Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
58
Curated Reports
1705+
Controls Checked
3
Cloud Providers
5 min
To First Results
Database Best Practices
63 controls
21 services covered
Reviews relational, NoSQL, cache, search, streaming, and migration databases — RDS, DynamoDB, DocumentDB, Neptune, ElastiCache, MSK, OpenSearch, Redshift, Redshift Serverless, and DMS — for logging, TLS, backups, high availability, deletion protection, maintenance, and public exposure.
What we check
RDS DB Instances11
- RDS Auto Minor Version Upgrade Enabled
- RDS Instance Default Admin Username Check
- RDS IAM Authentication Enabled
- RDS Enhanced Monitoring Enabled
- RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
- RDS for SQL Server DB instances should publish logs to CloudWatch Logs
- RDS for SQL Server DB instances should be encrypted in transit
- RDS for MariaDB DB instances should publish logs to CloudWatch Logs
- RDS for MariaDB DB instances should be encrypted in transit
- RDS DB instances should not be deployed in public subnets with routes to internet gateways
- RDS DB instances backup retention period should be greater than or equal to 7
OpenSearch Domains8
- Amazon Elasticsearch Internal User Database Enabled
- Amazon Elasticsearch Software Updates are Available
- Amazon Elasticsearch Domain Application/Performance Logging Enabled
- OpenSearch Data Node Fault Tolerance Check
- OpenSearch Primary Node Fault Tolerance
- OpenSearch domain error logging to CloudWatch Logs should be enabled
- OpenSearch domains should have fine-grained access control enabled
- Connections to OpenSearch domains should be encrypted using the latest TLS security policy
Redshift Clusters6
- Redshift Clusters Audit Logging Enabled
- Redshift cluster maintenance settings should be configured
- Amazon Redshift clusters should not use the default Admin username
- Redshift security groups should allow ingress on the cluster port only from restricted origins
- Redshift clusters should have Multi-AZ deployments enabled
- AWS Redshift should have required maintenance settings
RDS DB Clusters5
- RDS Cluster Default Admin Username Check
- RDS instances should not use a database engine default port
- Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs
- RDS DB clusters should have enough backup retention period set
- RDS global clusters should run on a supported Aurora MySQL version
RDS Event Subscriptions5
- RDS Event Subscriptions: DB Parameter Group Changes
- RDS Event Subscription for DB Security Group Changes
- RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled
- RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled
- RDS Event Subscriptions: Instance Low Storage Event Monitoring is Enabled
DynamoDB Tables3
- DynamoDB Operations Logging with CloudTrail is Enabled
- DynamoDB tables should automatically scale capacity with demand
- DynamoDB Throughput Limit Check
DocumentDB Clusters3
- Deletion Protection is Enabled
- DocumentDB Audit logging Enabled
- Amazon DocumentDB clusters should be encrypted in transit
Redshift Serverless Namespaces3
- Redshift Serverless namespaces should not use the default admin username
- Redshift Serverless namespaces should export logs to CloudWatch Logs
- Redshift Serverless namespaces should not use the default database name
RDS Security Groups2
- RDS DB Uses Non-Default Security Groups
- RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0
Neptune Clusters2
- Neptune Audit logging Enabled
- Neptune Cluster CloudWatch Log Export Check
ElastiCache Replication Groups2
- ElastiCache (Redis) Multi-AZ is Enabled
- Ensure ElastiCache Replication Groups Have Auto Failover Enabled
MSK Clusters2
- MSK Cluster Node-to-Node Encryption Enabled
- MSK Enhanced Monitoring Enabled Check
DMS Replication Instances2
- DMS Replication Instances have Auto Minor Version Upgrade Enabled
- DMS replication instances should be configured to use multiple Availability Zones
DMS Replication Tasks2
- DMS replication tasks for the target database should have logging enabled
- DMS replication tasks for the source database should have logging enabled
RDS DB Proxies1
- RDS DB proxies should require TLS encryption for connections
RDS Certificates1
- RDS DB instances CA certificates should not expire within next 7 days
DynamoDB Accelerator (DAX) Clusters1
- DAX Cluster Encryption in Transit is Enabled
Neptune Snapshots1
- Neptune Cluster Copy Tags to Snapshot Check
DMS Endpoints1
- DMS Endpoints have SSL Enabled
DMS Certificates1
- Ensure that all the expired DMS certificates are removed
Redshift Serverless Workgroups1
- Connections to Redshift Serverless workgroups should be required to use SSL
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.