audit_config.yaml

# Each finding type has an ID (example: S3_PUBLIC_POLICY_GETOBJECT_ONLY) that the auditing code records.
# title: A more human friendly name
# severity: May be one of High, Medium, Low, Info, Verbose, or Ignore
# is_global: Identifies this finding type as not being associated with a region when it is reported
# group: Used to group these finding types in the report

EXCEPTION:
  title: An exception occurred during the audit. 
  description: Other issues cannot be checked for until this is fixed.
  severity: Critical
  group: ERROR

S3_PUBLIC_POLICY_GETOBJECT_ONLY:
  title: Internet accessible S3 bucket via policy (only GetObject)
  description: This is the right way to make an S3 bucket public when you don't want to put CloudFront in front of it. This may be done when a third-party caching service is being used and you don't care about direct access to the S3 bucket.
  severity: Info
  is_global: True
  group: S3

S3_PUBLIC_POLICY:
  title: Internet accessible S3 bucket via policy
  description: This S3 bucket allows more public access than simply GetObject. These public privileges should be reduced.
  severity: High
  is_global: True
  group: S3

S3_PUBLIC_ACL:
  title: Public grant to S3 bucket via ACL
  description: Access to S3 buckets should be controlled by policies, not ACL. ACLs result in overly permissive privileges to list the contents of the bucket.
  severity: High
  is_global: True
  group: S3

S3_ACCESS_BLOCK_OFF:
  title: S3 Control Access Block is not on
  description: This control prevents S3 buckets from being made public.  If there are no public S3 buckets in the account this should be turned on.
  severity: Low
  is_global: True
  group: S3

S3_ACCESS_BLOCK_ALL_ACCESS_TYPES:
  title: S3 Control Access Block is not blocking all access
  description: This control prevents S3 buckets from being made public.  Confirm that the exception that has been made is necessary.
  severity: Low
  is_global: True
  group: S3

GUARDDUTY_OFF:
  title: GuardDuty is not enabled
  description: GuardDuty is an AWS threat detection service that detects compromised access keys, EC2 instances, and more. It should be enabled in all regions.
  severity: Medium
  group: GuardDuty

CLOUDTRAIL_OFF:
  title: CloudTrail is off
  description: CloudTrail provides audit logs for an account and should be enabled. Preferably, this should be done at the Organization level.
  severity: Low
  is_global: True
  group: CloudTrail

CLOUDTRAIL_NOT_MULTIREGION:
  title: CloudTrail is not multiregion
  description: When CloudTrail was first released, you had to specify which regions to enable it in.  It now defaults to recording audit logs for all regions.  It should be configured for multiregion.
  severity: Low
  group: CloudTrail

PASSWORD_POLICY_NOT_SET:
  title: Password policy is not set
  description: A password policy helps ensure strong passwords are used by IAM Users. Setting a password policy does not impact existing users, so after setting this, you should ensure users reset their passwords so that they are in compliance.
  severity: Low
  is_global: True
  group: IAM
  
PASSWORD_POLICY_CHARACTER_MINIMUM:
  title: Password policy does not meet minimum character requirement
  description: A password length requirement helps ensure strong passwords are used by IAM Users. Setting a password policy does not impact existing users, so after setting this, you should ensure users reset their passwords so that they are in compliance.
  severity: Low
  is_global: True
  group: IAM
  
PASSWORD_POLICY_CHARACTER_SET_REQUIREMENTS:
  title: Password policy does not require all character sets
  description: A password character set requirement help ensure strong passwords are used by IAM Users. Setting a password policy does not impact existing users, so after setting this, you should ensure users reset their passwords so that they are in compliance.
  severity: Low
  is_global: True
  group: IAM

ROOT_USER_HAS_ACCESS_KEYS:
  title: Root user has access keys
  description: The root user should be used only in exceptional cases, and should therefore not use access keys. IAM Users or Roles should be used instead.
  severity: Low
  is_global: True
  group: IAM

