Elenco di AWS Config Regole gestite per tipo di trigger

• etichettato con acmpca-certificate-authority

• acm-certificate-rsa-check

• abilitato alla registrazione trasparente del certificato acm

• versione supportata da active-mq

• alb-desync-mode-check

• alb-http-drop-invalid-header-enabled

• alb-scheme-check interno

• etichettato con alb-listener

• etichettato con alb-tag

• alb-waf-enabled

• abilitato all'eliminazione automatica di amplify-app-branch-

• amplify-app-build-spec-configurato

• descrizione dell'app amplify

• amplify-app-no-variabili d'ambiente

• amplify-app-platform-check

• con tag amplify-app

• abilitato alla compilazione automatica di amplify-branch-

• amplify-branch-build-spec-configurato

• amplify-branch-description

• amplify-branch-framework-configurato

• abilitato alla modalità amplify-branch-performance

• abilitato all'anteprima di amplify-branch-pull-request-preview

• con tag amplify-branch

• apigatewayv2-integration-private-https-enabled

• descrizione di apigateway v2-stage

• apigateway-nome-dominio-tls-check

• apigateway-stage-acces-log-abilitato

• apigateway-stage-descrizione

• api-gwv2-access-logs-enabled

• abilitato per api-gwv2-stage-default-route-dettagliate-metriche

• api-gw-associated-with-waf

• api-gw-cache-enabled-and-encrypted

• api-gw-endpoint-type-check

• api-gw-execution-logging-enabled

• api-gw-rest-api-taggato

• api-gw-ssl-enabled

• etichettato con api-gw-stage

• api-gw-xray-enabled

• appconfig-descrizione dell'applicazione

• appconfig-application-taggato

• appconfig-configuration-profile-taggato

• appconfig-configuration-profile-validators-non-empty

• descrizione della strategia di installazione di appconfig-deployment

• appconfig-deployment-strategy-minimum-final-bake-time

• appconfig-deployment-strategy si replica su ssm

• appconfig-deployment-strategy con tag

• appconfig-environment-description

• appconfig-environment-tagged

• appconfig-extension-association-tagged

• appconfig-freeform-profile-config-storage

• descrizione della versione di configurazione ospitata da appconfig-hosted

• etichettato con appflow-flow

• appflow-flow-trigger-type-check

• appintegrations-application-approved-origins-check

• appintegrations-application-taggato

• appintegrations-event-integrations-description

• appintegrations-event-integration con tag

• appmesh-gateway-route-taggato

• appmesh-deny-tcp-forwarding

• appmesh-mesh-ip-pref-check

• con tag appmesh

• appmesh-route-tagged

• appmesh-virtual-gateway-backend-defaults-tls

• appmesh-virtual-gateway-listeners-health-check-abilitato

• appmesh-virtual-gateway-logging-file-path-esiste

• contrassegnati da appmesh-virtual-gateway

• appmesh-virtual-node-backend-defaults-tls-on

• appmesh-virtual-node-cloud-map-ip-pref-check

• appmesh-virtual-node-dns-ip-pref-check

• abilitato per appmesh-virtual-node-listeners-health-check

• abilitato per appmesh-virtual-node-listeners-outlier-detect

• appmesh-virtual-node-logging-file-path-esiste

• appmesh-virtual-node-service-backends-tls-enforced

• contrassegnati da appmesh-virtual-node

• contrassegnato da appmesh-virtual-router

• appmesh-virtual-service-taggato

• approved-amis-by-id

• approved-amis-by-tag

• apprunner-service-in-vpc

• apprunner-service-controllo-tipo-indirizzo-IP

• apprunner-service-max-unhealthy-threshold

• apprunner-service-senza accesso pubblico

• apprunner-service abilitato all'osservabilità

• apprunner-service taggato

• apprunner-vpc-connector-taggato

• appstream-fleet-in-vpc

• appsync-authorization-check

• appsync-cache-ct-encryption-a riposo

• appsync-cache-ct-crittografia-in transito

• abilitato per appsync-graphql-api-xray

• appsync-logging-enabled

• con tag aps-rule-groups-namespace

• athena-data-catalog-description

• descrizione della dichiarazione preparata da athena

• athena-workgroup-descrizione

• athena-workgroup-encrypted-at-rest

• configurazione athena-workgroup-enforce-workgroup-workgroup-

• aggiornamento automatico della versione del motore di lavoro di athena

