Logging and monitoring enabled

This test verifies that all audit log types (API server, audit, authenticator, controller manager, scheduler) are enabled for your AWS EKS clusters, ensuring comprehensive audit logging for security and compliance purposes.

This test checks whether your AWS Virtual Private Clouds (VPCs) have VPC Flow Logs enabled for network traffic monitoring.

This test verifies that CloudTrail is enabled on all AWS accounts within your organization.

Automatically passes.

Verifies that no AWS S3 logging buckets grant access to the built-in AWS groups AllUsers or AuthenticatedUsers

This test verifies that there is at least one AWS S3 bucket configured as a central storage destination for CloudTrail event logging or S3 server access logging.

This test verifies that AWS CloudWatch Log Groups are configured to retain logs for at least 365 days or are set to unlimited retention.

Checks that all Amazon RDS database instances have CloudWatch alarms configured to monitor CPU utilization.

Verifies that all Amazon RDS instances have associated AWS CloudWatch alarms configured to monitor the `FreeableMemory` metric.

This test verifies that Amazon RDS databases have CloudWatch alarms configured for at least one key Input/Output (IO) performance metrics (such as `DiskQueueDepth`, `WriteIOPS`, `ReadIOPS`, `VolumeWriteIOPs`, `VolumeReadIOPs`).

This test verifies whether each AWS DynamoDB table has a configured CloudWatch alarm for monitoring the `ConsumedReadCapacityUnits` metric.

This test verifies whether each AWS DynamoDB table has a configured CloudWatch alarm for monitoring the `ConsumedWriteCapacityUnits` metric.

This test confirms that all AWS service API endpoints enforce encryption via TLS (Transport Layer Security) by default. This ensures secure communication between your administrators and AWS infrastructure services.

This test verifies that all AWS Lambda functions have CloudWatch alarms configured to monitor their Errors metric—either individually per function or globally for all functions.

This test verifies whether all AWS EC2 instances have a CloudWatch alarm set specifically for the `CPUUtilization` metric to ensure proper monitoring and alerts in case of high CPU usage.

This test verifies that all AWS SQS queues have appropriate CloudWatch alarms configured to monitor the `ApproximateAgeOfOldestMessage` metric, which indicates message processing delays or potential queue blockages.