Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Data Protection Best Practices
42 controls
25 services covered
Covers sensitive-data protection — Macie discovery, S3 public-access guardrails, KMS key health, Secrets Manager, encrypted SSM parameters, secrets in EC2 user data and CodeBuild, CloudTrail data events, and data-access IAM risks.
What we check
Secrets Manager Secrets5
- Secrets Manager or Encrypted SSM Parameters Present
- Secrets Manager Secrets Automatic Rotation is Enabled
- Secret Resource Policy Configured
- Secrets Manager Secrets Use Custom KMS Key
- Secrets Manager Secrets Are Rotated Per Schedule
Macie Organization Settings3
- Macie Auto-Enroll Accounts in the Organization
- Macie Findings are Aggregated to a Dedicated Account
- Macie Management is Delegated in the Organization
KMS Keys3
- Ensure that KMS Key Rotation is Enabled
- KMS Keys Not Pending Deletion
- Imported KMS Key Material Rotated Within 365 Days
IAM Policies3
- No IAM Principals with Unrestricted S3 Access
- No IAM Principals with Unrestricted S3 Read Access
- No IAM Principals with Access to Get All Secrets
IAM Identity Center Permission Sets3
- No SSO Permission Set with Unrestricted S3 Access
- No SSO Permission Set with Unrestricted S3 Read Access
- No SSO Permission Set with Access to Get All Secrets
Lake Formation Settings3
- Lake Formation IAM Allowed Principals Defaults Disabled
- Lake Formation Administrator Configured
- Lake Formation External Data Filtering Restricted
S3 Public Access Controls2
- S3 Block Public Access is Enabled (Account-Level)
- S3 general purpose buckets should block public access
Systems Manager Automation2
- SSM Parameters Are Encrypted
- SSM Automation should have CloudWatch logging enabled
CloudWatch Metric Filter Alarms2
- Ensure a log metric filter and alarm exist for S3 bucket policy changes
- Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs
Macie Settings1
- Amazon Macie Enabled
Macie Findings1
- Amazon Macie Active Findings
Macie S3 Bucket Monitoring1
- Amazon S3 Buckets Are Protected by Macie
S3 Encryption1
- S3 Bucket Key is Enabled
EMR Security Configurations1
- EMR Security Configuration Encryption at Rest Enabled
Auto Scaling Launch Configurations1
- Auto Scaling Launch Config User Data Has No Sensitive Data
CodeBuild Project Environments1
- CodeBuild Environment Variables Do Not Contain Secrets
CloudFormation Stacks1
- CloudFormation Stack Outputs Do Not Contain Secrets
CloudTrail S3 Log Buckets1
- CloudTrail S3 Bucket Not Publicly Accessible
EC2 User Data1
- EC2 instances user data should not have secrets
Clean Rooms ML1
- Clean Rooms ML Shared Error Summaries Redact PII
Elastic Beanstalk Environments1
- Elastic Beanstalk Environments Do Not Contain Plaintext Secrets
CodePipeline Pipelines1
- CodePipeline Commands Actions Do Not Contain Plaintext Secrets
EMR Serverless Applications1
- EMR Serverless Local Disks Use Customer Managed Keys
Audit Manager Settings1
- Audit Manager Assessment Report Destination KMS Encrypted
Lake Formation Data Locations1
- Lake Formation Registered Locations Use Custom Roles
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.