D9.AZU.MON.74

Ensure Any of the ASC Default Policy Setting is Not Set to 'Disabled'

High

New

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AWS.IAM.108

Ensure that custom IAM Role doesn't have an overly permissive scope (Contains a wildcard)

High

Modification

• Name

• Logic

• Ensure that IAM Role doesn't have an overly permissive scope (Contains a wildcard)

• IamRole where not path regexMatch /service-role/ should not have combinedPolicies contain [ relationType != 'AssumeRole' and policyDocument.Statement contain [ Effect='Allow' and Resource contain ['*'] ] ]

• Ensure that custom IAM Role doesn't have an overly permissive scope (Contains a wildcard)

• IamRole where not path regexMatch /service-role/ should not have combinedPolicies contain [ (id regexMatch /^((?!arn:aws:iam::aws:policy).)*$/ and relationType != 'AssumeRole') and policyDocument.Statement contain [ Effect='Allow' and (Resource contain ['*']) and Action contain [$ regexMatch /^(?!sts|ssm|cloudwatch|ec2messages|ssmmessages|logs|route53).*$/] ] ]

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.GCP.IAM.07

Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer

High

Modification

• Logic

• ServiceAccount should not have keys with [ (managedBy = 'User') and (validAfterTime = isEmpty() or validAfterTime after(-90, 'days')) ]

• ServiceAccount should not have keys with [ (managedBy = 'User') and (validAfterTime before(-90, 'days')) ]

• GCP CIS Foundations v. 1.3.0

• GCP LGPD regulation

• GCP NIST 800-53 Rev 5

• GCP CIS Foundations v. 1.0.0

• GCP GDPR Readiness

• GCP CIS Foundations v. 1.1.0

• GCP CIS Foundations v. 1.2.0

• GCP CloudGuard Best Practices

D9.AZU.MON.46

Ensure Diagnostic Setting captures appropriate categories

Low

Modification

• Logic

• ActivityLogMonitor should have diagnosticSettings contain [ logs contain [ category regexMatch /Write|Delete|Action/ ] ]

• ActivityLogMonitor should not have (diagnosticSettings contain [ logs contain-any [ category regexMatch /Alert|Security|Policy|Administrative/ and enabled = false ] ])

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure NIST 800-53 Rev 5

• Azure CloudGuard Best Practices

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AWS.IAM.62

Ensure that IAM Role doesn't have excessive permissions (Allowing all actions)

High

Modification

• Name

• Logic

• Ensure that Role do not have Administrator Access

• IamRole should not have combinedPolicies contain-any [ policyDocument.Statement contain-any [ Resource = '*' and Action='*' and Effect='Allow'] ]

• Ensure that IAM Role doesn't have excessive permissions (Allowing all actions)

• IamRole should not have combinedPolicies contain [ relationType != 'AssumeRole' and policyDocument.Statement contain [ Effect='Allow' and Action contain ['*'] ] ]

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11.3

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.108

Ensure that IAM Role doesn't have an overly permissive scope (Contains a wildcard)

High

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.109

Ensure that ECS Service role doesn't have excessive permissions (Contains a wildcard)

High

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.110

Ensure that ECS Service managed role doesn't have an overly permissive scope (Contains a wildcard)

High

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.LOG.15

Enable ALB Elastic Load Balancer v2 (ELBv2) access log

Low

Modification

• Name

• Enable ALB Elastic Load Balancer v2 (ELBv2) access log

• Enable ALB Elastic Load Balancer v2 (ELBv2) access log

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11.3

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.LOG.16

Ensure that your AWS CloudTrail logging bucket has MFA delete enabled

Low

Modification

• Name

• Ensure that your AWS CloudTrail logging bucket has MFA enabled

• Ensure that your AWS CloudTrail logging bucket has MFA delete enabled

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11.3

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AZU.NET.67

Ensure that Containers and its blobs are not exposed publicly

Critical

New

• Azure CloudGuard Best Practices

D9.AWS.NET.06

Ensure S3 buckets are not publicly accessible without a condition

High

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11.3

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard CheckUp

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Network Alerts for default VPC components

• AWS CloudGuard Best Practices

• AWS Dashboard System Ruleset

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS MITRE ATT&CK Framework v10

D9.AWS.NET.76

Ensure S3 buckets are not publicly accessible

High

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11.3

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard CheckUp

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Network Alerts for default VPC components

• AWS CloudGuard Best Practices

• AWS Dashboard System Ruleset

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.105

Ensure that Lambda Function is not publicly exposed via resource policy without a condition

Critical

Modification

• Logic

• Lambda should not have resourcePolicy.Statement contain [ Effect='Allow' and (Principal = '*' or Principal.AWS = '*' or Principal.Service) and not Condition ]

• Lambda should not have resourcePolicy.Statement contain [ Effect='Allow' and (Principal = '*' or Principal.AWS = '*') and not Condition ]

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.03

Ensure credentials unused for 45 days or greater are disabled (First access key)

Low

Modification

• Logic

• IamUser where firstAccessKey.isActive='true' should have firstAccessKey.lastUsedDate after(-45, 'days')

