default.yml

Networking:
  testSshNotOpenFromInternet: True
  testRdpNotOpenFromInternet: True
  testPortsOpenFromTheInternet: True
  testDefaultSecurityGroupsNotOpenFromInternet: True
  testMainRouteTableIsPrivate: True

Iam:
  testRootAccountLoginIsAvoided: True
  testMfaEnabledForConsoleUsers: True
  testUnusedCredentialsAreDeactivated: True
  testAccessKeysAreRotated: True
  testPasswordPolicyRequiresUpperCaseLetters: True
  testPasswordPolicyRequiresLowerCaseLetters: True
  testPasswordPolicyRequiresNumbers: True
  testPasswordPolicyRequiresSymbols: True
  testPasswordPolicyRequiresMinimumLength: True
  testPasswordPolicyPreventsPasswordReuse: True
  testPasswordPolicyEnsuresPasswordExpiry: True
  testRootAccountHasNoActiveAccessKeys: True
  testPoliciesAreNotAttachedToUsers: True

Logging:
  testCloudtrailEnabledForAllRegions: True
  testCloudTrialsLogsAreIntegratedWithCloudWatch: True
  testCloudTrailLogsS3BucketIsNotPublic: True
  testCloudTrailLogsS3BucketHasAccessLoggingEnabled: True
  testCloudTrailValidationIsEnabled: True
  testCloudTrailLogsAreEncrypted: True
  testCustomerCreatedCMKKeysAreRotationEnabled: True

Monitoring:
  testMetricFilterAndAlarmExistForUnauthorizedApiCalls: True
  testMetricFilterAndAlarmExistForLoginWithoutMfa: True
  testMetricFilterAndAlarmExistForRootLogin: True
  testMetricFilterAndAlarmExistForIamPolicyChanges: True
  testMetricFilterAndAlarmExistForCloudtrailConfigChanges: True
  testMetricFilterAndAlarmExistForS3PolicyChanges: True
  testMetricFilterAndAlarmExistForNetworkGatewayChanges: True
  testMetricFilterAndAlarmExistForRouteTableChanges: True
  testMetricFilterAndAlarmExistForVpcChanges: True
  testSNSTopicsHaveAppropriateSubscribers: True
  testMetricFilterAndAlarmExistForSecurityGroupChanges: True
  testMetricFilterAndAlarmExistForNetworkAclChanges: True
  testMetricFilterAndAlarmExistForConsoleAuthFailure: True