiality** and enabling **lateral movement**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default",
+    "https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/snapshot-encrypted.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws ec2 --region <REGION> enable-ebs-encryption-by-default",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#cloudformation",
-      "Other": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#aws-console",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#terraform"
+      "CLI": "aws ec2 copy-snapshot --source-region <SOURCE_REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description \"Encrypted copy of <SNAPSHOT_ID>\"",
+      "NativeIaC": "",
+      "Other": "1. In the AWS Console, go to EC2 > Snapshots and select the unencrypted snapshot\n2. Click Actions > Copy snapshot\n3. Check Encrypt this snapshot (leave the default KMS key unless a specific key is required)\n4. Click Copy snapshot and wait for the new encrypted snapshot to be available\n5. Select the original unencrypted snapshot > Actions > Delete snapshot > Delete",
+      "Terraform": "```hcl\nresource \"aws_ebs_snapshot_copy\" \"<example_resource_name>\" {\n  source_snapshot_id = \"<UNENCRYPTED_SNAPSHOT_ID>\"\n  source_region      = \"<SOURCE_REGION>\"\n  encrypted          = true  # Critical: creates an encrypted copy of the snapshot to remediate the finding\n}\n```"
     },
     "Recommendation": {
-      "Text": "Encrypt all EBS Snapshot and Enable Encryption by default. You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.",
-      "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default"
+      "Text": "Encrypt all **EBS snapshots** and enable `encryption by default` to prevent unencrypted creations and copies. Use **customer-managed KMS keys** for control and rotation, restrict snapshot sharing, and enforce **least privilege** on snapshot and key permissions as **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/ec2_ebs_snapshots_encrypted"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.metadata.json

@@ -1,28 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_ebs_volume_encryption",
-  "CheckTitle": "Ensure there are no EBS Volumes unencrypted.",
+  "CheckTitle": "EBS volume is encrypted",
   "CheckType": [
-    "Data Protection"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "volume",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "medium",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsEc2Volume",
-  "Description": "Ensure there are no EBS Volumes unencrypted.",
-  "Risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.",
+  "ResourceGroup": "compute",
+  "Description": "**EBS volumes** are assessed for **encryption at rest** using **AWS KMS**.\n\nThe finding identifies volumes whose `encrypted` state is disabled, meaning data is stored unencrypted on block storage.",
+  "Risk": "Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining **confidentiality**.\n\nAdversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting **integrity** and enabling **lateral movement**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/ebs-encrypted.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws ec2 create-snapshot --volume-id <VOLUME_ID> --description \"Snapshot for encryption\" && aws ec2 copy-snapshot --source-region <REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description \"Encrypted snapshot\" && aws ec2 create-volume --snapshot-id <ENCRYPTED_SNAPSHOT_ID> --availability-zone <AZ> --encrypted",
+      "NativeIaC": "```yaml\n# CloudFormation: Encrypted EBS volume\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::Volume\n    Properties:\n      AvailabilityZone: <example_az>\n      Size: 1\n      Encrypted: true  # CRITICAL: enables EBS encryption so the volume is created encrypted\n```",
+      "Other": "1. In the AWS Console, go to EC2 > Volumes and select the unencrypted volume\n2. Choose Actions > Create snapshot and wait for it to complete\n3. Open the snapshot, click Actions > Create volume, select the same Availability Zone, and check Encrypted, then create\n4. Stop the instance using the old volume\n5. Detach the old (unencrypted) volume\n6. Attach the new encrypted volume to the instance using the same device name\n7. Start the instance\n8. Verify the new volume shows Encrypted = Yes",
+      "Terraform": "```hcl\n# Encrypted EBS volume\nresource \"aws_ebs_volume\" \"<example_resource_name>\" {\n  availability_zone = \"<example_az>\"\n  size              = 1\n  encrypted         = true  # CRITICAL: ensures the volume is created encrypted\n}\n```"
     },
     "Recommendation": {
-      "Text": "Encrypt all EBS volumes and Enable Encryption by default You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.",
-      "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"
+      "Text": "Encrypt all EBS volumes and enable `encryption by default` for new volumes and snapshot copies.\n\nApply **least privilege** to KMS keys, restrict snapshot sharing, and enforce **defense in depth** with policies and templates that prevent creation of unencrypted storage.",
+      "Url": "https://hub.prowler.com/check/ec2_ebs_volume_encryption"
     }
   },
   "Categories": [