Triggers

The AWS Compliance mod has mod has 84 triggers:

• Detect & correct accounts without alternate security contact
• Detect & correct accounts without metric filter for bucket policy changes
• Detect & correct accounts without metric filter for CloudTrail configuration
• Detect & correct accounts without metric filter for Config configuration
• Detect & correct accounts without metric filter for console authentication failure
• Detect & correct accounts without metric filter for console login MFA changes
• Detect & correct accounts without metric filter for disable or delete CMK
• Detect & correct accounts without metric filter for IAM policy changes
• Detect & correct accounts without metric filter for network ACL changes
• Detect & correct CloudWatch log groups without metric filter for network gateway changes
• Detect & correct CloudWatch log groups without metric filter for organization changes
• Detect & correct accounts without metric filter for root login
• Detect & correct accounts without metric filter for route table changes
• Detect & correct accounts without metric filter for security group changes
• Detect & correct accounts without metric filter for unauthorized API changes
• Detect & correct accounts without metric filter for VPC changes
• Detect & correct API Gateway rest API stages with x-ray tracing disabled
• Detect & correct CloudTrail trail logs not encrypted with KMS CMK
• Detect & correct CloudTrail trails with log file validation disabled
• Detect & correct CloudTrail trails with multi-region read/write disabled
• Detect & correct CloudTrail trails using public S3 bucket
• Detect & correct CloudTrail trails with S3 logging disabled
• Detect & correct CloudTrail trails with S3 object level logging for read events disabled
• Detect & correct CloudTrail trails with S3 object level logging for write events disabled
• Detect & correct Config disabled in regions
• Detect & correct DynamoDB table with deletion protection disabled
• Detect & correct DynamoDB table with point-in-time recovery disabled
• Detect & correct EBS encryption by default disabled in regions
• Detect & correct EBS snapshots when publicly restorable
• Detect & correct EC2 classic load balancers with connection draining disabled
• Detect & correct EC2 instances with IMDSv1 enabled
• Detect & correct EC2 instances with multiple ENIs
• Detect & correct EC2 instances with public access enabled
• Detect & correct EFS file systems with encryption at rest disabled
• Detect & correct regions with IAM Access Analyzer disabled
• Detect & correct IAM account password policies without maximum password age of 90 days
• Detect & correct IAM account password policies without minimum length of 14
• Detect & correct IAM account password policies without requirement for any lowercase letter
• Detect & correct IAM account password policies without requirement for any number
• Detect & correct IAM account password policies without requirement for any symbol
• Detect & correct IAM account password policies without requirement for any uppercase letter
• Detect & correct IAM account password policies without password reuse 24
• Detect & correct IAM accounts without support role
• Detect & correct IAM groups attached with *:* policy
• Detect & correct IAM groups with unrestricted CloudShellFullAccess policy
• Detect & correct IAM roles attached with *:* policy
• Detect & correct IAM roles with unrestricted CloudShellFullAccess policy
• Detect & correct IAM root users last used in 90 days or more
• Detect & correct IAM root users with access keys
• Detect & correct IAM root users with hardware MFA disabled
• Detect & correct IAM root users with MFA disabled
• Detect & correct expired IAM server certificates
• Detect & correct IAM users with unused access key from 90 days or more
• Detect & correct IAM users with access key created during initial user setup
• Detect & correct IAM users with console access MFA disabled
• Detect & correct IAM users with IAM policy attached
• Detect & correct IAM users with inline policy
• Detect & correct IAM users with more than one active key
• Detect & correct IAM users attached with *:* policy
• Detect & correct IAM users with unrestricted CloudShellFullAccess policy
• Detect & correct IAM users with unused access key from 45 days or more
• Detect & correct IAM users with unused access key from 90 days or more
• Detect & correct IAM users with unused login profile from 45 days or more
• Detect & correct IAM users with unused login profile from 90 days or more
• Detect & correct KMS keys with rotation disabled
• Detect & correct RDS DB instances with auto minor version upgrade disabled
• Detect & correct RDS DB instances with encryption at rest disabled
• Detect & correct RDS DB instances with Multi-AZ disabled
• Detect & correct RDS DB instances with public access enabled
• Detect & correct S3 buckets with block public access disabled
• Detect & correct S3 buckets with default encryption disabled
• Detect & correct S3 buckets with Macie disabled
• Detect & correct S3 buckets with MFA delete disabled
• Detect & correct S3 buckets without SSL enforcement
• Detect & correct Security Hub disabled in regions
• Detect & correct default VPC security groups allowing ingress egress
• Detect & correct VPC network ACLs allowing ingress to remote server administration ports
• Detect & correct VPC security groups allowing ingress to port 22
• Detect & correct VPC security groups allowing ingress to port 3389
• Detect & correct VPC security groups allowing ingress to port 445
• Detect & correct VPC security groups allowing ingress to remote server administration ports
• Detect & correct VPC security groups allowing ingress to remote server administration ports IPv4
• Detect & correct VPC security groups allowing ingress to remote server administration ports IPv6
• Detect & correct VPCs without flow logs