Package: aws-audit
AWS AuditAWS Audit is a command line utility that will help end-user/application owner to audit the AWS services from the security perspective.Here are the features of the AWS AuditCommand line utilityGenerate report in excelNo additional setup is requiredInstallationThe easiest way to install AWS Audit is to use pip.$pipinstallaws-auditor install it globally using below command:$sudopipinstallaws-auditVerify InstallationVerify which version is installed on system using below command.$awsaudit-vor$awsaudit--versionConfigure AWS AuditThe AWS IAM user which you are using to configure the utility needs to have "ReadOnlyAccess" policy assigned.You have to provide AWS Access Key ID and AWS Secret Access Key to complete the configuration.Once you installed and verify the setup of AWS Audit, configure the utility using below command.$awsaudit--configureGetting StartedTo get help for AWS Audit run below command.$awsaudit-hRun the following command to get list of AWS Services available with utility.$awsaudit--list-servicesRun the following command to get the list of rules for specific service.$awsaudit--list-rulesacmIf you want to run the audit for specific service and for the specific region:$awsaudit--servicesec2--regionsus-east-1or, for multiple services:$awsaudit--servicesec2,rds--regionsus-east-1or, if you want to run for all regions do not pass regions:$awsaudit--servicesec2,rdsor, for all services for specific regions:$awsaudit--regionsus-east-1,us-east-2Shorthand parameters are also available.$awsaudit-sec2-rus-east-1Available ServicesServiceRule IDSeverityRuleacmACM_001HighAWS ACM Certificates are expired.ACM_002MediumACM Certificates are about to expires in 30 days.ACM_003LowACM Certificate issued for wildcard domain.apigatewayAPIGATEWAY_001MediumProduction stage APIs not integratated with AWS WAF.APIGATEWAY_002MediumProduction and Staging stage APIs not configured for SSL certificate.APIGATEWAY_003MediumAPIs are publicly accessible.backupBACKUP_001HighBackup vault access policy is not configured to prevent the deletion.BACKUP_001HighBackup valult is not encrypted with KMS CMK.BACKUP_003MediumBackup plans lifecycle configuration is not enabled.cloudfrontCLOUDFRONT_001LowCloudfront distributions are not using geo restriction.CLOUDFRONT_002MediumCloudfront distributions are using insecure SSL protocolsCLOUDFRONT_003MediumCloudfront distributions are not integrated with AWS WAF.CLOUDFRONT_004MediumAccess Logging is not enabled for Cloudfront distributions.CLOUDFRONT_005MediumCloudFront distributions are not using improved security policies for HTTPS connections.CLOUDFRONT_006MediumTraffic between the AWS CloudFront distributions and their origins is not encrypted.CLOUDFRONT_007MediumCloudfront not using secure viewer protocol policy.CLOUDFRONT_008MediumOrigin access identity is not enabled for Cloudfront distributionsCLOUDFRONT_009MediumField level encryption is not enabled for Cloudfront distributions.cloudtrailCLOUDTRAIL_001HighCloudtrail trails are not enabled.CLOUDTRAIL_002HighCloudtrail is not enabled for global services.CLOUDTRAIL_003MediumCloudtrail logs are not encrypted.CLOUDTRAIL_004MediumManagement events are not included into Cloudtrail.CLOUDTRAIL_005MediumFile integrity validation not enabled for Cloudtrail.CLOUDTRAIL_006MediumLog delivery failing for Cloudtrail.CLOUDTRAIL_007MediumBucket logging is not enabled for Cloudtrail.CLOUDTRAIL_008HighCloudtrail logging bucket is publicly accessible.configCONFIG_001HighAWS Config is not enabled.CONFIG_001MediumGlobal resources are not included in AWS Config.CONFIG_001MediumAWS Config log delivery failed.dmsDMS_001HighDMS replication instances are not encrypted with KMS CMK.DMS_002HighDMS replication instances are publicly accessible.DMS_003MediumDMS replication instances auto minor version upgrade feature not enabled.documentdbDOCUMENTDB_001HighDocumentDB clusters are not encrypted with KMS CMK.DOCUMENTDB_002HighDocumentDB Clusters are not encrypted at rest.DOCUMENTDB_003LowLog export feature is not enabled for DocumentDB Clusters.dynamodbDYNAMODB_001HighDynamoDB is not encrypted with KMS CMK.ec2EC2_001HighAMI is not encrypted.EC2_002MediumAMI is publicly shared. Your data on AMI is accessible to everyone.EC2_003MediumEC2 Default security groups are unrestricted.EC2_004MediumDefault EC2 security group is in use.EC2_005LowSecurity groups rule description not present.EC2_006LowYour account has too old AMI.EC2_007MediumEC2 instance not in VPCEC2_008MediumEC2 instances are not using IAM role.EC2_009LowEC2 security groups prefixed with 'launch-wizard'.EC2_010MediumEC2 Security groups opening wide port range to allow inbound traffic.EC2_011MediumEC2 security group allows