PingSafe Knowledge Base

Back to home

PingSafe Knowledge Base

AWS Knowledge Base

AWS Knowledge Base

We have written articles that explain security checks done by PingSafe on AWS and how engineering teams can fix the vulnerabilities.

Amazon EKS

EKS Security Groups Insecure Open Ports

EKS Security Groups Not Configured

EKS Secrets Not Encrypted

EKS Private Endpoint Disabled

EKS Kubernetes Version Deprecated Or Outdated

EKS Logging Disabled

See more

Amazon RDS

RDS Logging Disabled

RDS Multiple AZ Disabled

RDS IAM Database Authentication Disabled

RDS Transport Encryption Disabled

RDS low encryption

RDS Snapshot Encryption Disabled

RDS Publicly Accessible

RDS Automated Backups Disabled

RDS Encryption At Rest Disabled

RDS DocumentDB Minor Version Upgrade Disabled

RDS Deletion Protection Disabled

See more

Amazon Kinesis

Firehose Delivery Streams Encryption Disabled

Firehose Delivery Streams Using Default KMS Key

AWS Kinesis Using Default KMS key For Server-Side Encryption

Kinesis KMS Encryption Disabled

AWS Organizations

AWS Organizations All Features Not Enabled

AWS Organization Pending Invites

AWS Organizations Not In Use

Amazon SQS (Simple Queue Service)

SQS Missing Dead Letter Queue

SQS Public Access

SQS Cross-Account Access

SQS Not Encrypted

SQS Queue Unprocessed Messages

SQS Default KMS Key

See more

AWS Cloudtrail

CloudTrail Log File Validation Disabled

CloudTrail Delivery Failing

CloudTrail Encryption Disabled

CloudTrail Management Events Disabled

CloudTrail Logging Disabled

CloudTrail CloudWatch Integration Disabled

CloudTrail Bucket Access Logging Disabled

CloudTrail Data Events Disabled

CloudTrail Bucket Having Public Access

CloudTrail Not Logging Global API Calls

CloudTrail Bucket Delete Policy Disabled

CloudTrail Incorrect S3 Bucket Configuration

CloudTrail Global Services Logging Duplicated

See more

AWS Certificate Manager

Upcoming ACM Certificates Expiry

ACM Certificate Renew Eligibility Check

ACM Certificate Without Validation Options

ACM Certificate Validation Failure

ACM Expired Certificates

ACM Certificate DNS Validation Check

See more

AWS IAM

Directly Attached User IAM Policies

Users MFA Disabled

Groups Without Users

Weak Password Policy - 'Minimum Password Length'

Password Policy Not Set

Insecure Password Reuse Prevention

Password Policy Missing 'Require Numbers'

Missing Hardware MFA For Root Account

Root Account In Use

Root MFA Disabled

Insecure Password Expiration

Password Policy Missing- 'Require Uppercase'

Group With Inline Policies

Extra Access Keys

Unused Roles

Access Keys Not Rotated

Cross-Account Access External ID and MFA With Roles

Root Account With Active Signing Certificates

Insecure Role Policies

Extra Users

Password Policy Missing - 'Require Lowercase'

Root Access Keys Exist

Extra User Admins

Users Active Password And Access Keys

Unused Access Keys

Password Policy Missing- 'Require Symbols'

Fetch AWS Access Key's Last Used Detail

See more

AWS Workspaces

WorkSpaces Root Volume Encryption Disabled

Workspaces IP Access Control Too Open

WorkSpaces User Volume Encryption Disabled

Workspaces IP Access Control Disabled

Amazon S3

S3 Bucket Insecure Read Access

S3 Buckets With Global Policy

S3 DNS Compliant Bucket Names

S3 Bucket Insecure Write Access

S3 Transfer Acceleration Disabled

One To Many S3 Bucket CloudFront Mapping

S3 Bucket Versioning Disabled

S3 Buckets With Logging Disabled

S3 Buckets with global ACL

S3 Bucket Lifecycle Configuration

S3 Bucket MFA Delete Disabled

See more

AWS Systems Manager (AWS SSM)

