Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
58
Curated Reports
1705+
Controls Checked
3
Cloud Providers
5 min
To First Results
Encryption at Rest
60 controls
50 services covered
Checks encryption at rest across data stores, volumes, snapshots, and managed services — EC2/EBS, S3, RDS, DynamoDB, EFS, FSx, Redshift, OpenSearch, MSK, ElastiCache, Kinesis, ECR, SQS, SNS, SageMaker, Glue, Bedrock, Secrets Manager, and SSM parameters — with a focus on customer-managed keys.
What we check
Glue Dev Endpoints3
- Glue Dev Endpoint S3 Encryption
- Glue Dev Endpoint CloudWatch Encryption
- Glue Dev Endpoint Bookmark Encryption
Glue Jobs3
- Glue Job S3 Encryption
- Glue Job CloudWatch Encryption
- Glue Job Bookmark Encryption
EBS Volumes2
- EC2 Instances Encrypted Volumes
- EBS Volume Encryption
EC2 Instances2
- EC2 Default Encryption is Enabled
- EBS Snapshot Encryption
S3 Encryption2
- S3 Bucket Encryption
- Default KMS Encryption
Glue Data Catalog and Connections2
- Glue Data Catalog Connection Password Encryption Enabled
- Glue Catalog Metadata Encryption
WorkSpaces2
- Workspace User Volume Encryption
- Workspace Root Volume Encryption
Bedrock Custom Models2
- Bedrock Custom Model Import Uses Customer-Managed KMS Key with Required Key Policy
- Bedrock Custom Model Jobs Use Customer-Managed KMS Key
EC2 AMIs1
- EC2 AMI Encryption
RDS DB Instances1
- RDS Storage Encryption
RDS Snapshots1
- RDS Snapshot Encryption
Backup Recovery Points1
- Backup Recovery Points Encryption
OpenSearch Domains1
- OpenSearch Storage Encryption
CloudWatch Log Groups1
- CloudWatch Logs Encryption
CloudFront Field-Level Encryption1
- CloudFront Field-Level Encryption
ECR Repositories1
- ECR Repository Encryption
SQS Queues1
- SQS Queue Encryption
SNS Topics1
- SNS Topic Encryption
EKS Secrets1
- EKS Secret Encryption
Redshift Clusters1
- Redshift Storage Encryption
SageMaker Notebook Instances1
- SageMaker Instance Storage Encryption
SageMaker Training Jobs1
- SageMaker Job Volume Encryption
SageMaker Endpoints1
- SageMaker Endpoint Encryption
Glue ML Transforms1
- Glue ML Transform Encryption
API Gateway Stages1
- API Gateway Cache Encryption
DynamoDB Tables1
- DynamoDB Custom KMS Key Encryption
DynamoDB Accelerator (DAX) Clusters1
- DynamoDB Accelerator (DAX) Encryption
EFS File Systems1
- EFS Share Encryption
DocumentDB Clusters1
- DocumentDB Storage Encryption
FSx File Systems1
- FSx Storage Encryption
Neptune Clusters1
- Neptune Storage Encryption
Neptune Snapshots1
- Neptune Cluster Snapshot Encryption
MSK Clusters1
- MSK Custom KMS Key Encryption
ElastiCache Replication Groups1
- ElastiCache (Redis) Encryption At-Rest is Enabled
EMR Security Configurations1
- EMR Security Configuration Encryption at Rest Enabled
Kinesis Data Streams1
- Kinesis Data Stream Server-Side Encryption
CodeBuild Logs1
- CodeBuild S3 Logs Encryption
CodeBuild Artifacts1
- CodeBuild Project Artifact Encryption
CodeBuild Report Groups1
- CodeBuild Report Group Encryption
AppSync API Caches1
- AppSync API Cache Encryption
Athena Workgroups1
- Athena Workgroup Encryption
Secrets Manager Secrets1
- Secrets Manager Secrets Use Custom KMS Key
Systems Manager Automation1
- SSM Parameters Are Encrypted
ECS Clusters1
- ECS Cluster Encryption at Rest Enabled
Bedrock Guardrails1
- Bedrock Guardrails Encrypted with Customer-Managed KMS Key
Bedrock Model Evaluation Jobs1
- Bedrock Model Evaluation Jobs Use Customer-Managed KMS Key
Bedrock Agents1
- Agents for Amazon Bedrock Encrypted with Customer-Managed KMS Key
Bedrock Flows1
- Bedrock Flows Resources Encrypted with Customer-Managed KMS Key
Bedrock Knowledge Bases1
- Bedrock Knowledge Bases Resources Encrypted with Customer-Managed KMS Key
Data Firehose Delivery Streams1
- Firehose delivery streams should be encrypted at rest
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.