• IamUser where firstAccessKey.isActive=true and firstAccessKey.lastRotated before(-45, 'days') should not have firstAccessKey.lastUsedDate before(-45, 'days')

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11.3

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.05

Ensure credentials unused for 45 days or greater are disabled (Second access key)

Low

Modification

• Logic

• IamUser where secondAccessKey.isActive='true' should have secondAccessKey.lastUsedDate after(-45, 'days')

• IamUser where secondAccessKey.isActive=true and secondAccessKey.lastRotated before(-45, 'days') should not have secondAccessKey.lastUsedDate before(-45, 'days')

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11.3

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.DR.04

Ensure Amazon DynamoDB tables have continuous backups enabled

High

Modification

• Logic

• DynamoDbTable should not have restoreSummary isEmpty()

• DynamoDbTable should have continuousBackups.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus='ENABLED'

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11.3

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.68

Ensure that Lambda Function's environment variables 'Encryption at Rest' feature uses Customer Master Keys (CMK)

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.105

Ensure that Lambda Function is not publicly exposed via resource policy without a condition

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.CRY.20

Ensure AWS Kinesis Streams Keys are rotated

Modification

• Logic

• Kinesis where encrypted should have encryptionKey.rotationStatus=true

• Kinesis where encrypted should have getResources('KMS') contain [ rotationStatus=true and region = ~getValue('region') and ( arn=~getValue('kmsKeyId') or aliases contain [ name = ~getValue('kmsKeyId') or arn = ~getValue('kmsKeyId') ] or ~getValue('kmsKeyId') in (arn split('/')) )]

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.21

AWS Kinesis streams are encrypted with customer managed CMK

Modification

• Logic

• Kinesis should have encryptionKey.isCustomerManaged=true

• Kinesis should have getResources('KMS') contain [ isCustomerManaged=true and region = ~getValue('region') and ( arn=~getValue('kmsKeyId') or aliases contain [ name = ~getValue('kmsKeyId') or arn = ~getValue('kmsKeyId') ] or ~getValue('kmsKeyId') in (arn split('/')) )]

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard CheckUp

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.23

Ensure that your Amazon EFS file systems are encrypted using KMS CMK customer-managed keys

Modification

• Logic

• EFS should have encryptionKey.isCustomerManaged=true

• EFS should have getResources('KMS') contain [ isCustomerManaged=true and region = ~getValue('region') and ( arn=~getValue('encryptionKeyArn') or aliases contain [ name = ~getValue('encryptionKeyArn') or arn = ~getValue('encryptionKeyArn') ] or ~getValue('encryptionKeyArn') in (arn split('/')) )]

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.33

Ensures that AWS RDS databases are encrypted using Customer Managed Keys

Modification

• Logic

• RDS where isStorageEncrypted=true should have encryptionKey.isCustomerManaged=true

• RDS where isStorageEncrypted=true should have getResources('KMS') contain [ isCustomerManaged=true and region = ~getValue('region') and ( arn=~getValue('kmsKeyId') or aliases contain [ name = ~getValue('kmsKeyId') or arn = ~getValue('kmsKeyId') ] or ~getValue('kmsKeyId') in (arn split('/')) )]

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.35

Ensure SageMaker Notebook Instance Data Encryption is enabled

Modification

• Logic

• SageMakerNotebook should have kmsKey

• SageMakerNotebook should have kmsKeyId

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard CheckUp

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.36

Ensure that SageMaker Notebook Instance Data Encryption with KMS CMKs is enabled

Modification

• Logic

• SageMakerNotebook where kmsKey should have kmsKey.isCustomerManaged=true

• SageMakerNotebook should have getResources('KMS') contain [ isCustomerManaged=true and region = ~getValue('region') and ( arn=~getValue('kmsKeyId') or aliases contain [ name = ~getValue('kmsKeyId') or arn = ~getValue('kmsKeyId') ] or ~getValue('kmsKeyId') in (arn split('/')) )]

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.04

Ensure S3 Bucket Policy is set to deny HTTP requests

Modification

• Logic

• S3Bucket where policy.Statement contain-any [Effect='Allow' and (Action contain ['s3:GetObject'] or Action contain ['s3:PutObject'] or Action contain ['s3:*'] or Action contain ['*'] ) ] should have policy.Statement contain [Effect='Deny' and Condition.Bool.aws:SecureTransport='false' and (Action contain ['s3:GetObject'] or Action contain ['s3:PutObject'] or Action contain ['s3:*'] or Action contain ['*'] ) ]

• S3Bucket where policy should have policy.Statement contain [Effect='Deny' and Condition.Bool.aws:SecureTransport='false' and (Action contain ['s3:GetObject'] or Action contain ['s3:PutObject'] or Action contain ['s3:*'] or Action contain ['*'] ) ]

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.06

Ensure access keys are rotated every 90 days or less (First access key)

Modification

• Name

• Ensure first access key is rotated every 90 days or less

• Ensure access keys are rotated every 90 days or less (First access key)

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.07

Ensure access keys are rotated every 90 days or less (Second access key)

Modification

• Name

• Ensure second access key is rotated every 90 days or less

• Ensure access keys are rotated every 90 days or less (Second access key)