SSM Parameters Poorly Encrypted

Non-SecureString SSM Parameters present

Amazon EC2

Public IP Address Attached To EC2 Instances

Open Kibana

Public PostgreSQL

Public CIFS

Default VPC In Use

Public SQL Server

Open Hadoop HDFS NameNode Metadata Service

Unused Elastic Network Interfaces

Elastic Block Store Volumes Too Old Snapshots

Unencrypted AMIs

VPC Endpoint Cross-Account Access

Unused Security Groups

Elastic Block Store Backup Disabled

Unrestricted public access in security groups

Public MySQL

Unused Amazon Machine Images

Public Elasticsearch

App-Tier/Web-Tier EC2 Instance IAM Role Without Policy

VPC Subnet Instances Present

Elastic Block Store Unencrypted Snapshots

Managed NAT Gateway Not In Use

Public DNS

Elastic Block Store Volume Snapshot Public

VPC Multiple Subnets

Elastic Block Store Volume Snapshot Private

Public SMBoTCP

VPC Endpoint Exposed

Elastic Block Store Unencrypted Volumes

Restricted Ports Open to Public

Public AMI

Default VPC Exists

Elastic IP Limit Breach

Elastic Block Store Volume Default Encryption Disabled

VPC Flow Logs Not Enabled

Instance vCPU On-Demand Limit

VPC Elastic IP Limit Breach

Overlapping Security Groups

Public SSH

NAT Multiple AZ Not Configured

Instance Limit Breach

Open Salt

Instances Without IAM Role

Public RPC

Public Telnet

Unused VPC Egress Only Internet Gateways

Unused VPC Internet Gateways

Public VNC Client

Public Oracle

Down VPN Tunnels

Public FTP

Open Oracle Auto Data Warehouse

Open Hadoop HDFS NameNode WebUI

Detect EC2 Classic Instances

Open Docker

Public VNC Server

EC2 LaunchWizard Security Groups

Public RDP

Public NetBIOS

Default Security Groups In Use

Unused Virtual Private Gateway

Cross Organization VPC Peering Connections

Unused Elastic Block Store Volumes

Unassociated Elastic IP Addresses

EC2 Instances Vulnerable To SSRF Attack

EC2 Max Instances

Public SMTP

VPC Elastic IP Limit Breach

Unrestricted Network ACL Outbound Traffic

See more

Amazon Redshift

Redshift Parameter Group SSL Required

Redshift Encryption With Default KMS Key

Redshift Undesired Node Type

Redshift Cluster Audit Logging Disabled

Redshift Encryption Disabled

Redshift Cluster Not In VPC

Redshift Cluster Version Upgrade Disabled

Redshift Cluster Default Port

Redshift Cluster Default Master Username

Redshift Nodes Count Exceeded

Redshift User Activity Logging Enabled

Redshift Automated Snapshot Retention Period Not Set

Redshift Publicly Accessible

Redshift Cluster Encryption Key Missing

See more

Amazon EMR

AWS EMR Encryption In Transit Disabled

AWS EMR Cluster Logging Disabled

EMR Encryption At Rest Disabled

Amazon CloudFront

Insecure CloudFront Origin Protocol

CloudFront Logging Disabled

CloudFront Instance Takeover: Missing Origin S3 Bucket

CloudFront Not Using HTTPS

Public S3 CloudFront Origin

CloudFront Origin Uses Insecure Match-Viewer

Insecure CloudFront Distribution Protocols

CloudFront WAF Disabled

CloudFront Instance Takeover: Missing Origin Elastic Beanstalk Instance

CloudFront Origin Uses Insecure HTTP

See more

Amazon DynamoDB

DynamoDB Accelerator Cluster Encryption Not Enabled

DynamoDB Missing KMS Encryption

DynamoDB Continuous Backups

Amazon Managed Workflows for Apache Airflow (MWAA)

Environment Admin Privileges

Web Server Public Access

Amazon Route 53

Domain Transfer Lock Not Enabled

Public Subdomain Takeover: Missing Origin S3 Bucket

Private Subdomain Takeover: Missing Origin Elastic Beanstalk Instance

Domains About To Expire

Route 53 Expired Domain

Public Subdomain Takeover: Missing Origin IP Address

Domain Auto Renew Not Enabled

Private Subdomain Takeover: Missing Origin S3 Bucket

Public Subdomain Takeover: Missing Origin Elastic Beanstalk Instance

Private Subdomain Takeover: Missing Origin IP Address

Missing Valid Sender Policy Framework(SPF) Entry

See more

AWS Key Management Service (KMS)

