CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS NIST CSF (V2) Compliance Assessment Execution

20 Credits

AWS NIST CSF (V2) Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS NIST CSF (V2). The assessment covers 71 mapped controls using 173 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

Detect (DE) - Continuous Monitoring (CM) DE.CM-01: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Load Balancer Access Logging is Enabled., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for VPC changes., VPC Flow Logs Enabled
Detect (DE) - Continuous Monitoring (CM) DE.CM-02: Auto Scaling Multiple Availability Zones Check, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, RDS Enhanced Monitoring Enabled, RDS Multi Availability Zones Configured
Detect (DE) - Continuous Monitoring (CM) DE.CM-03: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, MFA for Users with Console Access, IAM Users in Groups, Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls.
Detect (DE) - Continuous Monitoring (CM) DE.CM-06: Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes.
Detect (DE) - Continuous Monitoring (CM) DE.CM-09: CloudWatch Alarm Action is Configured, DynamoDB Tables Covered by AWS Backup, DynamoDB Table Point-in-time Recovery Enabled, EBS Volume In Use, EBS Volumes Covered by AWS Backup, EC2 Detailed Monitoring Enabled, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., RDS Cross-Region Automated Backup is Enabled, RDS Enhanced Monitoring Enabled, RDS and Aurora Covered by AWS Backup, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check, S3 Bucket Versioning Enabled
Detect (DE) - Adverse Event Analysis (AE) - DE.AE-02: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls., AWS Security Hub is Enabled
Detect (DE) - Adverse Event Analysis (AE) - DE.AE-03: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls., AWS Security Hub is Enabled
Detect (DE) - Adverse Event Analysis (AE) - DE.AE-04: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls., AWS Security Hub is Enabled
Detect (DE) - Adverse Event Analysis (AE) - DE.AE-06: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls., AWS Security Hub is Enabled
Detect (DE) - Adverse Event Analysis (AE) - DE.AE-07: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls., AWS Security Hub is Enabled
Detect (DE) - Adverse Event Analysis (AE) - DE.AE-08: Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for unauthorized API calls., AWS Security Hub is Enabled
Govern (GV) - Organizational Context (OC) - GV.OC-02: AWS account is part of AWS Organizations, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No Inline IAM Policies Attached
Govern (GV) - Organizational Context (OC) - GV.OC-03: No IAM Principals with Full Administrator Permissions ":", EC2 Instance Compliant SSM Association Status, EC2 Instances Compliant with SSM Patching Requirements
Govern (GV) - Risk Management (RM) - GV.RM-03: No IAM Principals with all service access or wildcard service access, No IAM Principals with Full Administrator Permissions ":"
Govern (GV) - Roles, Responsibilities, and Authorities (RR) - GV.RR-01: No Inline IAM Policies Attached
Govern (GV) - Roles, Responsibilities, and Authorities (RR) - GV.RR-02: No Inline IAM Policies Attached
Govern (GV) - Roles, Responsibilities, and Authorities (RR) - GV.RR-04: MFA for Users with Console Access, IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days)
Govern (GV) - Cybersecurity Supply Chain Risk Management (SC) - GV.SC-02: No Inline IAM Policies Attached, EC2 Transit Gateway Auto Cross-Account Attachment Disabled
Identify (ID) - Asset Management (AM) - ID.AM-01: EC2 Detailed Monitoring Enabled, EC2 Instances Managed by Systems Manager (SSM), No EC2 Instances Stopped for More Than 30 Days, EC2 Instance Compliant SSM Association Status
Identify (ID) - Asset Management (AM) - ID.AM-02: EC2 Instances Managed by Systems Manager (SSM), No EC2 Instances Stopped for More Than 30 Days, EC2 Instance Compliant SSM Association Status, Elastic IP Addresses In Use, No Unused Network Access Control Lists (NACLs)
