Overview
This report assesses AWS resources against 38 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.
Lambda Functions
- Lambda Resource-Based Policy Configured
- No Public Accessible Lambda Functions
Lambda Function Configuration
- Lambda Code Signing is Enabled
- Lambda Dead-Letter Queue Configured
- Lambda Functions Concurrent Execution Limit Configured
Lambda Function URLs
- No Public Lambda Function URLs Without Authentication
Lambda Networking
- Lambda functions should be in a VPC
- Lambda Multi-AZ Availability Check
Lambda Logging
- Lambda function Logging is enabled
Lambda Runtimes
- Lambda Functions do not use Obsolete Runtimes
Inspector Lambda Scanning
- Amazon Inspector Lambda Standard Scanning is Enabled
- Inspector Lambda Code Scanning Enabled
- Lambda Functions Covered by Inspector Vulnerability Scanning
- No active Inspector Findings for Lambda Functions
GuardDuty Lambda Protection
- GuardDuty Lambda Protection Enabled
- GuardDuty Lambda Protection Auto-Enroll Accounts in the Organization
API Gateway HTTP and WebSocket APIs
- Websocket and HTTP API routes should specify an authorization type
API Gateway REST APIs
- API Gateway Stage with Client Certificate Configured
- API Gateway stages should have authorizers configured
API Gateway Custom Domains
- API Gateway domain names should use recommended security policies
API Gateway Methods
- API Gateway methods authorizer should be configured
- API Gateway methods request parameter should be validated
AppSync API Caches
- AppSync API Cache Encryption at Rest Check
AppSync Logging
- AWS AppSync API Logging Configuration Check
AppSync GraphQL APIs
- AppSync is WAF protected
- AWS AppSync GraphQL APIs should not be authenticated with API keys
Step Functions State Machines
- AWS Step Functions State Machine Logging Enabled Check
EventBridge Schema Registries
- Custom Schema Registry Policy Attachment Check
EventBridge Event Buses
- Custom EventBridge Event Bus Policy Attachment Check
EventBridge Global Endpoints
- EventBridge Global Endpoint Event Replication Enabled Check
SNS Topics
- SNS Topic Message Delivery Notification Enabled Check
SQS Queues
Cognito Identity Pools
- Cognito identity pools should not allow unauthenticated identities
Cognito User Pools
- Cognito user pool passwords should require min length 8, lower, upper, number, symbol, and temporary passwords <= 7 days
- MFA should be enabled for Cognito user pools
- Cognito user pools should have deletion protection enabled
Directory Service Directories
- Directory Service directories should have SNS notification enabled
EC2 Instance Roles
- EC2 instance IAM should not allow pass role and lambda invoke function access
The report includes actionable findings and remediation guidance for supported checks.