App-Tier KMS Customer Master Key (CMK) Missing

KMS Key Policy Globally Accessible

AWS Unused KMS Key

KMS Key Rotation Disabled

Amazon CloudWatch

CloudWatch Monitoring Metrics Not Enabled For Region

Low CloudWatch Log Retention Period

Important CloudWatch Monitoring Metrics Missing

Amazon ElasticSearch

ElasticSearch Logging Disabled

ElasticSearch Domains Not Encrypted

ElasticSearch HTTPS Only Disabled

ElasticSearch Upgrade Available

ElasticSearch Node To Node Encryption Disabled

ElasticSearch Global Access

ElasticSearch Access From Unauthorized IP Addresses

ElasticSearch Domains Without VPC

See more

AWS Database Migration Service

DMS Public Replication Instance

DMS Instance Using Default KMS Key

DMS Encryption Using Non Existent KMS Key

DMS No Multi-AZ

AWS Config

Config Service Not Recording

Config Service Delivery Bucket Missing

Config Service Delivery Failing

Config Service Global Monitoring

Config Service Not Enabled

See more

AWS X-Ray

XRay Encryption Disabled

Amazon API Gateway

CloudWatch Logs Missing For API Gateway

API Gateway Certificate About to Expire

API Gateway Public Endpoints

API Gateway WAF Disabled

API Gateway Content-Encoding Disabled

API Gateway Certificate Expired

API Gateway Missing Detailed CloudWatch Metrics

API Gateway Tracing Disabled

API Gateway Missing Private Endpoints

Missing API Gateway Client Certificate

See more

Amazon Athena

Workgroup Configuration Not Enforced

Workgroups Not Encrypted

Amazon SageMaker

Notebook Instance Publicly Accessible

Notebook Encryption Disabled

AWS Elastic Load Balancing (ELB)

ELBv2 Minimum Number of EC2 Target Instances

ELB Without SSL Termination

Classic Load Balancers In Use

ELB Deregistration Delay Not Configured

ELB Without Security Policy

ELB Cross-Zone Load Balancing Disabled

Network Load Balancer With Insecure Listeners

ELB Deletion Protection Not Configured

ELB Logging Disabled

ELB WAF Disabled

ELB Non HTTPS Listeners

ELB Connection Draining Disabled

ELB Without Backbone Servers

See more

AWS Lambda

Lambda With Invalid IAM Roles

Lambda Function Public Access

Lambda Missing Log Groups

Lambda Old Runtimes

Lambda Admin Privileges

Lambda Tracing Disabled

Lambda Environment Variables In-Transit Encryption Missing

Lambda Without IAM Roles

Lambda Without VPC (Virtual Private Cloud)

See more

AWS Auto Scaling

Auto Scaling Groups ELB Health Check Inactive

Empty AutoScaling Groups

Auto Scaling Groups Not Referencing Active Load Balancers

AutoScaling ELB Same Availability Zone

App-Tier/ Web-Tier ASG Launch Configurations Using Unapproved AMIs

AutoScaling Groups With Suspended Processes

Auto Scaling Groups Multiple Availability Zones Not Enabled

Launch Configuration Referencing Inactive Security Groups

App-Tier/ Web-Tier Launch Configurations Without IAM Roles

Auto Scaling Notifications Not Active

App-Tier/Web-Tier Auto Scaling Group CloudWatch Logs Disabled

See more

Amazon GuardDuty

Amazon GuardDuty Disabled

Amazon GuardDuty Detector Suspended

Amazon GuardDuty Master Account Missing

Amazon Elastic File System (Amazon EFS)

EFS Encryption Using Default KMS Keys

EFS systems Referencing Deleted KMS Key

EFS Encryption Disabled

Amazon Elastic Container Registry (Amazon ECR)

ECR Repository Tag Immutability

AWS ECR Repository Policy - ECR Check Global Principal

AWS ECR Repository Policy - ECR Check Cross-Account Principal

AWS Glue

AWS Glue Job Bookmark Encryption Disabled

AWS Glue S3 Encryption Disabled

AWS Glue Data Catalog Encryption Disabled

AWS Glue CloudWatch Logs Not Encrypted

Amazon Simple Notification Service (SNS)

SNS Cross-Account Access

SNS Topic Global Policies

SNS Topic Not Encrypted

SNS Topic CMK Encryption

AWS Elastic Beanstalk

AWS ElasticBeanstalk Managed Platform Updates Not Configured

AWS CodeBuild

CodeBuild Blacklisted Source Providers

AWS Secrets Manager

Secrets Manager Weakly Encrypted Secrets

Secrets Manager Secret Rotation Disabled

Secrets Manager Small Rotation Window

AWS Transfer Family

Publicly accessible SFTP Server Endpoints

Transfer Logging Disabled

Amazon Access Analyzer

IAM Access Analyzer Disabled