Cloud resource checks

Checks whether every S3 bucket in an AWS account has default server-side encryption enabled. Calls ListBuckets to enumerate every bucket, paginated, then GetBucketEncryption per bucket, checking for at least one encryption rule.

accessKeyId, secretAccessKey

an AWS IAM credential with s3:ListAllMyBuckets and s3:GetEncryptionConfiguration.

region (optional)

defaults to us-east-1.

A bucket with no encryption configuration returns a real AWS error (ServerSideEncryptionConfigurationNotFoundError), treated as a confirmed fail for that bucket, not needs-review. An account with zero S3 buckets passes, since there is nothing to violate. A 401 or 403 response while listing buckets is reported as needs-review for the whole check. A permission error on one bucket's own encryption read marks only that bucket unverifiable, without changing the result for every other bucket.

Checks whether every S3 bucket in an AWS account has S3 Block Public Access fully enabled. Calls ListBuckets, then GetPublicAccessBlock per bucket, checking that all four settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) are true.

accessKeyId, secretAccessKey

an AWS IAM credential with s3:ListAllMyBuckets and s3:GetBucketPublicAccessBlock.

region (optional)

defaults to us-east-1.

A bucket with no Block Public Access configuration at all returns a real AWS error (NoSuchPublicAccessBlockConfiguration), treated as a confirmed fail for that bucket. An account-level Block Public Access setting is not evaluated, only the per-bucket configuration. An account with zero S3 buckets passes. A permission error on one bucket marks only that bucket unverifiable.

Checks whether every RDS database instance in an AWS account and region has storage encryption enabled. Calls DescribeDBInstances, paginated, and reads each instance's StorageEncrypted field directly.

accessKeyId, secretAccessKey

an AWS IAM credential with rds:DescribeDBInstances.

region (optional)

defaults to us-east-1. RDS is regional, so this evaluates one region at a time.

Zero RDS instances in the region passes, since there is nothing to violate. A 401 or 403 response is reported as needs-review, never fail.

Checks whether every RDS database instance in an AWS account and region has automated backups enabled with a real retention period. Calls the same DescribeDBInstances call as aws-rds-encryption-enforced, reading each instance's BackupRetentionPeriod field.

accessKeyId, secretAccessKey

an AWS IAM credential with rds:DescribeDBInstances.

region (optional)

defaults to us-east-1.

A retention period of 0 is how RDS itself represents automated backups being disabled, and is a confirmed fail. Zero RDS instances in the region passes.

Checks whether every customer-managed KMS key in an AWS account and region has automatic key rotation enabled. Calls ListKeys, paginated, then DescribeKey per key to read whether it is customer-managed or AWS-managed, then GetKeyRotationStatus for each customer-managed key.

accessKeyId, secretAccessKey

an AWS IAM credential with kms:ListKeys, kms:DescribeKey, and kms:GetKeyRotationStatus.

region (optional)

defaults to us-east-1.

AWS-managed keys are skipped entirely, since a customer's credentials cannot configure their rotation. A key that does not support automatic rotation (an asymmetric or HMAC key) or is pending deletion is marked unverifiable for that key rather than a fail. An account with zero customer-managed keys passes.

Checks that no EC2 security group in an AWS account and region allows unrestricted inbound access on a sensitive port. Calls DescribeSecurityGroups, paginated, and inspects each group's inbound rules for a source of 0.0.0.0/0 or ::/0 covering SSH (22), RDP (3389), MySQL (3306), PostgreSQL (5432), SQL Server (1433), or MongoDB (27017).

accessKeyId, secretAccessKey

an AWS IAM credential with ec2:DescribeSecurityGroups.

region (optional)

defaults to us-east-1.

Only inbound rules are evaluated, not outbound. A security group is evaluated whether or not it is currently attached to a running resource. Zero security groups returned passes, though in practice AWS creates a default security group for every VPC automatically, so this is an unusual result.

Checks that at least one CloudTrail trail exists, is multi-region, and is actively logging. Calls DescribeTrails (which returns every trail visible from the region, including trails whose home region is elsewhere), then GetTrailStatus per trail.

accessKeyId, secretAccessKey

an AWS IAM credential with cloudtrail:DescribeTrails and cloudtrail:GetTrailStatus.

region (optional)

defaults to us-east-1.

Unlike this category's other AWS checks, zero trails is a confirmed fail, not a pass. At least one trail must exist, be multi-region, and be logging. A trail that exists but is single-region or not logging does not satisfy the control on its own.

Checks whether every Storage Account in an Azure subscription enforces HTTPS-only traffic and disallows anonymous public blob access. Mints an Azure Resource Manager access token via an OAuth 2.0 client-credentials grant, then calls GET /subscriptions/{subscriptionId}/providers/Microsoft.Storage/storageAccounts, reading each account's supportsHttpsTrafficOnly and allowBlobPublicAccess properties.

tenantId, subscriptionId

the Azure AD tenant and subscription to check.

clientId, clientSecret

an app registration granted the built-in Reader role at subscription scope. This is a separate credential from the access token the identity check azure-ad-mfa-enforced uses, since Azure Resource Manager and Microsoft Graph require differently-scoped tokens.