ROOT_USER_HAS_NO_MFA:
  title: Root user has no MFA
  description: MFA (multi-factor authentication) helps mitigate account take-overs. If this root user does not have an MFA associated with them, the account can more easily be compromised, especially through email account compromises, even if you do not know the password (as happens with Organization created accounts).
  severity: Medium
  is_global: True
  group: IAM

USER_WITH_PASSWORD_LOGIN_BUT_NO_MFA:
  title: User has password login, but not MFA
  description: MFA (multi-factor authentication) helps mitigate user account take-over.
  severity: Medium
  is_global: True
  group: IAM

USER_HAS_NEVER_LOGGED_IN:
  title: User has never logged in
  description: The password for these users should be removed. If the user has no access keys, the user should be removed.  The password may be a default password or may have been transmitted to the user insecurely, such that the user account may be compromised.
  severity: Medium
  is_global: True
  group: IAM

USER_HAS_NOT_LOGGED_IN_FOR_OVER_MAX_DAYS:
  title: User has not logged in for over 90 days
  description: The user has not used their password login for over 90 days.  The password login should be removed from this user, or the user entirely.
  severity: Medium
  is_global: True
  group: IAM

USER_HAS_TWO_ACCESS_KEYS:
  title: User has two access keys
  description: A user should only have one access key.  The ability to have multiple access keys is only for when an access key is being rolled, and the old one should be removed. The user should identify one access key to use and the other should be removed.
  severity: Low
  is_global: True
  group: IAM

USER_HAS_UNUSED_ACCESS_KEY:
  title: User has unused access key
  description: These users have access keys that have never been used. These access keys may have been communicated to the user insecurely, or otherwise may not be as well protected as they should.
  severity: Low
  is_global: True
  group: IAM

USER_HAS_NOT_USED_ACCESS_KEY_FOR_MAX_DAYS:
  title: User has not used access key for over 90 days
  description: Access keys that have not been used for a while should be removed as they may have been lost, but still grant access to the account.
  severity: Low
  is_global: True
  group: IAM

IAM_BAD_MFA_POLICY:
  title: Incorrect policy used to attempt to enforce MFA
  description: AWS had advised incorrect policies for enforcing MFA which allowed an attacker, if they compromised keys that were protected by this policy, to remove the MFA policy from themselves, or remove the existing MFA device and add their own.
  severity: High
  is_global: True
  group: IAM

IAM_KNOWN_BAD_POLICY:
  title: Known bad policy used
  description: AWS has provided flawed policies to customers. These are either deprecated or no longer advised.
  severity: High
  is_global: True
  group: IAM

IAM_NOTACTION_ALLOW:
  title: Use of NotAction in an Allow statement
  description: Using NotAction in an Allow policy almost always results in unwanted actions being allowed and should be avoided.
  severity: Medium
  is_global: True
  group: IAM

IAM_ROLE_ALLOWS_ASSUMPTION_FROM_ANYWHERE:
  title: IAM role allows assumption from anywhere
  description: The IAM role's trust policy allows any other account to assume it.
  severity: High
  is_global: True
  group: IAM

IAM_MANAGED_POLICY_UNINTENTIONALLY_ALLOWING_ADMIN:
  title: Managed policy is allowing admin
  description: This finding is primarily for the deprecated AmazonElasticTranscoderFullAccess policy that was found to grant admin privileges.
  severity: Medium
  is_global: True
  group: IAM

IAM_CUSTOM_POLICY_ALLOWS_ADMIN:
  title: Custom policy allows admin
  description: Instead of using the AdministratorAccess policy, a custom policy was created that does the same thing, or allows escalation to the same thing.
  severity: Low
  is_global: True
  group: IAM

IAM_UNEXPECTED_FORMAT:
  title: Unexpected formatting of IAM policy
  description: IAM policies can be written to do things that are unexpected. This catch-all issue identifies anything unexpected in a policy.
  severity: Low
  is_global: True
  group: IAM