• abilitato alla registrazione di athena-workgroup-

• etichettati con auditmanager per la valutazione

• cifratura globale del database aurora a riposo

• aurora-mysql-backtracking-enabled

• autoscaling-capacity-rebalancing

• autoscaling-group-elb-healthcheck-required

• autoscaling-launchconfig-requires-imdsv2

• autoscaling-launch-config-hop-limit

• autoscaling-launch-config-public-ip-disabled

• autoscaling-launch-template

• autoscaling-multiple-az

• autoscaling-multiple-instance-types

• backup-plan-min-frequency-and-min-retention-check

• backup-recovery-point-encrypted

• backup-recovery-point-manual-deletion-disabled

• backup-recovery-point-minimum-retention-check

• abilitato per l'ambiente di elaborazione in batch

• gestito dall'ambiente di calcolo in batch

• etichettati nell'ambiente di calcolo in batch

• abilitato per batch-job-quue

• etichettato con batch-job-quue

• ambiente di calcolo gestito in batch che utilizza un modello di avvio

• controllo della strategia di allocazione e calcolo gestito in batch

• etichettato con compute-env-compute-resources-gestita in batch

• ambiente-compute-spot-compute-max-bid gestito in batch

• etichettato con la politica di pianificazione in batch

• beanstalk-enhanced-health-reporting-enabled

• bedrockagentcore-gateway-authorizer abilitato

• bedrockagentcore-runtime-private-network-richiesto

• bedrock-agentcore-memory abilitato alla crittografia

• etichettato con cassandra-keyspace

• clb-desync-mode-check

• clb-multiple-az

• cloudformation-stack-notification-check

• cloudformation-stack-service-role-check

• cloudformation-termination-protection-check

• cloudfront-accesslogs-enabled

• cloudfront-associated-with-waf

• cloudfront-custom-ssl-certificate

• cloudfront-default-root-object-configured

• abilitato al gruppo di chiavi di distribuzione cloudfront

• cloudfront-no-deprecated-ssl-protocols

• cloudfront-origin-access-identity-enabled

• cloudfront-origin-failover-enabled

• abilitato per cloudfront-origin-lambda-url-oac

• cloudfront-s3-origin-access-control-enabled

• cloudfront-security-policy-check

• cloudfront-sni-enabled

• cloudfront-ssl-policy-check

• cloudfront-traffic-to-origin-encrypted

• cloudfront-viewer-policy-https

• cloudtrail-event-data-store-multiregione

• cloudwatch-alarm-action-check

• cloudwatch-alarm-action-enabled-check

• cloudwatch-alarm-descrizione

• cloudwatch-alarm-settings-check

• taggato con cloudwatch-metric-stream

• codeartifact-repository con tag

• codebuild-project-artifact-encryption

• codebuild-project-environment-privileged-check

• codebuild-project-envvar-awscred-check

• codebuild-project-logging-enabled

• codebuild-project-s3-logs-encrypted

• codebuild-project-source-repo-url-check

• codificato dal progetto codebuild

• codebuild-report-group-crittografato a riposo

• codificati dal gruppo codebuild-report-group

• codedeploy-auto-rollback-monitor-enabled

• codedeploy-deployment-group-abilitato al rollback automatico

• codedeploy-deployment-group-outdated-instances-update

• codedeploy-ec2-minimum-healthy-hosts-configured

• codedeploy-lambda-allatonce-traffic-shift-disabled

• codeguruprofiler-profiling-group-taggato

• codegurureviewer-repository-association-taggato

• codepipeline-deployment-count-check

• codepipeline-region-fanout-check

• accessi non autenticati a cognito-identity-pool

• cognito-identity-pool-unauth-access-check

• cognito-userpool-cust-auth-threat-controllo-completo

• abilitato alla sicurezza avanzata di cognito-userpool

• abilitato alla protezione dalla cancellazione di cognito-userpool

• abilitato per cognito-userpool-mfa

• controllo della politica delle password di cognito-userpool

• taggato da cognito-userpool

• connect-instance-logging abilitato

• profili dei clienti - con tag di dominio

• customerprofiles-object-type-allow-profile-creation

• profili-clienti-object-type-taggati

• custom-eventbus-policy-attached

• datasync-location-object-storage-using-https

• datasync-task-abilitato alla verifica dei dati

• datasync-task-logging abilitato

• datasync-task-taggato

