Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Encryption at Rest
85 controls
74 services covered
Checks encryption at rest across data stores, volumes, snapshots, and managed services — EC2/EBS, S3, RDS, DynamoDB, EFS, FSx, Redshift, OpenSearch, MSK, ElastiCache, Kinesis, ECR, SQS, SNS, SageMaker, Glue, Bedrock, Secrets Manager, and SSM parameters — with a focus on customer-managed keys.
What we check
Glue Dev Endpoints3
- Glue Dev Endpoint S3 Encryption
- Glue Dev Endpoint CloudWatch Encryption
- Glue Dev Endpoint Bookmark Encryption
Glue Jobs3
- Glue Job S3 Encryption
- Glue Job CloudWatch Encryption
- Glue Job Bookmark Encryption
EBS Volumes2
- EC2 Instances Encrypted Volumes
- EBS Volume Encryption
EC2 Instances2
- EC2 Default Encryption is Enabled
- EBS Snapshot Encryption
S3 Encryption2
- S3 Bucket Encryption
- Default KMS Encryption
Glue Data Catalog and Connections2
- Glue Data Catalog Connection Password Encryption Enabled
- Glue Catalog Metadata Encryption
WorkSpaces2
- Workspace User Volume Encryption
- Workspace Root Volume Encryption
Bedrock Custom Models2
- Bedrock Custom Model Import Uses Customer-Managed KMS Key with Required Key Policy
- Bedrock Custom Model Jobs Use Customer-Managed KMS Key
Audit Manager Settings2
- Audit Manager Customer Managed Key
- Audit Manager Assessment Report Destination KMS Encrypted
EC2 AMIs1
- EC2 AMI Encryption
RDS DB Instances1
- RDS Storage Encryption
RDS Snapshots1
- RDS Snapshot Encryption
Backup Recovery Points1
- Backup Recovery Points Encryption
OpenSearch Domains1
- OpenSearch Storage Encryption
CloudWatch Log Groups1
- CloudWatch Logs Encryption
CloudFront Field-Level Encryption1
- CloudFront Field-Level Encryption
ECR Repositories1
- ECR Repository Encryption
SQS Queues1
- SQS Queue Encryption
SNS Topics1
- SNS Topic Encryption
EKS Secrets1
- EKS Secret Encryption
Redshift Clusters1
- Redshift Storage Encryption
SageMaker Notebook Instances1
- SageMaker Instance Storage Encryption
SageMaker Training Jobs1
- SageMaker Job Volume Encryption
SageMaker Endpoints1
- SageMaker Endpoint Encryption
Glue ML Transforms1
- Glue ML Transform Encryption
API Gateway Stages1
- API Gateway Cache Encryption
DynamoDB Tables1
- DynamoDB Custom KMS Key Encryption
DynamoDB Accelerator (DAX) Clusters1
- DynamoDB Accelerator (DAX) Encryption
EFS File Systems1
- EFS Share Encryption
DocumentDB Clusters1
- DocumentDB Storage Encryption
FSx File Systems1
- FSx Storage Encryption
Neptune Clusters1
- Neptune Storage Encryption
Neptune Snapshots1
- Neptune Cluster Snapshot Encryption
MSK Clusters1
- MSK Custom KMS Key Encryption
ElastiCache Replication Groups1
- ElastiCache (Redis) Encryption At-Rest is Enabled
EMR Security Configurations1
- EMR Security Configuration Encryption at Rest Enabled
Kinesis Data Streams1
- Kinesis Data Stream Server-Side Encryption
CodeBuild Logs1
- CodeBuild S3 Logs Encryption
CodeBuild Artifacts1
- CodeBuild Project Artifact Encryption
CodeBuild Report Groups1
- CodeBuild Report Group Encryption
AppSync API Caches1
- AppSync API Cache Encryption
Athena Workgroups1
- Athena Workgroup Encryption
Secrets Manager Secrets1
- Secrets Manager Secrets Use Custom KMS Key
Systems Manager Automation1
- SSM Parameters Are Encrypted
ECS Clusters1
- ECS Cluster Encryption at Rest Enabled
Bedrock Guardrails1
- Bedrock Guardrails Encrypted with Customer-Managed KMS Key
Bedrock Model Evaluation Jobs1
- Bedrock Model Evaluation Jobs Use Customer-Managed KMS Key
Bedrock Agents1
- Agents for Amazon Bedrock Encrypted with Customer-Managed KMS Key
Bedrock Flows1
- Bedrock Flows Resources Encrypted with Customer-Managed KMS Key
Bedrock Knowledge Bases1
- Bedrock Knowledge Bases Resources Encrypted with Customer-Managed KMS Key
Data Firehose Delivery Streams1
- Firehose delivery streams should be encrypted at rest
Bedrock Data Automation Projects1
- Bedrock Data Automation Projects Use Customer Managed Keys
Backup Vaults1
- Backup Air-Gapped Vaults Use Customer Managed Keys
Lambda Functions1
- Lambda Durable Functions Use Customer Managed Keys
EventBridge Archives1
- EventBridge Archives Use Customer Managed Keys
EventBridge Event Buses1
- Custom EventBridge Buses Use Customer Managed Keys
EventBridge Connections1
- EventBridge Connections Use Customer Managed Keys
Managed Service for Apache Flink Applications1
- Flink Applications Use Customer Managed Keys
Cognito User Pools1
- Cognito User Pools Use Customer Managed Keys
Aurora DSQL Clusters1
- Aurora DSQL Clusters Use Usable Customer Managed Keys
EMR Serverless Applications1
- EMR Serverless Local Disks Use Customer Managed Keys
OpenSearch UI Applications1
- OpenSearch UI Applications Use Customer Managed Keys
Amazon Quick Suite1
- Quick Research Account Default Key Is Customer Managed and Enabled
S3 Vector Buckets1
- S3 Vector Buckets Use SSE-KMS
S3 Table Buckets1
- S3 Table Buckets Use Customer Managed Keys
SageMaker HyperPod Clusters1
- HyperPod EBS Volumes Use Customer Managed Keys
SageMaker MLflow1
- SageMaker MLflow Apps Use Customer Managed Keys
IAM Identity Center Instances1
- IAM Identity Center Organization Instance Uses Customer Managed Encryption
Timestream for InfluxDB1
- Timestream for InfluxDB Uses Customer Managed Keys
Transcribe Custom Resources1
- Transcribe Custom Resources Use Customer Managed Keys
Security Lake Data Lakes1
- Security Lake Data Lake Customer Managed Key
Verified Access1
- Verified Access groups and endpoints use customer managed encryption
AWS Config Settings1
- Config delivery channels specify KMS encryption
Elastic Disaster Recovery1
- DRS replication EBS encryption uses a customer managed key
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.