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.46

Ensure that Lambda Function execution role policy doesn't have an overly permissive scope (Contains a wildcard)

Modification

• Name

• Logic

• Lambda Functions with Admin Privileges are not created

• Lambda should not have executionRole.combinedPolicies contain [policyDocument.Statement contain-any [Effect = 'Allow' and (Resource ='*' ) and Action ='*']]

• Ensure that Lambda Function execution role policy doesn't have an overly permissive scope (Contains a wildcard)

• Lambda should not have executionRole.combinedPolicies contain [ relationType!='AssumeRole' and policyDocument.Statement contain [Effect='Allow' and (Resource contain [$ regexMatch /^(?!arn).*\*$/] or Resource regexMatch /^(?!arn).*\*$/) ]]

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.K8S.IAM.03

Ensure that the --authorization-mode argument is not set to AlwaysAllow (Kubelet)

Modification

• Logic

• KubernetesNode should have kubeletData.kubeletconfig.--authorization-mode unlike '%AlwaysAllow%'

• KubernetesNode should have kubeletData.kubeletconfig.authorization.mode unlike '%AlwaysAllow%'

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• OpenShift Container Platform v3

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Kubernetes Benchmark v1.4.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.34

Minimize wildcard use in Roles and ClusterRoles (RBAC)

Modification

• Logic

• KubernetesRole should not have rules contain [ (resources with [$ regexMatch /.*\*.*/]) or (apiGroups with [$ regexMatch /.*\*.*/]) or (verbs with [$ regexMatch /.*\*.*/])]

• KubernetesRole should not have rules contain [ (resources with ['%*%']) or (apiGroups with ['%*%']) or (verbs with ['%*%'])]

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• OpenShift Container Platform v3

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.35

Minimize access to create pods (RBAC)

Modification

• Logic

• KubernetesRoleBinding should not have role.rules contain [ (verbs with ['create'] and (resources with ['pod'] or resources with [$ regexMatch /.*\*.*/])) or (verbs with [$ regexMatch /.*\*.*/] and (resources with ['pod'] or resources with [$ regexMatch /.*\*.*/]))]

• KubernetesRoleBinding should not have role.rules contain [ (verbs with ['create'] and (resources with ['pod'] or resources with ['%*%'])) or (verbs with ['%*%'] and (resources with ['pod'] or resources with ['%*%']))]

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• OpenShift Container Platform v3

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.AZU.LOG.12

Ensure that logging for Azure KeyVault is 'Enabled'

Modification

• Logic

• KeyVault should have diagnosticSettings contain [ logs contain [ category='AuditEvent' and enabled=true ] ]

• KeyVault should have diagnosticSettings contain [ logs contain [ categoryGroup='audit' and enabled=true ] ]

• Azure CloudGuard CheckUp

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CIS Foundations v. 1.0.0

• Azure PCI-DSS 3.2

• Azure NIST 800-53 Rev 4

• Azure CSA CCM v.3.0.1

• Azure ISO 27001:2013

• Azure NIST CSF v1.1

• Azure CloudGuard SOC2 based on AICPA TSC 2017

• Azure HIPAA

• Azure CIS Foundations v. 1.1.0

• Azure NIST 800-171

• Azure CloudGuard Best Practices

• Azure Security Benchmark

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure New Zealand Information Security Manual (NZISM) v.3.4

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AWS.CRY.66

Ensure that EC2 instance's volumes are encrypted

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.CRY.67

Ensure that EC2 instance's custom AMI is encrypted at rest

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.55

Ensure that Lambda Function execution role policy doesn't have excessive permissions (Contains a wildcard)

Modification

• Name

• Logic

• Ensure that Lambda Functions with overly permissive policies are not created

• Lambda should not have executionRole.combinedPolicies contain [policyDocument.Statement contain-any [Effect = 'Allow' and (Resource ='*' or Resource contain[$='*'] ) and Action contain ['%*%'] or Action ='*' or Action contain [$='*']]]

• Ensure that Lambda Function execution role policy doesn't have excessive permissions (Contains a wildcard)

• Lambda should not have executionRole.combinedPolicies contain [ relationType!='AssumeRole' and policyDocument.Statement contain [Effect='Allow' and (Action contain [$ regexMatch /\*/] or Action regexMatch /\*/) ]]

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.104

Ensure that Lambda Function resource-based policy doesn't have excessive permissions (Contains a wildcard)

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.106

Ensure that EC2 instance's custom AMI is not publicly shared

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.IAM.107

Ensure that Lambda Function URL is secured with IAM authentication

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.AWS.NET.90

Ensure that EC2 instances requires the use of Instance Metadata Service Version 2 (IMDSv2)

New

• AWS Security Risk Management

• AWS CloudGuard Best Practices

D9.K8S.IAM.20

Minimize the admission of containers wishing to share the host IPC namespace (PSP)

Modification

• Logic

• List<KubernetesPodSecurityPolicy> should have items contain [not spec.hostIPC] or items contain [spec.hostIPC ='false']

• List<KubernetesPodSecurityPolicy> where items length() > 0 should have items contain [spec.hostIPC != 'true']

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.22

Minimize the admission of containers wishing to share the host network namespace (PSP)