• db-instance-backup-enabled

• desired-instance-tenancy

• desired-instance-type

• devicefarm-instance-profile-taggato

• contrassegnati dal progetto devicefarm

• etichettati dal progetto devicefarm-test-grid

• dms-auto-minor-version-upgrade-check

• dms-endpoint-ssl-configured

• contrassegnati da dms endpoint

• abilitato all'autenticazione dms-mongo-db

• dms-neptune-sono abilitato all'autorizzazione

• abilitato a dms-redis-tls

• abilitato per dms-replication-instance-multi-az

• dms-replication-task-sourcedb-logging

• con tag dms-replication-task

• dms-replication-task-targetdb-logging

• docdb-cluster-audit-logging-enabled

• docdb-cluster-backup-retention-check

• docdb-cluster-deletion-protection-enabled

• docdb-cluster-encrypted

• docdb-cluster-snapshot-public-prohibited

• dynamodb-pitr-enabled

• dynamodb-table-deletion-protection-enabled

• dynamodb-table-encrypted-kms

• dynamodb-table-encryption-enabled

• ebs-optimized-instance

• ebs-snapshot-block-accesso pubblico

• etichettato con ec2-capacity-reservation

• etichettato con ec2-carrier-gateway

• ec2-client-vpn-connection-log-enabled

• contrassegnato da ec2-client-vpn-endpoint

• con tag ec2-dhcp-options

• ec2-enis è abilitato al controllo della destinazione del codice sorgente

• etichettato con ec2-fleet

• ec2-imdsv2-check

• ec2-instance-detailed-monitoring-enabled

• ec2-instance-managed-by-ssm

• ec2-instance-multiple-eni-check

• ec2-instance-no-public-ip

• ec2-instance-profile-attached

• etichettato con ec2-ipamscope

• ec2-launchtemplate-ebs-encrypted

• ec2-launch-templates-ebs-volume-criptato

• ec2-launch-template-imdsv2-check

• ec2-launch-template-public-ip-disabled

• modello con tag ec2-launch

• ec2-managedinstance-applications-blacklisted

• ec2-managedinstance-applications-required

• ec2-managedinstance-association-compliance-status-check

• ec2-managedinstance-inventory-blacklisted

• ec2-managedinstance-patch-compliance-status-check

• ec2-managedinstance-platform-check

• etichettato con ec2-network-insights-access-scope-analysis

• etichettato con ec2-network-insights-access-scope

• etichettato con ec2-network-insights-analysis

• ec2-network-insights-path-taggato

• ec2-no-amazon-key-pair

• ec2-paravirtual-instance-check

• etichettato con ec2-prefix-list

• ec2-security-group-attached-to-eni

• ec2-spot-fleet-request-ct-encryption-a riposo

• ec2-token-hop-limit-check

• descrizione del filtro ec2-traffic-mirror

• contrassegnato da ec2-traffic-mirror con filtro

• descrizione della sessione di ec2-traffic-mirror

• contrassegnato dalla sessione di ec2-traffic-mirror

• ec2-traffic-mirror-target-descrizione

• contrassegnato con ec2-traffic-mirror

• ec2-transit-gateway-auto-vpc-attach-disabled

• ec2-transit-gateway-multicast-contrassegnato con dominio

• ec2-volume-inuse-check

• controllo della versione simile a ec2-vpn

• abilitata alla registrazione della connessione ec2-vpn

• contrassegnati con connessione ec2-vpn

• ecr-private-lifecycle-policy-configured

• ecr-private-tag-immutability-enabled

• abilitato alla crittografia ecr-repository-cmk

• contrassegnato da ecr-repository

• ecs-awsvpc-networking-enabled

• contrassegnato da ecs-capacity-provider

• ecs-capacity-provider-controllo della terminazione

• ecs-containers-nonprivileged

• ecs-containers-readonly-access

• ecs-container-insights-enabled

• ecs-fargate-latest-platform-version

• ecs-no-environment-secrets

• abilitato per i tag di propagazione di ecs

• abilitato per ecs-task-definition-efs-encryption

• ecs-task-definition-linux-user-non-root

• ecs-task-definition-log-configuration

• ecs-task-definition-memory-hard-limit

• ecs-task-definition-modalità-network-non-host

• ecs-task-definition-nonroot-user

• ecs-task-definition-pid-mode-check

• ecs-task-definition-user-for-host-mode-check

• ecs-task-definizione-windows-utente-non-amministratore

• efs-access-point-enforce-root-directory

• efs-access-point-enforce-user-identity

• abilitato per i backup automatici

• efs-filesystem-ct-criptato

• con tag efs-file-system

• eip-attached

