Overview
This report assesses AWS resources against 16 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.
WorkSpaces
- WorkSpaces Root Volume Encryption Check
- Amazon WorkSpaces User Volume Encryption Enabled
Cognito User Pools
- Cognito User Pool Advanced Security Enabled
- Cognito user pool passwords should require min length 8, lower, upper, number, symbol, and temporary passwords <= 7 days
- MFA should be enabled for Cognito user pools
- Cognito user pools should have deletion protection enabled
Cognito Identity Pools
- Cognito identity pools should not allow unauthenticated identities
Directory Service Logs
- Directory Service Domain Controller Has Security Event Logging Enabled
Directory Service Certificates
- Directory Service Certificates Do Not Expire Within 90 Days
Directory Service Snapshots
- Directory Service Manual Snapshots ≥ 2
SES Identities
- No Publicly Accessible SES Identities
Amazon Connect Instances
- Connect Customer instances should have CloudWatch logging enabled
AppStream Fleets
- AppStream fleet default internet access should be disabled
- AppStream fleet idle disconnect timeout should be set to less than or equal to 10 mins
- AppStream fleet max user duration should be set to less than 10 hours
- AppStream fleet session disconnect timeout should be set to less than or equal to 5 mins
The report includes actionable findings and remediation guidance for supported checks.