Identify (ID) - Asset Management (AM) - ID.AM-03: API Gateway Stage Logging is Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, Ensure CloudTrail is Enabled for this Region, Load Balancer Access Logging is Enabled., S3 Bucket Access Logging Enabled, VPC Flow Logs Enabled, Redshift Clusters Audit Logging Enabled, Redshift Clusters Encrypted At-Rest
Identify (ID) - Asset Management (AM) - ID.AM-05: Auto Scaling Groups Use ELB Health Checks, DynamoDB Auto Scaling is Enabled
Identify (ID) - Asset Management (AM) - ID.AM-07: DynamoDB Tables Covered by AWS Backup, DynamoDB Table Point-in-time Recovery Enabled, RDS Cross-Region Automated Backup is Enabled, RDS and Aurora Covered by AWS Backup, S3 Bucket Cross-Region Replication, S3 Bucket Lifecycle Rules are Configured, S3 Bucket Object Lock is Enabled, S3 Version Lifecycle Policy Check, S3 Bucket Versioning Enabled
Identify (ID) - Asset Management (AM) - ID.AM-08: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, DynamoDB Tables Covered by AWS Backup, DynamoDB Table Point-in-time Recovery Enabled, EBS Volume In Use, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, ElastiCache (Redis) Snapshot Retention Period 7 days or More, Load Balancers Deletion Protection Enabled, FSx File Systems Covered by AWS Backup, RDS Cross-Region Automated Backup is Enabled, RDS and Aurora Covered by AWS Backup, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check, S3 Bucket Versioning Enabled
Identify (ID) - Risk Assessment (RA) - ID.RA-01: No Active Inspector Findings for EC2 Instances, Image Scan on Push is Enabled, AWS Security Hub is Enabled, EC2 Instances Compliant with SSM Patching Requirements
Identify (ID) - Risk Assessment (RA) - ID.RA-03: Amazon GuardDuty is Enabled, AWS Security Hub is Enabled
Identify (ID) - Risk Assessment (RA) - ID.RA-04: EC2 Detailed Monitoring Enabled, Amazon GuardDuty is Enabled, RDS Enhanced Monitoring Enabled, AWS Security Hub is Enabled
Identify (ID) - Risk Assessment (RA) - ID.RA-05: CloudTrail S3 Bucket Not Publicly Accessible, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Ensure that AWS Config is Enabled, EC2 Detailed Monitoring Enabled, Amazon GuardDuty is Enabled, Ensure that KMS Key Rotation is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., RDS Enhanced Monitoring Enabled, AWS Security Hub is Enabled, VPC Flow Logs Enabled
Identify (ID) - Risk Assessment (RA) - ID.RA-08: AWS Security Hub is Enabled, EC2 Instances Compliant with SSM Patching Requirements
Identify (ID) - Risk Assessment (RA) - ID.RA-09: Ensure that CloudTrail Log File Validation is Enabled, Private AMI is Encrypted, No Active Inspector Findings for EC2 Instances, Image Scan on Push is Enabled
Identify (ID) - Improvement (IM) - ID.IM-01: No Active Inspector Findings for EC2 Instances, AWS Security Hub is Enabled, EC2 Instances Compliant with SSM Patching Requirements
Identify (ID) - Improvement (IM) - ID.IM-02: No Active Inspector Findings for EC2 Instances, AWS Security Hub is Enabled, EC2 Instances Compliant with SSM Patching Requirements
Protect (PR) - Identity Management, Authentication, and Access Control (AA) - PR.AA-01: IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, IAM Access Keys Are Rotated every 90 Days, No Unused IAM User Credentials (90 Days), MFA for Users with Console Access, IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, No IAM Users with Administrator Privileges without MFA
Protect (PR) - Identity Management, Authentication, and Access Control (AA) - PR.AA-02: IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No IAM Users with Administrator Privileges without MFA
Protect (PR) - Identity Management, Authentication, and Access Control (AA) - PR.AA-03: IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No IAM Users with Administrator Privileges without MFA , Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for usage of root account.