• con tag eks-addon

• eks-cluster-log-enabled

• eks-cluster-oldest-supported-version

• eks-cluster-supported-version

• taggato con il profilo eks-fargate

• controllo della versione supportata da eks-nodegroup

• elasticbeanstalk-descrizione dell'applicazione

• elasticbeanstalk-application-version-descrizione

• elasticbeanstalk - descrizione dell'ambiente

• elasticsearch-logs-to-cloudwatch

• elasticsearch-node-to-node-encryption-check

• elastic-beanstalk-logs-to-cloudwatch

• elastic-beanstalk-managed-updates-enabled

• elbv2-listener-crittografia-in transito

• elbv2-multiple-az

• elbv2-policy-sicurezza-predefinita-ssl-check

• protocollo elbv2-targetgroup-healthcheck crittografato

• protocollo elbv2 targetgroup crittografato

• elb-acm-certificate-required

• elb-cross-zone-load-balancing-enabled

• elb-custom-security-policy-ssl-check

• elb-deletion-protection-enabled

• elb-internal-scheme-check

• elb-logging-enabled

• elb-predefined-security-policy-ssl-check

• etichettato con elb

• elb-tls-https-listeners-only

• emr-security-configuration-encryption-rest

• emr-security-configurazione-crittografia-transito

• encrypted-volumes

• eventschemas-discoverer etichettati

• eventschemas-taggato nel registro

• evidentemente - descrizione del lancio

• evidentemente etichettato come lancio

• evidentemente - descrizione del progetto

• evidentemente etichettato come progetto

• evidentemente - descrizione del segmento

• evidentemente etichettato per segmenti

• fis-experiment-template-log-configuration-esiste

• etichettato con fis-experiment-template

• fms-shield-resource-policy-check

• fms-webacl-resource-policy-check

• fms-webacl-rulegroup-association-check

• frauddetector-entity-type-taggato

• frauddetector - etichettato

• frauddetector-outcome-taggato

• frauddetector - con etichetta variabile

• etichettato da glb-listener

• etichettato con glb

• global-endpoint-event-replication-enabled

• abilitato alla registrazione di glue-job

• glue-ml-transform-crittografato a riposo

• etichettato con glue-ml-transformation

• versione supportata da glue-spark-job

• taggato con groundstation-config

• groundstation-dataflowendpointgroup-taggato

• groundstation-missionprofile con tag

• etichettato con healthlake-fjir datastore

• iam-customer-policy-blocked-kms-actions

• iam-group-has-users-check

• iam-inline-policy-blocked-kms-actions

• iam-no-inline-policy-check

• iam-oidc-provider-client-id-list-check

• sono contrassegnato da un provider oidc

• iam-policy-blacklisted-check

• iam-policy-description

• iam-policy-no-statements-with-admin-access

• iam-policy-no-statements-with-full-access

• iam-role-managed-policy-check

• sono etichettato con saml-provider

• sono etichettato con certificato del server

• iam-user-group-membership-check

• iam-user-no-policies-check

• imagebuilder-distributionconfiguration-tagged

• imagebuilder-imagepipeline-taggato

• imagebuilder-imagerecipe-ebs-volumes-criptato

• imagebuilder-imagerecipe-taggato

• imagebuilder-infrastructureconfiguration - taggato

• instances-in-vpc

• internet-gateway-authorized-vpc-only

• iotdevicedefender con tag metrici personalizzati

• modello iotevents-alarm-taggato

• iotevents-detector-model-taggato

• iotevents-input - etichettato

• iotsitewise-asset-model-taggato

• contrassegnato da iotsitewise con dashboard

• etichettato con iotsitewise come gateway

• etichettato con iotsitewise come portale

• etichettato come progetto iotsitewise

• iottwinmaker-component-tipo-taggato

• etichettato con entità iottwinmaker-entity

• contrassegnato da iottwinmaker-scene

• iottwinmaker-sync-job-taggato

• con tag iottwinmaker-workspace

• iotwireless-fuota-task-taggato

• iotwireless-multicast-group-taggato

• iotwireless-service-taggato

• abilitato alla firma tramite token di autorizzazione IoT

• modello con tag iot-job

• descrizione del modello di iot-provisioning

• modello-iot-provisioning jitp

• modello di provisioning con tag iot-

• iot-scheduled-audit-taggato

• abilitata all'autorizzazione alla riproduzione ivs-channel

