Cloud infrastructure

Checks that a domain has a currently active TLS certificate within its validity window. Opens a real TLS connection to {domain}:443 and reads the peer certificate directly, no provider API and no stored credential involved.

domain

the domain to connect to, also used as the target. No integration is required.

Connects with certificate verification disabled at the transport layer so an invalid or expired certificate can still be retrieved and reported on, with its own trust-chain result recorded separately, rather than only ever seeing a generic handshake failure.

Checks whether MFA is enforced for IAM users and the account root user. Calls the AWS IAM credential report API, signed with the supplied access key and secret access key, and reads each user's MFA status from the report.

accessKeyId, secretAccessKey

an AWS IAM credential with permission to generate and read a credential report.

AWS only regenerates a credential report periodically. A request on an account without a recent report returns a generation-in-progress status rather than the report itself, so this check polls for a bounded time before giving up. A 401 or 403 response is reported as needs-review, never fail.

Checks whether DNSSEC is active for a Cloudflare-managed DNS zone. Calls GET https://api.cloudflare.com/client/v4/zones/{zoneId}/dnssec, authenticated with a bearer API token, and reads whether the zone's status is active.

zoneId

the Cloudflare zone identifier, also used as the target.

apiToken

a Cloudflare API token with permission to read DNS settings for the zone.

A 401 or 403 response is reported as needs-review, never fail.

Checks whether at least one active DigitalOcean cloud firewall has droplets and inbound rules attached. Calls GET https://api.digitalocean.com/v2/firewalls, paginated through every page of results, authenticated with a bearer personal access token.

apiToken

a DigitalOcean personal access token. The target is a fixed label for the account.

A firewall counts only when its status is succeeded, it has at least one droplet attached, and it has at least one inbound rule. An account with no firewalls, or firewalls with nothing attached, fails. A 401 or 403 response is reported as needs-review, never fail.