APRA

The Australian Prudential Regulation Authority (APRA) is an independent statutory authority that supervises institutions across banking, insurance and superannuation and promotes financial system stability in Australia.

Compliance checks for Amazon Web Services

Low

Ensure Amazon MQ brokers Log Exports feature is enabled

Low

Ensure Amazon MQ brokers are using the latest engine version

Medium

Ensure Amazon MQ brokers are not publicly accessible

Medium

Ensure Amazon MQ brokers Auto Minor Version Upgrade feature is enabled

Critical

Ensure Amazon MQ brokers are not publicly accessible

Low

Ensure Redshift clusters are not using default endpoint port

Low

Ensure Redshift clusters are using a custom master user name instead of the default master user name

Medium

Ensure Redshift clusters are using desired node types

AWS Well-Architected Framework

Medium

Ensure Redshift clusters are provisioned within a VPC

Medium

Ensure Redshift clusters Version Upgrade feature is enabled

High

Ensure Redshift clusters are not publicly accessible

High

Ensure Redshift clusters are encrypted at-rest

Medium

Ensure AWS Config is configured to include global resources

AWS Well-Architected Framework

High

AWS Config configuration changes alarm

AWS Well-Architected Framework

Medium

Ensure Database Migration Service (DMS) replication instances have Auto Minor Version Upgrade feature enabled

High

Ensure Database Migration Service (DMS) are not publicly accessible

Medium

Ensure CloudFormation stacks are sending event notifications to an SNS topic

AWS Well-Architected Framework

Medium

Ensure CloudFormation stacks Termination Protection feature is enabled

AWS Well-Architected Framework

Low

CloudTrail changes alarm

Medium

Ensure CloudTrail Log File Integrity Validation is enabled

Medium

Ensure CloudWatch Logs service is configured to monitor CloudTrail trail logs

Medium

Ensure S3 buckets associated with CloudTrail trails are configured with sever access logging

High

Ensure CloudTrail trails record global service events

High

Ensure CloudTrail trails have multi-region enabled

High

Ensure CloudTrail buckets are configured to use MFA

High

Ensure EFS file systems are encrypted using KMS CMK customer-managed keys

AWS Well-Architected Framework

High

Ensure EFS file systems are encrypted

Low

Ensure Simple Email Service (SES) identities are verified

High

Ensure Simple Email Service (SES) identities are not exposed

AWS Well-Architected Framework

Low

Ensure DocumentDB clusters have Log Exports feature enabled

Critical

Ensure access keys are rotated every 90 days or less

High

IAM Role inline policy has over permissive RDS access

High

IAM Role inline policy has over permissive KMS access

High

IAM Role inline policy has over permissive Kafka access

High

IAM Role inline policy has over permissive OpenSearch access

High

IAM Role inline policy has over permissive ElastiCache access

Critical

IAM Role inline policy is over permissive

Medium

Ensure Kinesis Data Stream encryption is enabled

AWS Well-Architected Framework

High

IAM Role inline policy has over permissive DynamoDB access

High

IAM Role inline policy has over permissive S3 access

Medium

Ensure IAM policies that allow over privileges access to data are not created

AWS Well-Architected Framework

Low

EC2 large instance create alarm

AWS Well-Architected Framework

Low

Internet Gateway (IGW) changes alarm

Medium

EC2 should have a name set

Low

Ensure EKS Private access is enabled

Critical

Ensure there is no unrestricted inbound access to TCP port 23 (Telnet)

AWS Well-Architected Framework

Critical

Ensure default security groups are not in use by VPC Endpoints

Critical

Ensure default security groups are not in use by Lambda

Critical

Ensure default security groups are not in use by ElastiCache

Critical

Ensure default security groups are not in use by OpenSearch

Critical

Ensure default security groups are not in use by ECS

Critical

Ensure default security groups are not in use by ELB

Critical

Ensure default security groups are not in use by RDS

Critical

Ensure default security groups are not in use by ALB

Critical

Ensure default security groups are not in use by MSK

Critical

Ensure there is no unrestricted inbound access to TCP port 22 (SSH)

Critical

Ensure there is no unrestricted inbound access to TCP port 3389 (RDP)

Critical

Ensure there is no unrestricted inbound access to TCP port 80 (HTTP)

Critical

Ensure there is no unrestricted inbound access to UDP port 53 (DNS)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 27017 (MongoDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 27018 (MongoDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 27019 (MongoDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 135 (RPC)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 8080 (HTTP proxy)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 8000 (HTTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 5432 (PostgreSQL)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 137 (NetBios)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 139 (NetBios)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 1433 (MSSQL)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 53 (DNS)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 20 (FTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 21 (FTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 9200 (ElasticSearch)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 1521 (OracleDB)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 3020 (SMB / CIFS)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 25 (SMTP)

AWS Well-Architected Framework

Critical

Ensure there is no unrestricted inbound access to TCP port 3306 (MySQL)

AWS Well-Architected Framework

Low

Route Table changes alarm

Low

IAM Policy changes alarm

Low

S3 Bucket changes alarm

Low

Security Group (SG) changes alarm

Critical

Ensure SageMaker Notebook Data is Encrypted

Low

VPC Peering changes alarm

Low

Transit Gateway (TGW) changes alarm

Low

NAT Gateway changes alarm

Low

VPC changes alarm

Medium

Ensure SageMaker Notebook Direct Internet Access is disabled

Medium

Ensure Amazon SageMaker Notebook Instance is in VPC

AWS Well-Architected Framework

Critical

IAM Role with inline Admin access (*:*)

AWS Well-Architected Framework

Medium

IAM user inline policy is over permissive

AWS Well-Architected Framework

Low

Ensure Internet Gateway is attached to a VPC

AWS Well-Architected Framework

Medium

Unused NAT Resources

AWS Well-Architected Framework

Medium

AMI (Amazon Machine Images) not in use (12 months)

AWS Well-Architected Framework

Critical

Ensure EC2 AMIs are not publicly accessible

Medium

AMI (Amazon Machine Images) not in use

AWS Well-Architected Framework

Medium

Ensure EMR clusters are encrypted in-transit and at-rest

AWS Well-Architected Framework

Low

Ensure EMR cluster archive log files to S3

AWS Well-Architected Framework

Low

Ensure DynamoDB Tables are encrypted with customer managed key

AWS Well-Architected Framework

Critical

Ensure IAM password policy expires passwords within 90 days or less

Medium

Ensure IAM password policy require at least one symbol

AWS Well-Architected Framework