Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Network Best Practices
71 controls
23 services covered
Covers network segmentation and edge controls — VPC design, subnets, endpoints, peering and VPN, security groups and network ACLs, EC2 exposure, Route 53 DNS, Network Firewall, and VPC Block Public Access.
What we check
EC2 Security Groups20
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Cassandra Ports (7199, 9160 or 8888)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to CIFS Ports (TCP 445)
- No Security Group Rules Allowing Insecure Ports (Ingress)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Memcached Ports (11211)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to MongoDB Ports (27017 or 27018)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to MySQL DB Ports (3306)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Oracle DB Ports (1521 or 2483)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Postgres DB Ports (5432)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Redis Ports (6379)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22)
- Default Security Group No Rules
- VPC security groups should restrict uses of 'launch-wizard' security groups
- VPC security groups should restrict ingress CIFS access from 0.0.0.0/0 and ::/0
- VPC security groups should restrict ingress access on ports 20, 21, 22, 3306, 3389, 4333 from 0.0.0.0/0
- VPC security groups should restrict ingress Kafka port access from 0.0.0.0/0
- VPC security groups should restrict ingress kibana port access from 0.0.0.0/0
- VPC security groups should restrict ingress redis access from 0.0.0.0/0
- VPC security groups should restrict ingress TCP and UDP access from 0.0.0.0/0
VPC Endpoints8
- VPC Configured to Use VPC Endpoints (PrivateLink)
- Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
- VPCs should be configured with an interface endpoint for ECR API
- VPCs should be configured with an interface endpoint for Docker Registry
- VPCs should be configured with an interface endpoint for Systems Manager
- VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts
- VPCs should be configured with an interface endpoint for Systems Manager Incident Manager
- VPC endpoint services should have acceptance required enabled
VPCs5
- Default VPC is Deleted
- VPC Protected by AWS Network Firewall
- Multi-Layered VPC Check
- VPCs Exist in More Than One Region
- VPC Encryption Controls Enabled
CloudWatch Metric Filter Alarms5
- Ensure a log metric filter and alarm exist for changes to Network Access Control Lists
- Ensure a log metric filter and alarm exist for changes to network gateways
- Ensure a log metric filter and alarm exist for route table changes
- Ensure a log metric filter and alarm exist for security group changes
- Ensure a log metric filter and alarm exist for VPC changes
Site-to-Site VPN Connections4
- EC2 VPN connections should have logging enabled
- EC2 VPN connections should use IKEv2 protocol
- Site-to-Site VPN Tunnels Publish BGP Logs
- Backup VPN Connection Configured
VPC Route Tables3
- VPC Peering Routing Tables Are "Least Access"
- VPC Route Tables Restrict Public Access to IGW
- VPC DNS Logging (Route53)
Network Firewall Firewalls3
- Network Firewall Logging Enabled Check
- Network Firewall Multi-AZ Deployment Check
- Network Firewall Subnet Change Protection is Enabled
Network Firewall Policies3
- Network Firewall Uses Active Threat Defense
- Network Firewall Fails Closed on Stream Exceptions
- Network Firewall Holds TLS Sessions for Inspection
EC2 Transit Gateways2
- EC2 Transit Gateway Auto Cross-Account Attachment Disabled
- EC2 Transit Gateway Auto VPC Attach is Disabled
Route 53 DNS Firewall2
- VPC protected by Route53 DNS Firewall
- DNS Firewall Advanced Detects Dictionary DGA
VPC Lattice Service Networks2
- VPC Lattice service networks require IAM authentication
- VPC Lattice service networks have access log subscriptions
VPC Lattice Services2
- VPC Lattice services require IAM authentication
- VPC Lattice service listeners use HTTPS or TLS passthrough
Verified Access2
- Verified Access instances publish access logs
- Verified Access requires device trust and enabled group policies
Network ACLs1
- No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0)
Internet Gateways1
- VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs)
VPC Flow Logs1
- VPC Flow Logs are Forwarded to CloudWatch Logs
VPC Peering Connections1
- Avoid Many-to-Many VPC Peering Topologies
VPC Block Public Access1
- EC2 VPC Block Public Access settings should block internet gateway traffic
VPC Subnets1
- Auto Assign Public IP is Disabled for Subnets
Client VPN Endpoints1
- Client VPN Enforces Client Routes
VPC Route Servers1
- VPC Route Server Session Log Delivery Configured
Firewall Manager Policies1
- Firewall Manager Policies Compliant
Elastic Disaster Recovery1
- DRS replication servers use private connectivity
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.