• con tag ivs

• con coppia di tasti ivs-playback-tag

• con tag ivs-recording-configuration

• contrassegnato con kendra index

• kines è etichettato come canale di segnalazione video

• kinesisvideo-stream è etichettato

• kinesis-stream-backup-retention-check

• kinesis-stream-encrypted

• kinesis-video-stream-conservazione minima dei dati

• kms-key-policy-no-accesso-pubblico

• contrassegnati con kms con chiave

• lambda-concurrency-check

• lambda-dlq-check

• controllo del livello di registro dell'applicazione lambda

• descrizione della funzione lambda

• funzione-lambda-log-format-json

• lambda-function-public-access-prohibited

• lambda-function-settings-check

• funzione-lambda-system-log-level-check

• abilitato alla funzione lambda x

• lambda-inside-vpc

• lambda-vpc-multi-az-check

• lightsail-bucket-allow-public-overrides-disabilitato

• abilitato al controllo delle versioni degli oggetti con lightsail-bucket

• etichettato con lightsail-bucket

• etichettato con certificato lightsail

• etichettato con lightsail-disk

• mediapackage-packagingconfiguration-tagged

• mediatailor-playbackconfiguration-tagged

• memorydb-subnetgroup-taggato

• autenticazione mq-active-broker-ldap

• mq-active-deployment-mode

• mq-active-single-instance-broker-storage-type-efs

• mq-auto-minor-version-upgrade-enabled

• mq-broker-abilitato alla registrazione generale

• mq-cloudwatch-audit-log-abilitato

• mq-rabbit-deployment-mode

• msk-cluster-accesso pubblico disabilitato

• con tag msk-cluster

• abilitato alla registrazione di msk-connect-connector

• msk-enhanced-monitoring-enabled

• msk-in-cluster-node-require-tls

• msk-unrestricted-access-check

• nacl-no-unrestricted-ssh-rdp

• neptune-cluster-backup-retention-check

• neptune-cluster-cloudwatch-log-export-enabled

• neptune-cluster-copy-tags-to-snapshot-enabled

• neptune-cluster-deletion-protection-enabled

• neptune-cluster-encrypted

• neptune-cluster-iam-database-authentication

• neptune-cluster-multi-az-enabled

• neptune-cluster-snapshot-encrypted

• neptune-cluster-snapshot-sono abilitato all'autenticazione al database

• neptune-cluster-snapshot-public-prohibited

• netfw-deletion-protection-enabled

• netfw-multi-az-enabled

• netfw-policy-default-action-fragment-packets

• netfw-policy-default-action-full-packets

• netfw-policy-rule-group-associated

• netfw-stateless-rule-group-not-empty

• abilitato alla protezione netfw-subnet-change

• nlb-cross-zone-load-balancing-enabled

• controllo interno dello schema nlb-

• etichettato con nlb-listener

• etichettato con nlb

• opensearchserverless-collection-description

• opensearchserverless-collection-standby abilitato per le repliche

• opensearch-access-control-enabled

• opensearch-audit-logging-enabled

• opensearch-data-node-fault-tolerance

• opensearch-encrypted-at-rest

• opensearch-https-required

• opensearch-in-vpc-only

• opensearch-logs-to-cloudwatch

• opensearch-node-to-node-encryption-check

• opensearch-primary-node-fault-tolerance

• opensearch-update-check

• pacchetto panorama-taggato

• versione supportata da rabbit-mq

• rds-aurora-mysql-audit-logging-enabled

• rds-aurora-postgresql-logs-sucloudwatch

• rds-automatic-minor-version-upgrade-enabled

• rds-cluster-auto-minor-version-upgrade-enable

• rds-cluster-backup-retention-check

• rds-cluster-default-admin-check

• rds-cluster-deletion-protection-enabled

• rds-cluster-encrypted-at-rest

• rds-cluster-iam-authentication-enabled

• rds-cluster-multi-az-enabled

• rds-db-security-group-not-allowed

• rds-enhanced-monitoring-enabled

• tag rds-event-subscription

• versione supportata da rds-global-cluster-aurora-mysql

• rds-instance-default-admin-check

• rds-instance-deletion-protection-enabled

• rds-instance-iam-authentication-enabled

• rds-instance-public-access-check

• rds-logging-enabled

• rds-multi-az-support

• rds-mysql-cluster-copy-tags-susnapshot-check

• tag rds-option-group-tags

• rds-pgsql-cluster-copy-tags-to-snapshot-check

• rds-postgresql-logs-sucloudwatch

• rds-snapshots-public-prohibited