Modification

• Logic

• List<KubernetesPodSecurityPolicy> should have items contain [not spec.hostNetwork] or items contain [spec.hostNetwork ='false']

• List<KubernetesPodSecurityPolicy> where items length() > 0 should have items contain [spec.hostNetwork != 'true']

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.24

Minimize the admission of containers wishing to share the host process ID namespace (PSP)

Modification

• Logic

• List<KubernetesPodSecurityPolicy> should have items contain [not spec.hostPID] or items contain [spec.hostPID ='false']

• List<KubernetesPodSecurityPolicy> where items length() > 0 should have items contain [spec.hostPID != 'true']

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.25

Minimize the admission of containers with allowPrivilegeEscalation (PSP)

Modification

• Logic

• List<KubernetesPodSecurityPolicy> should have items contain [not spec.allowPrivilegeEscalation] or items contain [spec.allowPrivilegeEscalation ='false']

• List<KubernetesPodSecurityPolicy> where items length() > 0 should have items contain [spec.allowPrivilegeEscalation!= 'true']

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.26

Minimize the admission of privileged containers (PSP)

Modification

• Logic

• List<KubernetesPodSecurityPolicy> should have items contain [not spec.privileged] or items contain [spec.privileged ='false']

• List<KubernetesPodSecurityPolicy> where items length() > 0 should have items contain [spec.privileged != 'true']

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.AWS.CRY.51

Ensure that AWS SNS topic is encrypted using Customer Managed Keys instead of AWS-owned CMKs

Modification

• Name

• Ensure that AWS SNS topic is encrypted using AWS managed CMKs (Customer Master Key) instead of AWS-owned CMK's

• Ensure that AWS SNS topic is encrypted using Customer Managed Keys instead of AWS-owned CMKs

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.52

Ensure that AWS SQS is encrypted using Customer Managed keys instead of AWS-owned CMKs

Modification

• Name

• Ensure that AWS SQS is encrypted using AWS managed CMKs (Customer Master Key) instead of AWS-owned CMK's

• Ensure that AWS SQS is encrypted using Customer Managed keys instead of AWS-owned CMKs

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.K8S.IAM.29

Ensure that the --anonymous-auth argument is set to false (API Server)

Modification

• Logic

• KubernetesPod where labels contain [value='kube-apiserver'] and namespace = 'kube-system' should have spec.containers with [parsedArgs contain [key like 'anonymous-auth' and value like '%false%']]

• KubernetesPod where labels contain [value='kube-apiserver'] and namespace = 'kube-system' should not have spec.containers with [parsedArgs contain [key like 'anonymous-auth' and value like '%true%']]

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.OPE.02

Ensure that the --hostname-override argument is not set (Kubelet)

Removal

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Kubernetes Benchmark v1.4.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.OPE.04

Ensure that the --cadvisor-port argument is set to 0 (Kubelet)

Removal

• CIS Kubernetes Benchmark v1.4.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• Kubernetes v.1.14 CloudGuard Best Practices

D9.AZU.NET.61

Ensure that Virtual Networks Subnets have Security Groups

Removal

• Azure CloudGuard Best Practices

• Azure HITRUST v9.5.0

D9.AWS.IAM.102

Ensure that AWS Elastic Container Registry (ECR) repositories are not exposed to everyone.

New

• AWS CloudGuard Best Practices

D9.AWS.IAM.103

Ensure that AWS Elastic Container Registry (ECR) repositories are not exposed to everyone, even with a condition.

New

• AWS CloudGuard Best Practices

D9.AWS.CRY.40

Ensure that all the expired SSL/TLS certificates are removed from ACM

Modification

• Name

• Ensure that all the expired Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates managed by AWS Certificate Manager are removed in order to adhere to Amazon Security Best Practices.

• Ensure that all the expired SSL/TLS certificates are removed from ACM

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.38

Ensure to update the Security Policy of the Network Load Balancer

Modification

• Logic

• NetworkLoadBalancer should have listeners contain [securityPolicy in('ELBSecurityPolicy-2016-08', 'ELBSecurityPolicy-TLS-1-1-2017-01', 'ELBSecurityPolicy-FS-2018-06', 'ELBSecurityPolicy-TLS-1-2-Ext-2018-06') ]

• NetworkLoadBalancer should have listeners contain [securityPolicy in('ELBSecurityPolicy-2016-08', 'ELBSecurityPolicy-FS-2018-06', 'ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06', 'ELBSecurityPolicy-TLS13-1-2-2021-06') ]

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.20

Ensure AWS Kinesis Streams Keys are rotated

Modification

• Name

• AWS Kinesis Streams Keys are rotated

• Ensure AWS Kinesis Streams Keys are rotated

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.K8S.CRY.44

Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Kubelet) (Openshift)

Modification

• Logic

• KubernetesNode should have kubeletData.kubeletconfig.tlsCipherSuites isEmpty() or kubeletData.kubeletconfig.tlsCipherSuites contain-all [ in ('TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256','TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256','TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305','TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384','TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305','TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384','TLS_RSA_WITH_AES_256_GCM_SHA384','TLS_RSA_WITH_AES_128_GCM_SHA256','TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256','TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256')]

