Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
58
Curated Reports
1705+
Controls Checked
3
Cloud Providers
5 min
To First Results
Network Best Practices
49 controls
14 services covered
Covers network segmentation and edge controls — VPC design, subnets, endpoints, peering and VPN, security groups and network ACLs, EC2 exposure, Route 53 DNS, Network Firewall, and VPC Block Public Access.
What we check
EC2 Security Groups20
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Cassandra Ports (7199, 9160 or 8888)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to CIFS Ports (TCP 445)
- No Security Group Rules Allowing Insecure Ports (Ingress)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Memcached Ports (11211)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to MongoDB Ports (27017 or 27018)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to MySQL DB Ports (3306)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Oracle DB Ports (1521 or 2483)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Postgres DB Ports (5432)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to Redis Ports (6379)
- No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22)
- Default Security Group No Rules
- VPC security groups should restrict uses of 'launch-wizard' security groups
- VPC security groups should restrict ingress CIFS access from 0.0.0.0/0 and ::/0
- VPC security groups should restrict ingress access on ports 20, 21, 22, 3306, 3389, 4333 from 0.0.0.0/0
- VPC security groups should restrict ingress Kafka port access from 0.0.0.0/0
- VPC security groups should restrict ingress kibana port access from 0.0.0.0/0
- VPC security groups should restrict ingress redis access from 0.0.0.0/0
- VPC security groups should restrict ingress TCP and UDP access from 0.0.0.0/0
VPC Endpoints8
- VPC Configured to Use VPC Endpoints (PrivateLink)
- Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
- VPCs should be configured with an interface endpoint for ECR API
- VPCs should be configured with an interface endpoint for Docker Registry
- VPCs should be configured with an interface endpoint for Systems Manager
- VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts
- VPCs should be configured with an interface endpoint for Systems Manager Incident Manager
- VPC endpoint services should have acceptance required enabled
VPCs4
- Default VPC is Deleted
- VPC Protected by AWS Network Firewall
- Multi-Layered VPC Check
- VPCs Exist in More Than One Region
Site-to-Site VPN Connections3
- EC2 VPN connections should have logging enabled
- EC2 VPN connections should use IKEv2 protocol
- Backup VPN Connection Configured
Network Firewall Firewalls3
- Network Firewall Logging Enabled Check
- Network Firewall Multi-AZ Deployment Check
- Network Firewall Subnet Change Protection is Enabled
EC2 Transit Gateways2
- EC2 Transit Gateway Auto Cross-Account Attachment Disabled
- EC2 Transit Gateway Auto VPC Attach is Disabled
VPC Route Tables2
- VPC Peering Routing Tables Are "Least Access"
- VPC Route Tables Restrict Public Access to IGW
Network ACLs1
- No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0)
Internet Gateways1
- VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs)
VPC Flow Logs1
- VPC Flow Logs are Forwarded to CloudWatch Logs
VPC Peering Connections1
- Avoid Many-to-Many VPC Peering Topologies
Route 53 DNS Firewall1
- VPC protected by Route53 DNS Firewall
VPC Block Public Access1
- EC2 VPC Block Public Access settings should block internet gateway traffic
VPC Subnets1
- Auto Assign Public IP is Disabled for Subnets
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.