• rds-snapshot-encrypted

• rds-sql-server-logs-sucloudwatch

• rds-storage-encrypted

• redshift-audit-logging-enabled

• redshift-backup-enabled

• redshift-cluster-configuration-check

• redshift-cluster-kms-enabled

• redshift-cluster-maintenancesettings-check

• abilitato per redshift-cluster-multi-az

• redshift-cluster-parameter-group-taggato

• redshift-cluster-public-access-check

• redshift-cluster-subnet-group-multi-az

• redshift-default-admin-check

• redshift-default-db-name-check

• redshift-enhanced-vpc-routing-enabled

• redshift-require-tls-ssl

• required-tags

• con tag resiliencehub-app

• resiliencehub-resiliencypolicy-taggato

• route53 - Health-Check-Tagged

• route53-hosted-zone-taggato

• route53-query-logging-enabled

• route53-recovery-control-cluster-tagged

• route53-recovery-readiness-taggato con cella

• route53-recovery-readiness-readiness-check-taggato

• route53-recovery-readiness-recovery-group-taggato

• route53-recovery-readiness-resource-set-taggato

• route53-resolver-firewall-domain-list-taggato

• route53-resolver-firewall-rule-group-association-taggato

• route53-resolver-firewall-rule-group-taggato

• route53-resolver-resolver-etichettato con endpoint

• route53-resolver-resolver-taggato con una regola

• abilitato per rum-app-monitor-cloudwatch-logs

• rum-app-monitor-taggato

• s3express-dir-bucket-lifecycle-regole-check

• s3-access-point-in-vpc-only

• s3-access-point-public-access-blocks

• s3-account-level-public-access-blocks

• s3-bucket-acl-prohibited

• s3-bucket-blacklisted-actions-prohibited

• abilitato per la replica tra più regioni con s3-bucket

• s3-bucket-default-lock-enabled

• s3-bucket-level-public-access-prohibited

• s3-bucket-logging-enabled

• s3-bucket-mfa-delete-enabled

• s3-bucket-policy-grantee-check

• s3-bucket-policy-not-more-permissive

• s3-bucket-replication-enabled

• s3-bucket-server-side-encryption-enabled

• s3-bucket-ssl-requests-only

• con tag s3 bucket

• s3-bucket-versioning-enabled

• s3-default-encryption-kms

• s3-directory-bucket-lifecycle-policy-rule-check

• s3-event-notifications-enabled

• s3-lifecycle-policy-check

• s3-version-lifecycle-policy-check

• taggato con sagemaker-app-image-config

• sagemaker-data-quality-job-encrypt-in-transit

• sagemaker-data-quality-job-isolation

• dominio sagemaker in vpc

• etichettato con dominio sagemaker

• descrizione del gruppo di funzionalità sagemaker

• sagemaker-featuregroup-encryption-at-rest

• crittografia sagemaker-featuregroup-online-store-

• taggato da sagemaker-feature-group

• descrizione dell'immagine di sagemaker

• taggato con immagine da sagemaker

• sagemaker-inferenceexperiment-taggato

• sagemaker-model-bias-job-encrypt-in-transit

• isolamento sagemaker-model-bias-job-

• sagemaker-model-explainability-job-encrypt-in-transit

• modello sagemaker in vpc

• abilitato all'isolamento del modello sagemaker

• sagemaker-model-multicontainer-registro privato

• sagemaker-model-private-registry-obbligatorio

• sagemaker-model-quality-job-encrypt-in-transit

• sagemaker-monitoring-schedule-isolation

• sagemaker-notebook-instance-inside-vpc

• sagemaker-notebook-instance-root-access-check

• secretsmanager-rotation-enabled-check

• secretsmanager-scheduled-rotation-success-check

• secretsmanager-using-cmk

• taggato con il catalogo dei servizi

• catalogo-di servizi condiviso all'interno dell'organizzazione

• ses-sending-tls-required

• profilo di firma del firmatario con tag

• sns-encrypted-kms

• sns-topic-message-delivery-notification-enabled

• sns-topic-no-accesso pubblico

• sqs-queue-dlq-check

• sqs-queue-no-accesso-pubblico

• sqs-queue-policy-access-check

• documento con tag ssm

• stepfunctions-state-machine-taggato

• step-functions-state-machine-logging-enabled

• subnet-auto-assign-public-ip-disabled

• descrizione del contratto di trasferimento

• contratto di trasferimento contrassegnato

• descrizione del certificato di trasferimento

• certificato di trasferimento etichettato

• transfer-connector-as2-encryption-check