• KubernetesNode should have kubeletData.kubeletconfig.tlsCipherSuites isEmpty() or kubeletData.kubeletconfig.tlsCipherSuites contain-all ['TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256' and 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256' and 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305' and 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' and 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305' and 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' and 'TLS_RSA_WITH_AES_256_GCM_SHA384' and 'TLS_RSA_WITH_AES_128_GCM_SHA256']

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• OpenShift Container Platform v3

D9.AWS.CRY.55

ACM has a PENDING_VALIDATION Certificate

Modification

• Name

• ACM Has a PENDING_VALIDATION Certificates

• ACM has a PENDING_VALIDATION Certificate

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.25.PCI

Ensure ElastiCache for Memcached is not used in AWS PCI DSS environments

Modification

• Name

• Ensure ElastiCache for Memcached is not in use in AWS PCI DSS environments

• Ensure ElastiCache for Memcached is not used in AWS PCI DSS environments

• AWS PCI-DSS 3.2

• AWS CloudGuard Well Architected Framework

D9.AZU.MON.50

Ensure that SQL Server Auditing Retention is greater than 90 days

Removal

• Azure CIS Foundations v. 1.4.0

• Azure CloudGuard Best Practices

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.51

Ensure SQL Server Threat Detection is Enabled and Retention Logs are greater than 90 days

Removal

• Azure CIS Foundations v. 1.4.0

• Azure CloudGuard Best Practices

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AWS.IAM.61

Ensure that Trusted Policy Roles which can be assumed by external entities include a Condition String

Removal

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.OPE.02

Container metadata

Removal

• AWS NIST 800-53 Rev 5

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

D9.AWS.CRY.21

AWS Kinesis streams are encrypted with customer managed CMK

Modification

• Name

• AWS Kinesis streams are encrypted with KMS customer master keys

• AWS Kinesis streams are encrypted with customer managed CMK

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard CheckUp

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.24

AWS Kinesis data streams have server side encryption (SSE) enabled

Modification

• Name

• AWS Kinesis Server data at rest has server side encryption (SSE)

• AWS Kinesis data streams have server side encryption (SSE) enabled

• AWS HIPAA

• AWS LGPD regulation

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.65

Ensure that S3 Bucket is encrypted at rest

New

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.03

Ensure credentials unused for 45 days or greater are disabled (First access key)

Modification

• Name

• Ensure credentials (with first activated accessKey) unused for 45 days or greater are disabled

• Ensure credentials unused for 45 days or greater are disabled (First access key)

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.04

Ensure credentials unused for 45 days or greater are disabled (Console password)

Modification

• Name

• Credentials (with password enabled) unused for 45 days or more should be disabled

• Ensure credentials unused for 45 days or greater are disabled (Console password)

• AWS HIPAA

• None

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.05

Ensure credentials unused for 45 days or greater are disabled (Second access key)

Modification

• Name

• Ensure credentials (with second activated accessKey) unused for 45 days or greater are disabled

• Ensure credentials unused for 45 days or greater are disabled (Second access key)

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CIS Foundations v. 1.1.0

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS CIS Foundations v. 1.0.0

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.2.0

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AZU.MON.21

Ensure that SQL server 'Auditing' is set to 'On'

Modification

• Name

• Ensure that 'Auditing' is set to 'On'

• Ensure that SQL server 'Auditing' is set to 'On'

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure ISO 27001:2013

• Azure CIS Foundations v. 1.1.0

• Azure CloudGuard Best Practices

• Azure Security Benchmark

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.25

Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server

Modification

• Logic

• SQLServer should have threatDetection.emailToAccountAdmins=true

• SQLServer should have vulnerabilityAssessments contain [ recurringScansProperties.emailSubscriptionAdmins=true ]

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure ISO 27001:2013

• Azure CIS Foundations v. 1.1.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure New Zealand Information Security Manual (NZISM) v.3.4

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.48

Ensure that SQL Database Auditing Retention is greater than 90 days

Modification

• Logic

• SQLDB should have auditing.state='Enabled' and (auditing.retentionDays=0 or auditing.retentionDays>=90)

• SQLDB should have auditing.retentionDays>90

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AWS.NET.72

Ensure that S3 Buckets are configured with Block public access (bucket/account settings)

Modification

• Name

• Logic

• Ensure that S3 Buckets are configured with Block public access (bucket settings)

• S3Bucket should have accessPublicBlock.blockPublicAcls=true and accessPublicBlock.ignorePublicAcls=true and accessPublicBlock.blockPublicPolicy=true and accessPublicBlock.restrictPublicBuckets=true

• Ensure that S3 Buckets are configured with Block public access (bucket/account settings)

• S3Bucket should have (accessPublicBlock.blockPublicAcls=true or accountAccessPublicBlock.blockPublicAcls=true) and (accessPublicBlock.ignorePublicAcls=true or accountAccessPublicBlock.ignorePublicAcls=true) and (accessPublicBlock.blockPublicPolicy=true or accountAccessPublicBlock.blockPublicPolicy=true) and (accessPublicBlock.restrictPublicBuckets=true or accountAccessPublicBlock.restrictPublicBuckets=true)

