Overview
This report assesses AWS resources against 49 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.
EC2 Security Groups
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Cassandra Ports (7199, 9160 or 8888)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to CIFS Ports (TCP 445)
- No Security Group Rules Allowing Insecure Ports (Ingress)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Memcached Ports (11211)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to MongoDB Ports (27017 or 27018)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to MySQL DB Ports (3306)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Oracle DB Ports (1521 or 2483)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Postgres DB Ports (5432)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Redis Ports (6379)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22)
- Default Security Group No Rules
- VPC security groups should restrict uses of 'launch-wizard' security groups
- VPC security groups should restrict ingress CIFS access from 0.0.0.0/0 and ::/0
- VPC security groups should restrict ingress access on ports 20, 21, 22, 3306, 3389, 4333 from 0.0.0.0/0
- VPC security groups should restrict ingress Kafka port access from 0.0.0.0/0
- VPC security groups should restrict ingress kibana port access from 0.0.0.0/0
- VPC security groups should restrict ingress redis access from 0.0.0.0/0
- VPC security groups should restrict ingress TCP and UDP access from 0.0.0.0/0
EC2 Transit Gateways
- EC2 Transit Gateway Auto Cross-Account Attachment Disabled
- EC2 Transit Gateway Auto VPC Attach is Disabled
Site-to-Site VPN Connections
- EC2 VPN connections should have logging enabled
- EC2 VPN connections should use IKEv2 protocol
Network ACLs
- No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0)
Internet Gateways
- VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs)
VPCs
- Default VPC is Deleted
- VPC Protected by AWS Network Firewall
- Multi-Layered VPC Check
- VPCs Exist in More Than One Region
VPC Endpoints
- VPC Configured to Use VPC Endpoints (PrivateLink)
- Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
- VPCs should be configured with an interface endpoint for ECR API
- VPCs should be configured with an interface endpoint for Docker Registry
- VPCs should be configured with an interface endpoint for Systems Manager
- VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts
- VPCs should be configured with an interface endpoint for Systems Manager Incident Manager
- VPC endpoint services should have acceptance required enabled
VPC Flow Logs
- VPC Flow Logs are Forwarded to CloudWatch Logs
VPC Peering Connections
- Avoid Many-to-Many VPC Peering Topologies
VPC Route Tables
- VPC Peering Routing Tables Are "Least Access"
- VPC Route Tables Restrict Public Access to IGW
Site-to-Site VPN Connections
- Backup VPN Connection Configured
Route 53 DNS Firewall
- VPC protected by Route53 DNS Firewall
Network Firewall Firewalls
- Network Firewall Logging Enabled Check
- Network Firewall Multi-AZ Deployment Check
- Network Firewall Subnet Change Protection is Enabled
VPC Block Public Access
- EC2 VPC Block Public Access settings should block internet gateway traffic
VPC Subnets
- Auto Assign Public IP is Disabled for Subnets
The report includes actionable findings and remediation guidance for supported checks.