Network-level public access (publicNetworkAccess) is recorded but does not affect the verdict, since a subscription can secure that access another way this check does not read. A subscription with zero Storage Accounts, or an unreachable API, is reported as needs-review rather than a pass, since a genuinely empty result cannot be told apart from a scoping problem with the app registration's Reader role.

Checks whether every Azure SQL logical server enforces TLS 1.2 or higher and has server-level auditing enabled. Calls GET /subscriptions/{subscriptionId}/providers/Microsoft.Sql/serversfor each server's minimalTlsVersion, then GET .../servers/{serverName}/auditingSettings/default for its auditing state.

tenantId, subscriptionId

the Azure AD tenant and subscription to check.

clientId, clientSecret

an app registration granted the built-in Reader role at subscription scope.

A minimum TLS version other than 1.2 or 1.3 is a confirmed fail on its own. If the separate auditing-settings call fails for one server, that server's auditing state is recorded as undetermined rather than assumed, which holds the overall result to needs-review unless a real violation is found elsewhere. A subscription with zero Azure SQL servers, or an unreachable API, is reported as needs-review.

Checks whether every Key Vault in an Azure subscription has soft-delete enabled, purge-protection enabled, and RBAC authorization enabled instead of legacy access policies. Calls GET /subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/vaults, reading each vault's enableSoftDelete, enablePurgeProtection, and enableRbacAuthorization properties.

tenantId, subscriptionId

the Azure AD tenant and subscription to check.

clientId, clientSecret

an app registration granted the built-in Reader role at subscription scope.

Soft-delete is Azure's own default when the field is absent, so a vault only fails on soft-delete when it is explicitly turned off. A subscription with zero Key Vaults, or an unreachable API, is reported as needs-review rather than a pass.

Checks that no Network Security Group in an Azure subscription has a custom inbound rule allowing a source of *, 0.0.0.0/0, or Internet on a sensitive port. Calls GET /subscriptions/{subscriptionId}/providers/Microsoft.Network/networkSecurityGroupsand inspects each group's custom rules for SSH (22), RDP (3389), or a common database port (1433, 3306, 5432, 6379, 27017, 1521).

tenantId, subscriptionId

the Azure AD tenant and subscription to check.

clientId, clientSecret

an app registration granted the built-in Reader role at subscription scope.

Only customer-defined rules are evaluated, not Azure's own fixed default rules, which already deny all inbound traffic and cannot be the source of an opening. A subscription with zero Network Security Groups, or an unreachable API, is reported as needs-review rather than a pass.

Checks whether every Cloud Storage bucket in a GCP project has uniform bucket-level access enabled and is not publicly accessible. Mints a Cloud Platform-scoped access token from a service account credential, then calls the Cloud Storage JSON API to list every bucket and read each one's IAM policy, looking for a role granted to the allUsers or allAuthenticatedUsers special principal.

serviceAccountEmail, serviceAccountPrivateKey

a GCP service account key's client_email and private_key, used to sign a JWT and exchange it for a token scoped to cloud-platform.read-only, separate from the access token the identity check gcp-2sv-enforced uses.

projectId

the GCP project to check, and the service account's own project.

A bucket whose IAM policy cannot be read is recorded as unverifiable rather than assumed private, and only pulls the result to needs-review when no other bucket has a confirmed violation. Zero buckets returned for the project is reported as needs-review rather than a pass.

Checks that no VPC firewall rule in a GCP project allows unrestricted ingress from 0.0.0.0/0 on a sensitive port. Calls the Compute Engine API to list every firewall rule, evaluating enabled ingress rules whose source ranges include 0.0.0.0/0 for allowed ports covering SSH (22), RDP (3389), or a common database port (1433, 3306, 5432, 6379, 27017).

serviceAccountEmail, serviceAccountPrivateKey

a GCP service account key's client_email and private_key.

projectId

the GCP project to check.

A rule with no ports listed on a TCP or UDP entry is treated as allowing every port, matching Compute Engine's own documented firewall behavior. Disabled rules and egress rules are not evaluated. Zero firewall rules returned for the project is reported as needs-review rather than a pass, since some projects keep their firewall rules on a separate Shared VPC host project.

Checks whether every Cloud SQL instance in a GCP project requires SSL/TLS connections and has automated backups enabled. Calls the Cloud SQL Admin API to list every instance, reading each one's SSL mode and backup configuration.

serviceAccountEmail, serviceAccountPrivateKey

a GCP service account key's client_email and private_key.

projectId

the GCP project to check.

Reads the current sslMode field first, falling back to the older requireSsl field only when sslMode is absent. An instance missing both signals, or missing its backup configuration entirely, is recorded as undetermined rather than a fail. Zero instances returned for the project is reported as needs-review rather than a pass.