Detect, troubleshoot & optimize AWS environments in real-time ->

APRA

The Australian Prudential Regulation Authority (APRA) is an independent statutory authority that supervises institutions across banking, insurance and superannuation and promotes financial system stability in Australia.

Compliance checks for Amazon Web Services

High

Ensure EFS file systems are encrypted using KMS CMK customer-managed keys

AWS Well-Architected Framework

High

Ensure EFS file systems are encrypted

Low

Ensure Simple Email Service (SES) identities are verified

High

Ensure Simple Email Service (SES) identities are not exposed

AWS Well-Architected Framework

Low

Ensure DocumentDB clusters have Log Exports feature enabled

Critical

Ensure access keys are rotated every 90 days or less

High

IAM Role inline policy has over permissive RDS access

High

IAM Role inline policy has over permissive KMS access

High

IAM Role inline policy has over permissive Kafka access

High

IAM Role inline policy has over permissive OpenSearch access

High

IAM Role inline policy has over permissive ElastiCache access

Critical

IAM Role inline policy is over permissive

Medium

Ensure Kinesis Data Stream encryption is enabled

AWS Well-Architected Framework

High

IAM Role inline policy has over permissive DynamoDB access

High

IAM Role inline policy has over permissive S3 access

Medium

Ensure IAM policies that allow over privileges access to data are not created

AWS Well-Architected Framework

Low

EC2 large instance create alarm

AWS Well-Architected Framework

Low

Internet Gateway (IGW) changes alarm

Medium

EC2 should have a name set

Low

Ensure EKS Private access is enabled

Critical

Ensure there is no unrestricted inbound access to TCP port 23 (Telnet)

AWS Well-Architected Framework

Critical

Ensure default security groups are not in use by VPC Endpoints

Critical

Ensure default security groups are not in use by Lambda

Critical

Ensure default security groups are not in use by ElastiCache

Critical

Ensure default security groups are not in use by OpenSearch

Critical

Ensure default security groups are not in use by ECS

Critical

Ensure default security groups are not in use by ELB

Critical

Ensure default security groups are not in use by RDS

Critical

Ensure default security groups are not in use by ALB

Critical

Ensure default security groups are not in use by MSK

Critical

Ensure there is no unrestricted inbound access to TCP port 22 (SSH)

Critical

Ensure there is no unrestricted inbound access to TCP port 3389 (RDP)

Critical

Ensure there is no unrestricted inbound access to TCP port 80 (HTTP)

Critical

Ensure there is no unrestricted inbound access to UDP port 53 (DNS)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 27017 (MongoDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 27018 (MongoDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 27019 (MongoDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 135 (RPC)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 8080 (HTTP proxy)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 8000 (HTTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 5432 (PostgreSQL)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 137 (NetBios)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 139 (NetBios)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 1433 (MSSQL)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 53 (DNS)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 20 (FTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 21 (FTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 9200 (ElasticSearch)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 1521 (OracleDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 3020 (SMB / CIFS)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 25 (SMTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 3306 (MySQL)

AWS Well-Architected Framework

Low

Route Table changes alarm

Low

IAM Policy changes alarm

Low

S3 Bucket changes alarm

Low

Security Group (SG) changes alarm

Critical

Ensure SageMaker Notebook Data is Encrypted

Low

VPC Peering changes alarm

Low

Transit Gateway (TGW) changes alarm

Low

NAT Gateway changes alarm

Low

VPC changes alarm

Medium

Ensure SageMaker Notebook Direct Internet Access is disabled

Medium

Ensure Amazon SageMaker Notebook Instance is in VPC

AWS Well-Architected Framework

Critical

IAM Role with inline Admin access (*:*)

AWS Well-Architected Framework

Medium

IAM user inline policy is over permissive

AWS Well-Architected Framework

Low

Ensure Internet Gateway is attached to a VPC

AWS Well-Architected Framework

Medium

Unused NAT Resources

AWS Well-Architected Framework

Medium

AMI (Amazon Machine Images) not in use (12 months)

AWS Well-Architected Framework

Critical

Ensure EC2 AMIs are not publicly accessible

Medium

AMI (Amazon Machine Images) not in use

AWS Well-Architected Framework

Medium

Ensure EMR clusters are encrypted in-transit and at-rest

AWS Well-Architected Framework

Low

Ensure EMR cluster archive log files to S3

AWS Well-Architected Framework

Low

Ensure DynamoDB Tables are encrypted with customer managed key

AWS Well-Architected Framework

Critical

Ensure IAM password policy expires passwords within 90 days or less

Medium

Ensure IAM password policy require at least one symbol

AWS Well-Architected Framework

Medium

Ensure IAM password policy requires at least one uppercase letter

AWS Well-Architected Framework

Medium

Ensure IAM password policy require at least one number

AWS Well-Architected Framework

Medium

Ensure IAM password policy require at least one lowercase letter

AWS Well-Architected Framework

Critical

IAM Role with Admin access (*:*)

AWS Well-Architected Framework

Medium

Ensure IAM Role has no inline policy

AWS Well-Architected Framework

Critical

Ensure IAM policies that allow full "*:*" administrative privileges are not created

AWS Well-Architected Framework

Low

Ensure RDS is not using the default port 1433

AWS Well-Architected Framework

Medium

Ensure security groups do not have ingress open to any (0.0.0.0/0)

Medium

Ensure security groups do not have all ports open

AWS Foundational Security Best Practices Controls

AWS Well-Architected Framework

Medium

Ensure EC2 instance uses an IAM profile

Medium

Ensure S3 object versioning is enabled

AWS Well-Architected Framework

Medium

Ensure VPC flow logging is enabled in all VPCs

Medium

Ensure IAM Group has no inline policy

Medium

Ensure default security groups do not allow unrestricted traffic

Critical

Ensure ElastiCache Redis clusters are encrypted in-transit

Critical

Ensure ElastiCache Redis clusters are encrypted at-rest

Medium

Ensure that Cloudfront distribution is not using insecure SSL protocols

Medium

VPC endpoint is publicly accessible

AWS Well-Architected Framework

Medium

Ensure IAM User has no inline policy

AWS Well-Architected Framework

Medium

Ensure OpenSearch domains are in a VPC

AWS Foundational Security Best Practices Controls

AWS Well-Architected Framework

Medium

Ensure EBS volumes are encrypted

Critical

Ensure the S3 bucket for CloudTrail logs is not publicly accessible

Medium

Ensure EKS Public access is disabled

Medium

Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

Medium

Gateway VPC endpoint is not in use

AWS Well-Architected Framework