Protect (PR) - Identity Management, Authentication, and Access Control (AA) - PR.AA-04: Imported and ACM-issued certificates should be renewed within 30 days of expiration, Check RSA Certificate Key Length Compliance, ACM certificates have Certificate Transparency Logging Enabled, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access, No IAM Users with Administrator Privileges without MFA , No Public KMS Keys, Ensure that KMS Key Rotation is Enabled, No IAM Principals with access to blocked actions on KMS
Protect (PR) - Identity Management, Authentication, and Access Control (AA) - PR.AA-05: No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", IAM Access Keys Are Rotated every 90 Days, No Unused IAM User Credentials (90 Days), IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, No IAM Users with Administrator Privileges without MFA , Ensure a log metric filter and alarm exist for IAM policy changes.
Protect (PR) - Data Security (DS) - PR.DS-01: Athena Workgroup Encryption at Rest Check, Ensure that CloudTrail logs are encrypted using KMS, EBS Volume is Encrypted, EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, EFS Encryption At-Rest Enabled, No Public KMS Keys, Ensure that KMS Key Rotation is Enabled, No IAM Principals with access to blocked actions on KMS, Neptune Encryption At-Rest is Enabled, Neptune Cluster Snapshot Encryption Check, RDS Storage Encryption is Enabled, S3 Default Encryption with KMS Key Check, S3 Bucket Encryption is Enabled, S3 Bucket Encryption in Transit is Enforced, SNS Topic Encryption Enabled, SQS Queue Encryption Enabled, ECS Cluster Encryption at Rest Enabled
Protect (PR) - Data Security (DS) - PR.DS-02: Imported and ACM-issued certificates should be renewed within 30 days of expiration, Check RSA Certificate Key Length Compliance, ACM certificates have Certificate Transparency Logging Enabled, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, Load Balancers Do Not Use Insecure SSL Ciphers, Elasticsearch Node-to-Node Encryption is Enabled, MSK Cluster Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, Load Balancer TLS Listener Protocol Version
Protect (PR) - Data Security (DS) - PR.DS-11: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, EBS Volume In Use, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Neptune Backup Retention Period Set to 7 Days or More, Neptune Cluster Copy Tags to Snapshot Check, Backup plan should exist in a region, Backup vaults should exist in a region, Backup report plan should exist in a region where backup plan is enabled
Protect (PR) - Platform Security (PS) - PR.PS-01: Auto Scaling Groups Use ELB Health Checks, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, EC2 Instances and EBS Volumes covered by Data Lifecycle Manager (DLM), EC2 Instances Managed by Systems Manager (SSM), No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, Secrets Manager Secrets Automatic Rotation is Enabled, EC2 Instance Compliant SSM Association Status, EC2 Instances Compliant with SSM Patching Requirements, DLM EBS Snapshot Lifecycle Policy Should Be Enabled
Protect (PR) - Platform Security (PS) - PR.PS-02: EC2 Instances Managed by Systems Manager (SSM), Redshift Version Auto-Update Enabled, Secrets Manager Secrets Automatic Rotation is Enabled, EC2 Instance Compliant SSM Association Status, EC2 Instances Compliant with SSM Patching Requirements, AWS Redshift Should Have Required Maintenance Settings
Protect (PR) - Platform Security (PS) - PR.PS-03: Attached EBS Volume Delete on Termination Enabled, Ensure that EBS Volumes have a Recent Snapshot, EBS Volumes Covered by AWS Backup, EC2 Instances Managed by Systems Manager (SSM), EC2 Instance Compliant SSM Association Status, EC2 Instances Compliant with SSM Patching Requirements, AWS Elastic Disaster Recovery (DRS) Job Enabled, EBS Volume Snapshots Should Exist
Protect (PR) - Platform Security (PS) - PR.PS-04: AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Groups Retention Policy Configured, CodeBuild Project Logging Enabled Check, CodeBuild S3 Logs Encryption is Enabled, ECS Task Definition Log Configuration Check, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Elasticsearch Audit Logging is Enabled, Amazon Elasticsearch Domain Application/Performance Logging Enabled, CloudWatch Log Group Encryption Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for usage of root account., Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, S3 Bucket Object Level Logging is enabled.