IAM_UNEXPECTED_ADMIN_PRINCIPAL:
  title: IAM role with admin privileges can be assumed by unexpected principals
  description: Admins in an account should be assumed by people. This rule detects IAM Roles that have admin privileges which can be granted to EC2s and other services.
  severity: High
  is_global: True
  group: IAM

IAM_UNEXPECTED_S3_EXFIL_PRINCIPAL:
  title: IAM role with s3 listing and get privileges can be assumed by unexpected principals
  description: The ability to list s3 buckets, and get objects from them, should be restricted largely to people as compromising an EC2 with this privilege could lead to exfiltration of data.
  severity: High
  is_global: True
  group: IAM

IAM_LINTER:
  title: IAM linting issues
  description: Issues identified by the IAM linter Parliament
  severity: Low
  is_global: True
  group: IAM

IAM_NAME_DOES_NOT_INDICATE_ADMIN:
  title: Name does not indicate admin
  description: This IAM Group grants admin privileges, but the name does not indicate it is for admins.
  severity: Low
  is_global: True
  group: IAM

DOMAIN_NOT_SET_TO_RENEW:
  title: Domain not set to autorenew
  description: This domain will no longer be under your control once it expires and may be taken over by someone else.
  severity: High
  is_global: True
  group: Route53

DOMAIN_HAS_NO_TRANSFER_LOCK:
  title: Domain does not have a domain transfer lock set
  description: A domain transfer lock mitigates the possibility of someone else taking ownership of your domain. Not all TLD's support this. For example, the .io domain does not support this.
  severity: Low
  is_global: True
  group: Route53

EBS_SNAPSHOT_PUBLIC:
  title: EBS snapshot is public
  description: This is essentially a copy of a hard-drive and may contain sensitive information. These are very easy for attackers to find.
  severity: High
  group: EC2

RDS_PUBLIC_SNAPSHOT:
  title: RDS snapshot is public
  description: This is a copy of the contents of a database and may contain sensitive information. These are very easy for attackers to find.
  severity: High
  group: RDS

RDS_PUBLIC_IP:
  title: RDS has a public IP address
  description: Check whether this RDS instance is publicly accessible. Best practice is to put RDS instances in private subnets and not give them public IPs.
  severity: Low
  group: RDS

RDS_VPC_CLASSIC:
  title: RDS is using VPC classic
  description: At one point AWS did not have the concept of VPCs so all network resources had public IPs.  Workloads not in VPCs cannot take advantage of certain security benefits and should be migrated.  Databases should be in private subnets.
  severity: Low
  group: RDS

AMI_PUBLIC:
  title: AMI is public
  description: An AMI is used to install the OS for an EC2 instance. These may contain sensitive information. These are very easy for attackers to find.
  severity: High
  group: EC2

ECR_PUBLIC:
  title: ECR is public
  description: The Amazon Elastic Container Registry (ECR) stores Docker images. These may contain sensitive information. These are somewhat hard for an attacker to find, but should not be made public.
  severity: Medium
  group: ECR

REDSHIFT_PUBLIC_IP:
  title: Redshift has public IP
  description: Redshift databases should be in private subnets. Databases should not have public IPs. You should additionally check if the Security Groups associated with this are allowing it to be publicly accessible.
  severity: Medium
  group: Redshift

ES_PUBLIC:
  title: ElasticSearch cluster is publicly accessible
  description: ElasticSearch databases should not be public. Change the resource policy to fix this.
  severity: High
  group: ElasticSearch

CLOUDFRONT_MINIMUM_PROTOCOL_SUPPORT:
  title: CloudFront is supporting an insecure minimum protocol version
  description: An advanced attacker with a privileged position in a network could obtain access to the encrypted traffic coming to this CloudFront distribution because this distribution supports an older, weaker protocol version.
  severity: Low
  is_global: True
  group: CloudFront