• transfer-connector-as2-mdn-signing-algorithm-check

• transfer-connector-as2-signing-algorithm-check

• transfer-connector-logging abilitato

• contrassegnato da transfer-connector

• transfer-profile-taggato

• transfer-workflow-description

• transfer-workflow-taggato

• vpc-default-security-group-closed

• vpc-network-acl-unused-check

• vpc-peering-dns-resolution-check

• vpc-vpn-2-tunnels-up

• wafv2-rulegroup-logging-enabled

• wafv2-rulegroup-not-empty

• wafv2-webacl-not-empty

• waf-global-rulegroup-not-empty

• waf-global-rule-not-empty

• waf-global-webacl-not-empty

• waf-regional-rulegroup-not-empty

• waf-regional-rule-not-empty

• waf-regional-webacl-not-empty

• workspaces-connection-alias etichettati

• workspaces-root-volume-abilitato alla crittografia

• spazi di lavoro abilitati alla crittografia dei volumi degli utenti

• spazi di lavoro etichettati come spazi di lavoro

• access-keys-rotated

• account-part-of-organizations

• acm-pca-root-ca-disabled

• alb-http-to-https-redirection-check

• api-gwv2-authorization-type-configured

• appsync-associated-with-waf

• appsync-cache-encryption-at-rest

• aurora-last-backup-recovery-point-created

• aurora-meets-restore-time-target

• aurora-mysql-cluster-audit-logging

• aurora-resources in un vault con intercapedine logico

• aurora-resources-protected-by-backup-plan

• cloudfront-s3-origin-non-existent-bucket

• cloudtrail-all-read-s3-data-event-check

• cloudtrail-all-write-s3-data-event-check

• registrazione degli accessi a cloudtrail-s3-bucket

• cloudtrail-s3-bucket-accesso pubblico vietato

• cloudtrail-s3-dataevents-enabled

• cloudtrail-security-trail-enabled

• cloudwatch-alarm-resource-check

• cloudwatch-log-group-encrypted

• cloud-trail-cloud-watch-logs-enabled

• cloud-trail-enabled

• cloud-trail-encryption-enabled

• cloud-trail-log-file-validation-enabled

• cmk-backing-key-rotation-enabled

• custom-schema-registry-policy-attached

• cw-loggroup-retention-period-check

• dax-encryption-enabled

• crittografia dax-tls-endpoint

• dms-replication-not-public

• cluster docdb crittografato in transito

• dynamodb-autoscaling-enabled

• dynamodb-in-backup-plan

• dynamodb-last-backup-recovery-point-created

• dynamodb-meets-restore-time-target

• dynamodb-resources-protected-by-backup-plan

• dynamodb-throughput-limit-check

• ebs-in-backup-plan

• ebs-last-backup-recovery-point-created

• ebs-meets-restore-time-target

• ebs-resources-in-logically-airgapped-vault

• ebs-resources-protected-by-backup-plan

• ebs-snapshot-public-restorable-check

• ec2-client-vpn-not-authorize-all

• ec2-ebs-encryption-by-default

• ec2-last-backup-recovery-point-created

• ec2-meets-restore-time-target

• risorse ec2 in un archivio logico con intercapedine

• ec2-resources-protected-by-backup-plan

• ec2-security-group-attached-to-eni-periodic

• ec2-stopped-instance

• ecr-private-image-scanning-enabled

• efs-encrypted-check

• efs-in-backup-plan

• efs-last-backup-recovery-point-created

• efs-meets-restore-time-target

• efs-mount-target-accessibile al pubblico

• efs-resources-in-logically-airgapped-vault

• efs-resources-protected-by-backup-plan

• eks-cluster-logging-enabled

• eks-cluster-secrets-criptato

• eks-endpoint-no-public-access

• eks-secrets-encrypted

• elasticache-automatic-backup-check abilitato

• elasticache-auto-minor-version-upgrade-check

• elasticache-rbac-auth-enabled

• elasticache-redis-cluster-automatic-backup-check

• elasticache-repl-grp-auto-failover-enabled

• elasticache-repl-grp-encrypted-at-rest

• elasticache-repl-grp-encrypted-in-transit

• elasticache-repl-grp-redis-auth-enabled

• elasticache-subnet-group-check

• elasticache-supported-engine-version

• elasticsearch-encrypted-at-rest

• elasticsearch-in-vpc-only

• elbv2-acm-certificate-required

• emr-block-public-access

• emr-kerberos-enabled

• emr-master-no-public-ip

• event-data-store-cmk-abilitato alla crittografia

• fsx-last-backup-recovery-point-created

• fsx-lustre-copy-tags-to-backups

• fsx-meets-restore-time-target

• fsx-ontap-deployment-type-check