Protect (PR) - Platform Security (PS) - PR.PS-05: EC2 Instances Managed by Systems Manager (SSM), ECS Containers Read-Only Access Check, ECS Task Definition PID Mode Check, ECS Task Definition Non-Root User Check, ECS Task Definition User Check for Host Mode, EC2 Instance Compliant SSM Association Status, EC2 Instances Compliant with SSM Patching Requirements
Protect (PR) - Platform Security (PS) - PR.PS-06: Image Scan on Push is Enabled, ECR Lifecycle Policies Enabled, No Public ECR Repositories, ECR Private Tag Immutability Enabled Check, Secrets Manager Secrets Automatic Rotation is Enabled
Protect (PR) - Technology Infrastructure Resilience (IR) - PR.IR-01: AWS account is part of AWS Organizations, No IAM Principals with all service access or wildcard service access, No IAM Principals with Full Administrator Permissions ":", VPC Protected by AWS Network Firewall, Network Firewall Policy Default Action for Fragmented Packets Check, Network Firewall Policy Default Stateless Action Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public SNS Topics, Default Security Group No Rules, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0
Protect (PR) - Technology Infrastructure Resilience (IR) - PR.IR-02: Auto Scaling Multiple Availability Zones Check, Attached EBS Volume Delete on Termination Enabled, EBS Volume In Use, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Neptune Backup Retention Period Set to 7 Days or More, Neptune Cluster Copy Tags to Snapshot Check, Redshift Clusters Use Enhanced VPC Routing, S3 Bucket Cross-Region Replication, Backup plan should exist in a region, Backup vaults should exist in a region, AWS Elastic Disaster Recovery (DRS) Job Enabled
Protect (PR) - Technology Infrastructure Resilience (IR) - PR.IR-03: Auto Scaling Multiple Availability Zones Check, Auto Scaling Groups Use ELB Health Checks, Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, Neptune Backup Retention Period Set to 7 Days or More, Neptune Cluster Copy Tags to Snapshot Check, Neptune Deletion Protection is Enabled, Redshift Automatic Snapshots Enabled, S3 Bucket Cross-Region Replication, Backup plan should exist in a region, Backup vaults should exist in a region, Backup report plan should exist in a region where backup plan is enabled
Protect (PR) - Technology Infrastructure Resilience (IR) - PR.IR-04: Auto Scaling Multiple Availability Zones Check, EC2 Auto Scaling Groups Should Use EC2 Launch Templates, Auto Scaling Groups Use ELB Health Checks, CloudWatch Alarm Action is Configured, Attached EBS Volume Delete on Termination Enabled, EBS Volume In Use, EBS Volumes Covered by AWS Backup, Redshift Clusters Use Enhanced VPC Routing
Recover (RC) - Incident Recovery Plan Execution (RP) - RC.RP-01: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, Backup plan should exist in a region, Backup vaults should exist in a region, Backup report plan should exist in a region where backup plan is enabled
Recover (RC) - Incident Recovery Plan Execution (RP) - RC.RP-02: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, EBS Volume In Use, EBS Volumes Covered by AWS Backup, Ensure that EBS Volumes have a Recent Snapshot, RDS Cross-Region Automated Backup is Enabled, RDS Deletion Protection Enabled, RDS Multi Availability Zones Configured, RDS and Aurora Covered by AWS Backup, S3 Bucket Cross-Region Replication, S3 Bucket Lifecycle Rules are Configured, S3 Bucket Object Lock is Enabled, S3 Version Lifecycle Policy Check, S3 Bucket Versioning Enabled, Backup plan should exist in a region, Backup vaults should exist in a region, Backup report plan should exist in a region where backup plan is enabled, EBS Volume Snapshots Should Exist
Recover (RC) - Incident Recovery Plan Execution (RP) - RC.RP-03: Ensure that CloudTrail Log File Validation is Enabled
Recover (RC) - Incident Recovery Plan Execution (RP) - RC.RP-04: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, EBS Volume In Use, EBS Volumes Covered by AWS Backup, Amazon GuardDuty is Enabled, No IAM Principals with all service access or wildcard service access, No IAM Principals with Full Administrator Permissions ":", RDS Cross-Region Automated Backup is Enabled, RDS Deletion Protection Enabled, RDS Multi Availability Zones Configured, RDS and Aurora Covered by AWS Backup, AWS Security Hub is Enabled, Backup plan should exist in a region, Backup vaults should exist in a region, Backup report plan should exist in a region where backup plan is enabled