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS CIS Foundations v. 1.3.0

• AWS HITRUST

• AWS ITSG-33

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.30

Ensure that AWS DynamoDB is encrypted using customer-managed CMK

Modification

• Name

• Ensure that AWS DynamoDB is encrypted using AWS managed CMKs (Customer Master Key) instead of AWS-owned CMK's

• Ensure that AWS DynamoDB is encrypted using customer-managed CMK

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard CheckUp

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.66

Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

Modification

• Logic

• List<IamSAMLProvider> should have items length() > 0

• List<IamSAMLProvider> should have items with [id] length() > 0]

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.3.0

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.NET.73

Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

Modification

• Logic

• NACL should not have inbound with [ source='0.0.0.0/0' and action='ALLOW' and ( ( destinationPort<=23 and destinationPortTo>=20 ) or ( destinationPort<=115 and destinationPortTo>=115 ) or ( destinationPort<=139 and destinationPortTo>=137 ) or ( destinationPort<=2049 and destinationPortTo>=2049 ) or ( destinationPort<=3389 and destinationPortTo>=3389 ) ) ]

• NACL should not have inbound with [ source='0.0.0.0/0' and action='ALLOW' and ( ( destinationPort<=22 and destinationPortTo>=22 ) or ( destinationPort<=3389 and destinationPortTo>=3389 ) ) ]

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CIS Foundations v. 1.3.0

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.OPE.10

Identify unused AWS VPCs

Modification

• Name

• Identifies unused AWS VPCs

• Identify unused AWS VPCs

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AZU.NET.59

Ensure Flow-Logs are Enabled on NSG

Modification

• Logic

• NsgFlowLog should have properties.enabled=true

• NetworkSecurityGroup should have nsgFlowLog.properties.enabled=true

• Azure CloudGuard Best Practices

• Azure HITRUST v9.5.0

D9.AWS.NET.58

Ensure that AWS S3 Bucket block public ACLs is enabled at the account level or at the Bucket level

Removal

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.CRY.08

SSL/TLS certificates expire in one week

Modification

• Severity

• High

• Low

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.10

ELB secured listener certificate expires in one week

Modification

• Severity

• High

• Low

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.12

ALB secured listener certificate expires in one week

Modification

• Severity

• High

• Low

• AWS HIPAA

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.29

Ensure that S3 bucket ACLs don't allow 'READ' access for anonymous / AWS authenticated users

Modification

• Name

• Logic

• S3 bucket should not be world-listable

• S3Bucket should not have acl.grants contain [uri = 'http://acs.amazonaws.com/groups/global/AllUsers' and (premission = 'FULL_CONTROL' or premission = 'READ')]

• Ensure that S3 bucket ACLs don't allow 'READ' access for anonymous / AWS authenticated users

• S3Bucket should not have acl.grants contain [ (uri = 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' or uri = 'http://acs.amazonaws.com/groups/global/AllUsers') and premission = 'READ']

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.31

Ensure that S3 bucket ACLs don't allow 'WRITE' access for anonymous / AWS authenticated users

Modification

• Name

• Logic

• S3 bucket should not be world-writable

• S3Bucket should not have acl.grants contain [uri = 'http://acs.amazonaws.com/groups/global/AllUsers' and (premission = 'FULL_CONTROL' or premission = 'WRITE')]

• Ensure that S3 bucket ACLs don't allow 'WRITE' access for anonymous / AWS authenticated users

• S3Bucket should not have acl.grants contain [ (uri = 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' or uri = 'http://acs.amazonaws.com/groups/global/AllUsers') and premission = 'WRITE']

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.33

Ensure that S3 bucket ACLs don't allow 'WRITE_ACP' access for anonymous / AWS authenticated users

Modification

• Name

• Logic

• S3 bucket should not have world-writable permissions

• S3Bucket should not have acl.grants contain [uri = 'http://acs.amazonaws.com/groups/global/AllUsers' and (premission = 'FULL_CONTROL' or premission = 'WRITE_ACP')]

• Ensure that S3 bucket ACLs don't allow 'WRITE_ACP' access for anonymous / AWS authenticated users

• S3Bucket should not have acl.grants contain [ (uri = 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' or uri = 'http://acs.amazonaws.com/groups/global/AllUsers') and premission = 'WRITE_ACP']

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.35

Ensure that S3 bucket ACLs don't allow 'READ_ACP' access for anonymous / AWS authenticated users

Modification

• Name

• Logic

• S3 bucket should not have world-readable permissions

• S3Bucket should not have acl.grants contain [uri = 'http://acs.amazonaws.com/groups/global/AllUsers' and (premission = 'FULL_CONTROL' or premission = 'READ_ACP')]

• Ensure that S3 bucket ACLs don't allow 'READ_ACP' access for anonymous / AWS authenticated users

• S3Bucket should not have acl.grants contain [ (uri = 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' or uri = 'http://acs.amazonaws.com/groups/global/AllUsers') and premission = 'READ_ACP']

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.40

Ensure that S3 Bucket policy doesn't allow actions from all principals without a condition