unrestricted inbound access for TCP port 445.EC2_012MediumEC2 security group allows unrestricted inbound access for TCP port 53.EC2_013MediumEC2 security group allows unrestricted inbound access for TCP port 9200.EC2_014MediumEC2 security group allows unrestricted inbound access for TCP port 20 and 21.EC2_015MediumEC2 security group allows unrestricted inbound access for TCP port 80.EC2_016MediumEC2 security group allows unrestricted inbound access for TCP port 443.EC2_017MediumEC2 security group allows unrestricted inbound access for ICMP.EC2_018MediumEC2 security group allows unrestricted inbound access for TCP port 27017.EC2_019MediumEC2 security group allows unrestricted inbound access for TCP port 1433.EC2_020MediumEC2 security group allows unrestricted inbound access for TCP port 3306.EC2_021MediumEC2 security group allows unrestricted inbound access for TCP port 137, 138, and 139.EC2_022MediumEC2 security group allows unrestricted inbound access for TCP port 1521.EC2_023MediumEC2 security group allows unrestricted outbound access for all ports.EC2_024MediumEC2 security group allows unrestricted inbound access for TCP port 5432.EC2_025MediumEC2 security group allows unrestricted inbound access for TCP port 3389.EC2_026MediumEC2 security group allows unrestricted inbound access for TCP port 135.EC2_027MediumEC2 security group allows unrestricted inbound access for TCP port 25.EC2_028MediumEC2 security group allows unrestricted inbound access for TCP port 22.EC2_029MediumEC2 security group allows unrestricted inbound access for TCP port 23.EC2_030MediumEC2 security group allows unrestricted inbound access for TCP port 5601.EC2_031MediumEC2 security group allows unrestricted inbound access for TCP port 5500.EC2_032MediumEC2 security group allows unrestricted inbound access for TCP port 5900.EC2_033MediumEC2 security group allows unrestricted inbound access for TCP port 8020.EC2_034MediumEC2 security group allows unrestricted inbound access for TCP port 50070 and 50470.EC2_035MediumUnused key pairs presentEC2_036HighEBS Volume snapshots are public.EC2_037HighEBS volumes are not encryptedEC2_038HighEBS volumes are not encrypted with KMS CMK.EC2_039MediumEBS snapshots are not encrypted.EC2_040MediumVPC enpoints allows cross account access.EC2_041MediumVPC endpoints are exposed to everyone.EC2_042LowVPC Flow Log is not enabled.EC2_043MediumDefault VPC exists.ecrECR_001HighRepositories are exposed to everyone.ECR_002HighRepositories are allows cross account access.efsEFS_001HighEncryption is not enabled for EFS File systems.EFS_002HighEFS file systems are not encrypted with KMS CMK.eksEKS_001LowEKS Clusters logging is not enabled.EKS_002MediumEKS Cluster security group is not secure.EKS_003MediumEKS Cluster endpoint is publicly accessible.elasticacheELASTICACHE_001LowElastiCache clusters are using default port.ELASTICACHE_002MediumElastiCache clusters are not in VPC.ELASTICACHE_003HighElastiCache clusters end-to-end encryption is not enabled.elbv2ELBV2_001MediumApplication load balancer not using HTTPS listener.ELBV2_002MediumALB Access logging in not enabledELBV2_003MediumWAF is not configured for ALBsELBV2_004MediumALBs are using insecure ciphers.ELBV2_005MediumALBs Invalid HTTP header dropped feature is not enabled.ELBV2_006MediumALB deletion protection is not enabled.emrEMR_001MediumEMR clusters are not in VPC.EMR_002HighEMR clusters end-to-end encryption is not enabled.esES_001HighAWS ElasticSearch domains are not encrypted with KMS Customer Master Keys.ES_002HighNode to Node encryption is not enabled for ES clusters.ES_003HighES Clusters are allowed cross account access.ES_004HighES Domains are exposed to everyone.ES_005MediumES Domains are not in VPC.ES_006HighES domains are not encrypted at-rest.ES_007HighES Domains are not enforcing HTTPS connections.firehoseFIREHOSE_001HighFirehose delivery stream source records are not encrypted.FIREHOSE_002HighFirehose delivery stream S3 destination is not encrypted.fsxFSX_001MediumFSx for Windows File Server file systems are not encrypted using AWS KMS CMksiamIAM_001MediumIAM password policy is not defined.IAM_002HighIAM users are having full administrator permission.IAM_003HighIAM policies have full administrator access.IAM_004MediumIAM ggroups are using inline policies.IAM_005MediumIAM users are not present.IAM_006HighMFA is not enabled for IAM users.IAM_007HighIAM root account is using access keys.IAM_008HighMFA for root account is not enabled.IAM_009MediumIAM users having more than one active access keys.IAM_010MediumIAM users having more than one active ssh keys.IAM_011LowIAM groups are not having users.IAM_012MediumIAM having unused users.kafkaKAFKA_001MediumKafka clusters are not