Recover (RC) - Incident Recovery Plan Execution (RP) - RC.RP-05: Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, Ensure that CloudTrail Log File Validation is Enabled, DynamoDB Table Point-in-time Recovery Enabled, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Amazon GuardDuty is Enabled, RDS Cross-Region Automated Backup is Enabled, RDS and Aurora Covered by AWS Backup, AWS Security Hub is Enabled
Recover (RC) - Incident Recovery Plan Execution (RP) - RC.RP-06: Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, CloudWatch Log Groups Retention Policy Configured, Backup report plan should exist in a region where backup plan is enabled
Recover (RC) - Incident Recovery Communication (CO) - RC.CO-03: Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, SNS Topic Message Delivery Notification Enabled Check
Recover (RC) - Incident Recovery Communication (CO) - RC.CO-04: S3 Event Notifications Enabled Check, S3 Block Public Access is Enabled (Account-Level), No Public SNS Topics
Respond (RS) - Incident Management (MA) - RS.MA-01: Ensure CloudTrail is Enabled for this Region, Amazon GuardDuty is Enabled, No Inline IAM Policies Attached, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
Respond (RS) - Incident Management (MA) - RS.MA-02: Ensure CloudTrail is Enabled for this Region, CloudWatch Alarm Action is Configured, AWS Security Hub is Enabled
Respond (RS) - Incident Management (MA) - RS.MA-03: CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, No Active GuardDuty Findings, AWS Security Hub is Enabled
Respond (RS) - Incident Management (MA) - RS.MA-04: CloudFormation Stack Notification Check, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, No Active GuardDuty Findings, IAM Support Role is Created, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
Respond (RS) - Incident Management (MA) - RS.MA-05: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check, Backup plan should exist in a region, Backup vaults should exist in a region, Backup report plan should exist in a region where backup plan is enabled
Respond (RS) - Incident Analysis (AN) - RS.AN-03: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Groups Retention Policy Configured, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for CloudTrail configuration changes., S3 Bucket Access Logging Enabled, AWS Security Hub is Enabled, VPC Flow Logs Enabled
Respond (RS) - Incident Analysis (AN) - RS.AN-06: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Groups Retention Policy Configured, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for CloudTrail configuration changes., S3 Bucket Access Logging Enabled, AWS Security Hub is Enabled, VPC Flow Logs Enabled
Respond (RS) - Incident Analysis (AN) - RS.AN-07: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Groups Retention Policy Configured, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for CloudTrail configuration changes., S3 Bucket Access Logging Enabled, AWS Security Hub is Enabled, VPC Flow Logs Enabled
Respond (RS) - Incident Analysis (AN) - RS.AN-08: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, No Active GuardDuty Findings, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
Respond (RS) - Incident Response Reporting and Communication (CO) RS.CO-02: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check, No Public SNS Topics
Respond (RS) - Incident Response Reporting and Communication (CO) RS.CO-03: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check, No Public SNS Topics
Respond (RS) - Incident Mitigation (MI) - RS.MI-01: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, Network Firewall Logging Enabled Check, S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check, Default Security Group No Rules, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0
Respond (RS) - Incident Mitigation (MI) - RS.MI-02: Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, Network Firewall Logging Enabled Check, S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check, Default Security Group No Rules, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0

The report includes actionable findings and remediation guidance for supported checks.