Modification

• Name

• Logic

• S3 bucket should not allow all actions from all principals without a condition

• S3Bucket should not have policy.Statement with [Effect='Allow' and (Principal='*' or Principal.AWS='*') and Condition isEmpty() and (Action contain [$ = '*'] or Action = '*' ) ]

• Ensure that S3 Bucket policy doesn't allow actions from all principals without a condition

• S3Bucket should not have policy.Statement with [Effect='Allow' and (Principal='*' or Principal.AWS='*') and Condition isEmpty()]

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.96

Ensure that S3 Bucket policy doesn't allow actions from all principals (Condition exists)

Modification

• Name

• Logic

• S3 bucket should not allow all actions from all principals

• S3Bucket should not have policy.Statement with [Effect='Allow' and (Principal='*' or Principal.AWS='*') and Condition and (Action contain [$ = '*'] or Action = '*' ) ]

• Ensure that S3 Bucket policy doesn't allow actions from all principals (Condition exists)

• S3Bucket should not have policy.Statement with [Effect='Allow' and (Principal='*' or Principal.AWS='*') and Condition]

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.100

Ensure that S3 bucket ACLs don't allow 'FULL_CONTROL' access for anonymous / AWS authenticated users

New

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.101

Ensure that S3 Bucket policy doesn't have excessive permissions (Allowing all actions)

New

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AZU.CRY.15

Ensure the Key Vault is Recoverable

Modification

• Name

• Logic

• Ensure the key vault is recoverable - enable 'Soft Delete' setting for a Key Vault

• KeyVault should have enableSoftDelete=true

• Ensure the Key Vault is Recoverable

• KeyVault should have enableSoftDelete=true and enablePurgeProtection=true

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CIS Foundations v. 1.1.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AZU.CRY.39

Ensure That Storage Account Access Keys are Periodically Regenerated

Modification

• Logic

• StorageAccount should have keysRegeneratedInThePast90Days=true

• StorageAccount where allowSharedKeyAccess=true should have keysRegeneratedInThePast90Days=true

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.22

Ensure that SQL Server 'Auditing' Retention is 'greater than 90 days'

Modification

• Name

• Ensure that 'Auditing' Retention is 'greater than 90 days'

• Ensure that SQL Server 'Auditing' Retention is 'greater than 90 days'

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure ISO 27001:2013

• Azure CIS Foundations v. 1.1.0

• Azure CloudGuard Best Practices

• Azure Security Benchmark

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure HITRUST v9.5.0

• Azure ITSG-33

• Azure CIS Foundations v. 1.3.1

D9.AWS.CRY.54

ACM has soon to be expired certificates

Modification

• Name

• ACM has a soon to be expired certificates

• ACM has soon to be expired certificates

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Best Practices

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.53

Ensure AWS IAM policies do not grant 'assume role' permission across all services

Modification

• Severity

• High

• Low

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

D9.AWS.IAM.28

S3 bucket should not be world-listable from anonymous users

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.30

S3 bucket should not be world-writable from anonymous users

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.32

S3 bucket should not have writable permissions from anonymous users

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.34

S3 bucket should not have world-readable permissions from anonymous users

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.36

S3 bucket should not allow delete actions from all principals without a condition

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.37

S3 bucket should not allow get actions from all principals without a condition

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.38

S3 bucket should not allow list actions from all principals without a condition

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.41

S3 bucket should not allow put or restore actions from all principals without a condition

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.92

S3 bucket should not allow delete actions from all principals

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.93

S3 bucket should not allow get actions from all principals with a condition

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.94

S3 bucket should not allow list actions from all principals

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.AWS.IAM.95

S3 bucket should not allow put or restore actions from all principals

Removal

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS PCI-DSS 3.2

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.K8S.IAM.33

Minimize access to secrets (RBAC)

Modification

• Logic

• KubernetesRole should not have rules with [ (resources with ['secret']) or (resources with [$ regexMatch /.*\*.*/])]

• KubernetesRole should not have rules with [ (resources with ['secret']) or (resources contain ['%*%'])]

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• OpenShift Container Platform v3

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.IAM.36

Ensure that default service accounts are not actively used. (RBAC)

Modification

• Logic

• KubernetesRoleBinding should not have role.name='default' and role.kind='role'

• KubernetesRoleBinding should not have subjects contain-any [ name='default' and kind='ServiceAccount' ]

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• OpenShift Container Platform v3

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

• CIS Kubernetes Benchmark v1.23

D9.K8S.OPE.06

Apply Security Context to Your Pods and Containers

Modification

• Name

• Logic

• Apply Security Context to Your Pods and Containers - SELinux

• KubernetesPod should have spec.containers contain-all [ securityContext.seLinuxOptions ] and (spec.initContainers isEmpty() or spec.initContainers contain-all [ securityContext.seLinuxOptions ])

• Apply Security Context to Your Pods and Containers

• KubernetesPod should have spec.containers contain-all [ securityContext ] and (spec.initContainers isEmpty() or spec.initContainers contain-all [ securityContext ])