encrypted using KMS CMK.kinesisKINESIS_001HighKinesis streams are not using server side encryption.KINESIS_002HighKinesis streams are not encrypted using KMS CMK.kmsKMS_001HighKMS Key is exposed to everyone.KMS_002MediumKMS Key rotation is not enabledKMS_003MediumKMS key is scheduled for deleteion. It may impact services if key is in use.KMS_004HighKMS Key allows cross account access.lambdaLAMBDA_001HighLambda functions are exposed to everyone.LAMBDA_002MediumLambda functions are allows cross account access.LAMBDA_003MediumLambda functions are not in VPC.mqMQ_001LowMQ brokers log export feature is not enabled.MQ_002MediumMQ Brokers are publicly accessible.MQ_003MediumMQ brokers, auto minor version upgrade feature is not enabled.neptuneNEPTUNE_001MediumNeptune clusters are not using IAM Database authentication.NEPTUNE_002MediumNeptune instances are not encrypted using KMS CMK.NEPTUNE_003HighNeptune instances are not encrypted.NEPTUNE_004HighNeptune instances are publicly accessible.NEPTUNE_005MediumNeptune instances auto minor version upgrade feature not enabled.NEPTUNE_006LowNeptune instances are using default port.rdsRDS_001HighRDS Database snapshots are publicly accessible.RDS_002MediumRDS Aurora database deletetion protection feature is not enabled.RDS_003LowRDS Log exports feature is not enabled.RDS_004LowLog exports features is not enabled for Aurora Serverless databases.RDS_005MediumIAM database authentication feature is not enabled.RDS_006MediumRDS deletetion protection is not enabled for database instances.RDS_007MediumRDS auto minor version upgrade is not enabled.RDS_008LowRDS insatnces are using default ports.RDS_009HighRDS instances are not encypted with KMS CMK.RDS_0010HighRDS instances are not encrypted.RDS_0011HighRDS instance is publicly accessible.RDS_0012MediumUnrestricted security groups assign to RDS Instances.RDS_0013HighRDS Database snapshots are not encrypted.redshiftREDSHIFT_001LowActivity logging is not enabled for Redshift clusters.REDSHIFT_002MediumAudit logging is not eneabled for Redshift clusters.REDSHIFT_003LowRedshift clusters are using default port.REDSHIFT_004HighRedshift clusters are not encrypted.REDSHIFT_005HighRedshift clusters are not encrypted using KMS CMK.REDSHIFT_006MediumRedshift clusters not in VPC.REDSHIFT_007HighRedshift clusters are publicly accessible.REDSHIFT_008MediumParameter groups associated with Redshift cluster do not have the require_ssl parameter enabled.route53ROUTE53_001LowPrivacy protection is not enabled for Route53 Domains.ROUTE53_002MediumSPF record is not present for Hosted Zones.ROUTE53_003MediumTransfer lock is not enabled for Route53 Domains.s3S3_001MediumServer side encryption is not enabled for S3 buckets.S3_002MediumIn-Transit encryption not enabled for S3 buckets.S3_003LowObject lock feature is not enabled for S3 Buckets.S3_004HighS3 Buckets are allowing cross account access.S3_005LowLifecycle rules are not configured for S3 Buckets.S3_006MediumS3 Buckets are not encrypted using KMS CMK.S3_007HighS3 Buckets are not encrypted using default encryption.S3_008HighS3 Buckets are allowing global Read, Write, Delete permissions.sagemakerSAGEMAKER_001MediumNotebook instances are not in VPC.SAGEMAKER_002HighNotebook instances are not encrypted.SAGEMAKER_003HighNotebook instances are not encrypted using KMS CMK.SAGEMAKER_004MediumNotebook instances are publicly accessible.secretsmanagerSECRETSMANAGER_001HighSecret is not encrypted with KMS CMK.SECRETSMANAGER_002MediumSecret rotation is not enabled.SECRETSMANAGER_003MediumSecret rotation interval is not configured.sesSES_001LowSES DKIM is not enabled.SES_002HighSES identities are exposed to everyone.SES_003HighSES identities allows cross account access.shieldSHIELD_001MediumAWS Shield is not enabeld.snsSNS_001HighSNS topics are not encrypted.SNS_002HighSNS topics are not encrypted with KMS CMK.SNS_003HighSNS topics are exposed to everyone.SNS_004HighSNS topics allows cross account accessSNS_005MediumSNS topics are using insecure subscription.SNS_006MediumSNS topics allows everyone to publish.SNS_007MediumSNS topics allows everyone to subscribe.sqsSQS_001HighSQS queues are enforcing server side encryptionSQS_002HighSQS queues are not encrypted with KMS CMK.SQS_003HighSQS Queues are exposed to everyone.SQS_004HighSQS queues are allowing cross account access.ssmSSM_001MediumSSM Paramters are not encrypted.transferTRANSFER_001MediumCloudwatch logging is not enabled for Transfer for SFTP.TRANSFER_002MediumTransfer for SFTP servers are not using PrivateLink for endpointsxrayXRAY_001HighX-ray not encrypts traces and related data using KMS CMK.For IssuesFor any issues/queries/suggestions please reach us atthecloudrecipes[at]gmail[dot]com