EC2_SOURCE_DEST_CHECK_OFF:
  title: EC2 Source/Destination check is off
  description: If there are no routes, this is not doing anything and the Source/Destination check should be re-enabled.
  severity: Info
  group: EC2

EC2_CLASSIC:
  title: EC2 Classic used
  description: EC2 Classic does not use VPCs. Some security benefits are therefore not possible. These workloads should be migrated to modern EC2 instances.
  severity: Info
  group: EC2

EC2_OLD:
  title: Old EC2
  description: EC2 runnning that was launched more than 365 days ago.
  severity: Info
  group: EC2

LAMBDA_PUBLIC:
  title: Lambda is internet accessible
  description: Lambdas should not be publicly callable. Other resources such as an API Gateway should be used to call the Lambda.
  severity: Medium
  group: Lambda

GLACIER_PUBLIC:
  title: Glacier vault is publicly accesible
  description: Glacier is a storage service like S3. These vaults are harder to find, but may still contain sensitive information. The resource policy should be locked down to allow access only by certain accounts.
  severity: Medium
  group: Glacier

KMS_PUBLIC:
  title: KMS is publicly accesible
  description: This may allow an attacker to decrypt data using the KMS key.
  severity: Medium
  group: KMS

SQS_PUBLIC:
  title: SQS is publicly accesible
  description: This may allow an attacker to read or write messages to this queue.
  severity: Medium
  group: SQS

SNS_PUBLIC:
  title: SNS is publicly accesible
  description: This may allow an attacker to read or write messages to this queue.
  severity: Medium
  group: SNS

SG_CIDR_OVERLAPS:
  title: Security Group overlaps
  description: This often happens when one attempts to restrict access, then opens up the access further.
  severity: Low
  group: SecurityGroup

SG_CIDR_UNNEEDED:
  title: Security Group CIDR unneeded
  description: The CIDR in the Security Group cannot be blocked, so including it is not necessary.
  severity: Info
  group: SecurityGroup

SG_CIDR_UNEXPECTED:
  title: Security Group CIDR unexpected
  description: The CIDR in the Security Group is formatted oddly.
  severity: Info
  group: SecurityGroup

SG_LARGE_CIDR:
  title: Security Group CIDR contains large IP range
  description: The CIDR in a Security Group in the account contains a large IP range, defeating the purpose of restricting access with a Security Group.
  severity: Info
  group: SecurityGroup

LIGHTSAIL_IN_USE:
  title: Lightsail in use
  description: There is nothing wrong with Lightsail, but it does not tend to be used in enterprises. The instances often were created while testing something and forgotten about.
  severity: Info
  group: Lightsail

FOREIGN_HOSTED_ZONE:
  title: Hosted zone found
  description: Hosted Zones have legitimate uses, but may also be used to redirect traffic by an attacker, especially when they are owned by another account. (This finding needs more research into what should be filtered out, but I wanted to expose this info for manual review).
  severity: Info
  group: Route53

EC2_IMDSV2_NOT_ENFORCED:
  title: IMDSv2 not enforced
  description: The original metadata service that allows EC2s to assume IAM roles could allow an attacker to take over that role if they were able to find an SSRF vulnerability or proxy functionality on the instance. IMDSv2 should be enforced and not optional.
  severity: Medium
  group: EC2

ACCESSANALYZER_OFF:
  title: Access Analyzer off
  description: Access Analyzer is a free service that can tell you when resources are public or shared with unexpected accounts.
  severity: Medium
  group: AccessAnalyzer

REQUEST_SMUGGLING:
  title: Request smuggling not denied
  description: "HTTP request smuggling is possible against ALBs, as described here: https://portswigger.net/web-security/request-smuggling"
  severity: Low
  group: ELB

ELBV1_DESYNC_MITIGATION:
  title: Desync mitigation mode not configured
  description: "Desync mitigation mode protects your application from issues due to HTTP Desync and should be set to 'Strictest'. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html"
  severity: Low
  group: ELB