• CIS OpenShift Container Platform v4 Benchmark v1.1.0

• CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0

• OpenShift Container Platform v3

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0

• CIS Kubernetes Benchmark v1.4.0

• Kubernetes v.1.13 CloudGuard Best Practices

• Kubernetes NIST.SP.800-190

• CIS Kubernetes Benchmark v1.5.1

• CIS Kubernetes Benchmark v1.6.1

• CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1

• Kubernetes v.1.14 CloudGuard Best Practices

• CIS Kubernetes Benchmark v1.20

D9.AZU.MON.72

Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected

Modification

• Severity

• Medium

• High

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.73

Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is selected

Modification

• Severity

• Medium

• High

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AWS.IAM.43

Ensure MFA Delete is enable on S3 buckets

Modification

• Severity

• High

• Low

• AWS HIPAA

• AWS LGPD regulation

• AWS Security Risk Management

• AWS CloudGuard S3 Bucket Security

• AWS NIST 800-53 Rev 5

• AWS CIS Foundations v. 1.5.0

• AWS MITRE ATT&CK Framework v11

• AWS NIST 800-53 Rev 4

• AWS GDPR Readiness

• AWS PCI-DSS 3.2

• AWS CSA CCM v.3.0.1

• AWS ISO 27001:2013

• AWS NIST CSF v1.1

• AWS CloudGuard SOC2 based on AICPA TSC 2017

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA Framework

• AWS MAS TRM Framework

• AWS NIST 800-171

• AWS HITRUST

• AWS CIS Foundations v. 1.4.0

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.GCP.NET.34

Ensure that no VMInstace allows incoming traffic from 0.0.0.0/0 to a known TCP port.

New

• GCP CloudGuard CheckUp

• GCP Security Risk Management

• GCP LGPD regulation

• GCP PCI-DSS 3.2

• GCP NIST 800-53 Rev 4

• GCP ISO 27001:2013

• GCP NIST CSF v1.1

• GCP CloudGuard SOC2 based on AICPA TSC 2017

• GCP CloudGuard Network Security

• GCP GDPR Readiness

• GCP CloudGuard Best Practices

• GCP Risk Management

D9.GCP.NET.35

Ensure that no VMInstace allows incoming traffic from 0.0.0.0/0 to a known UDP port.

New

• GCP CloudGuard CheckUp

• GCP Security Risk Management

• GCP LGPD regulation

• GCP PCI-DSS 3.2

• GCP NIST 800-53 Rev 4

• GCP ISO 27001:2013

• GCP NIST CSF v1.1

• GCP CloudGuard SOC2 based on AICPA TSC 2017

• GCP CloudGuard Network Security

• GCP GDPR Readiness

• GCP CloudGuard Best Practices

• GCP Risk Management

D9.GCP.NET.36

Ensure that no VMInstace allows incoming traffic from 0.0.0.0/0 to a known TCP DB port.

New

• GCP CloudGuard CheckUp

• GCP Security Risk Management

• GCP LGPD regulation

• GCP PCI-DSS 3.2

• GCP NIST 800-53 Rev 4

• GCP ISO 27001:2013

• GCP NIST CSF v1.1

• GCP CloudGuard SOC2 based on AICPA TSC 2017

• GCP CloudGuard Network Security

• GCP GDPR Readiness

• GCP CloudGuard Best Practices

• GCP Risk Management

D9.GCP.NET.37

Ensure that no VMInstace allows incoming traffic from 0.0.0.0/0 to a known UDP DB port.

New

• GCP CloudGuard CheckUp

• GCP Security Risk Management

• GCP LGPD regulation

• GCP PCI-DSS 3.2

• GCP NIST 800-53 Rev 4

• GCP ISO 27001:2013

• GCP NIST CSF v1.1

• GCP CloudGuard SOC2 based on AICPA TSC 2017

• GCP CloudGuard Network Security

• GCP GDPR Readiness

• GCP CloudGuard Best Practices

• GCP Risk Management

D9.AZU.CRY.48

Ensure 'Allow access to Azure services' for PostgreSQL Flexible Server is disabled

New

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.70

Ensure that Microsoft Defender for Container Registries is set to 'On'

New

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.71

Ensure that Microsoft Defender for Key Vault is set to 'On'

New

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.72

Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected

New

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AZU.MON.73

Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is selected

New

• Azure CIS Foundations v. 1.4.0

• Azure CIS Foundations v. 1.5.0

• Azure CloudGuard Best Practices

• Azure CIS Foundations v. 1.2.0

• Azure CIS Foundations v. 1.3.0

• Azure CIS Foundations v. 1.3.1

D9.AWS.LOG.16

Ensure that your AWS CloudTrail logging bucket has MFA enabled

Modification

• Severity

• High

• Low

• AWS Security Risk Management

• AWS NIST 800-53 Rev 5

• AWS MITRE ATT&CK Framework v11

• AWS CloudGuard Well Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM Framework

• AWS HITRUST

• AWS ITSG-33

• AWS MITRE ATT&CK Framework v10

• AWS Risk Management

D9.GCP.NET.32

Ensure that no VMInstance allows incoming traffic from '0.0.0.0/0' to all protocols and ports.

New

• GCP CloudGuard Best Practices

D9.GCP.NET.33

Ensure that no VMInstance allows incoming traffic from 0.0.0.0/0 to the ICMP port.

New

• GCP CloudGuard Best Practices