What's New

• Supported Versions & End-of-Life: 26 checks that flag engines, runtimes, and platforms past or nearing the end of standard support, across services such as RDS and Aurora, EKS, Lambda, OpenSearch, ElastiCache, MSK, and Amazon MQ.
• Threat Detection Coverage: 57 checks that verify GuardDuty protection plans, Inspector scanning, Macie, Security Hub, Amazon Detective, Shield Advanced, and Security Lake are enabled and cover your accounts and resources.

• Expanded AWS Coverage: 46 new assessment checks, including first-time coverage for 8 services: AWS Shield Advanced, AWS Firewall Manager, Amazon Security Lake, Amazon Detective, AWS Audit Manager, AWS Resilience Hub, AWS Lake Formation, and Amazon VPC Lattice.
• Threat Detection and DDoS Protection (10): Shield Advanced protection coverage, automatic application layer DDoS mitigation, proactive engagement, SRT access, and subscription auto-renewal, Detective member and organization coverage, and Security Lake source, retention, and encryption settings.
• Governance and Multi-Account (10): Firewall Manager policy compliance and remediation, AWS Config recording scope, delivery encryption and organization aggregation, Audit Manager evidence finder, tag policies, required resource tags, and Trusted Advisor support plan.
• Data and Access Control (9): Lake Formation permission defaults and administrators, IAM Access Analyzer unused and internal access analyzers, VPC Lattice IAM authentication, and Verified Access device trust.
• Encryption and PKI (8): Customer managed KMS key and TLS checks for Audit Manager, Elastic Disaster Recovery, Verified Access, and VPC Lattice, plus ACM Private CA revocation, key strength, and CRL bucket checks.
• Resilience and Disaster Recovery (5): Resilience Hub policies, scheduled assessments and drift notifications, and Elastic Disaster Recovery replication health and private replication connectivity.
• Logging and Patching (4): VPC Lattice and Verified Access access logging, plus Systems Manager patch baseline approvals and scheduled patch scans.
• Report Coverage: The new checks are included in the AWS best practice reports, such as Threat Detection Coverage, Encryption at Rest, Network, Identity and Access Management, Resiliency, and Organization Governance.

• Expanded AWS Coverage: 103 new and 10 updated assessment checks, including first-time coverage for 20 services such as Aurora DSQL, S3 Tables, S3 Vectors, AWS Parallel Computing Service, and Amazon Verified Permissions.
• Logging and Monitoring (30): Audit, execution, access, and data event logging checks for services including API Gateway, Elastic Load Balancing, S3, MSK, IoT Core, OpenSearch Serverless, Managed Service for Prometheus, and AWS Parallel Computing Service.
• Encryption and Certificates (28): Customer managed KMS key, TLS, and mTLS checks for services including S3 Tables, S3 Vectors, Managed Service for Apache Flink, Transcribe, Timestream for InfluxDB, and SES Mail Manager, plus EKS and Transfer Family certificate validity.
• Network, Access, and Configuration (20): Network Firewall and Route 53 threat protections, Client VPN route enforcement, IMDSv2, plaintext secret detection, token rotation, and workload configuration checks for services including Lambda, ECS, and Auto Scaling.
• Backup and Resilience (11): Checks that confirm resources such as Aurora DSQL clusters, Timestream for InfluxDB instances, and EBS volumes are protected by AWS Backup plans, Recycle Bin rules, or deletion protection, plus automatic recovery and health checks.
• Supported Versions (10): Checks that flag deprecated or end-of-life engines, runtimes, and platform versions, such as AWS IoT Greengrass V1.
• AI Security (9): Checks for Amazon Bedrock, Bedrock AgentCore, SageMaker, Clean Rooms ML, and related AI services, including GuardDuty AI Protection, PII redaction, and encryption settings.
• WAF and Edge (5): Checks for AWS WAF associations and CloudFront edge protections, including WAF coverage for AWS Amplify apps and origin access control for S3 and Lambda origins.

• New AWS Compliance Report: ISO/IEC 27001:2022 Annex A maps 222 AWS assessment checks to 34 organizational and technological controls, providing supporting evidence for your information security management system.
• Framework Selection: Select the 2022 revision when reviewing AWS assessments or assigning compliance frameworks to an environment. Both the 2013 and 2022 revisions are available.

Explore the ISO/IEC 27001:2022 AWS report

• Security Report CSV Exports: AWS, Azure, and GCP security and best practice reports can now be downloaded as CSV from the report view and the assessment export dialog, alongside the existing PDF. Each row includes the service area, resource, resource type, region, account, subscription, or project context, the check, and a pass or fail result.
• Remediation Plan CSV: The remediation plan download now offers CSV as well as PDF. The spreadsheet lists priority, category, service, title, region, account context, resource, and finding details.
• Azure Identity Risk Exports: The Azure Identity Risk view can be exported as a PDF or CSV covering users, authentication methods, risky users, risky service principals, and directory roles.