• fsx-openzfs-copy-tags-enabled

• fsx-openzfs-type-check

• fsx-resources-protected-by-backup-plan

• fsx-windows-audit-log-configured

• controllo del tipo di distribuzione fsx-windows-

• guardduty-ec2-protection-runtime abilitato

• abilitato per guardduty-ecs-protection-runtime

• abilitato per guardduty-eks-protection-audit-auditing

• abilitato a guardduty-eks-protection-runtime

• guardduty-enabled-centralized

• abilitato alla protezione lambda guardduty-lambda

• guardduty-abilitato alla protezione da malware

• guardduty-non-archived-findings

• abilitato alla protezione guardduty-rds

• abilitato al monitoraggio del runtime di guardduty

• abilitato alla protezione guardduty-s3

• sono abilitato all'analizzatore di accesso esterno

• iam-password-policy

• iam-policy-in-use

• iam-root-access-key-check

• controllo della scadenza del certificato iam-server

• iam-user-mfa-enabled

• iam-user-unused-credentials-check

• abilitato a inspector-ec2-scan

• abilitato a inspector-ecr-scan

• abilitato a inspector-lambda-code-scan-scan

• abilitato a inspector-lambda-standard-scan

• kinesis-firehose-delivery-stream crittografato

• kms-cmk-not-scheduled-for-deletion

• macie-auto-sensitive-data-discovery-check

• macie-status-check

• mariadb-publish-logs-to-cloudwatch-logs

• mfa-enabled-for-iam-console-access

• mq-automatic-minor-version-upgrade-enabled

• mq-cloudwatch-audit-logging-enabled

• mq-no-public-access

• multi-region-cloud-trail-enabled

• netfw-logging-enabled

• abilitato a nlb-logging

• rds-instance-subnet-igw-check

• rds-in-backup-plan

• rds-last-backup-recovery-point-created

• rds-mariadb-instance-crittografata in transito

• rds-meets-restore-time-target

• istanza rds-mysql crittografata in transito

• istanza rds-postgres-crittografata in transito

• crittografia rds-proxy-tls

• rds-resources-protected-by-backup-plan

• rds-sqlserver-crittografato in transito

• redshift-serverless-default-admin-check

• redshift-serverless-default-db-name-check

• redshift-serverless-namespace-cmk-encryption

• redshift-serverless-publishlogs-to-cloudwatch

• redshift-serverless-workgroup-crittografato in transito

• redshift-serverless-workgroup-senza accesso pubblico

• redshift-serverless-workgroup-routes-all'interno di vpc

• redshift - accesso illimitato alle porte

• root-account-hardware-mfa-enabled

• root-account-mfa-enabled

• s3-account-level-public-access-blocks-periodic

• s3-last-backup-recovery-point-created

• s3-meets-restore-time-target

• risorse s3 in un archivio logico con intercapedine

• s3-resources-protected-by-backup-plan

• sagemaker-endpoint-configuration-kms-key-configured

• sagemaker-endpoint-config-prod-instance-count

• sagemaker-notebook-instance-kms-key-configured

• versione sagemaker-notebook-instance-platform-

• sagemaker-notebook-no-direct-internet-access

• secretsmanager-secret-periodic-rotation

• secretsmanager-secret-unused

• securityhub-enabled

• security-account-information-provided

• service-vpc-endpoint-enabled

• ses-malware-scanning-enabled

• shield-advanced-enabled-autorenew

• shield-drt-access

• ssm-automation-block-condivisione pubblica

• abilitato alla registrazione di ssm-automation

• ssm-document-not-public

• storagegateway-last-backup-recovery-point-created

• storagegateway-resource-in-logically-gapped-vault

• storagegateway-resources-protected-by-backup-plan

• transfer-family-server-no-ftp

• virtualmachine-last-backup-recovery-point-created

• risorse della macchina virtuale in un archivio logico con intercapedine

• virtualmachine-resources-protected-by-backup-plan

• abilitato per vpc-endpoint

• vpc-flow-logs-enabled

• controllo della restrizione della porta vpc-sg-

• wafv2-logging-enabled

• waf-classic-logging-enabled

• acm-certificate-expiration-check

• cloudformation-stack-drift-detection-check

• ec2-instance-lanceed-con-allowed-ami

• incoming-ssh-disabled

• no-unrestricted-route-to-igw

• restricted-incoming-traffic

• s3-bucket-public-read-prohibited

• s3-bucket-public-write-prohibited

• vpc-sg-open-only-to-authorized-ports