Security requirements verified in CSPM

The following tables present the security requirements on which Fluid Attacks' cloud security posture management (CSPM) scans are based, differentiating by the supported cloud provider and by the scanner method that automates the check. To learn how to make the configurations to use CSPM, refer to Use cloud integrations.

You can use the scanner as a standalone tool. Learn to configure it yourself reading CSPM scanner configuration file.

AWS

Scanner method name	Related security requirement verified
AWS_APIGATEWAY_ALLOWS_ANONYMOUS_ACCESS	255. Allow access only to the necessary ports
AWS_CFT_SERVES_CONTENT_OVER_HTTP	181. Transmit data using secure protocols
AWS_CF_DISTRIBUTION_HAS_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_CLOUDFRONT_HAS_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_CLOUDFRONT_INSECURE_PROTOCOLS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AWS_CLOUDTRAIL_FILES_NOT_VALIDATED	080. Prevent log modification
AWS_CLOUDTRAIL_IS_TRAIL_BUCKET_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_CLOUDTRAIL_NOT_LOGGING	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_CLOUDTRAIL_TRAILS_NOT_MULTIREGION	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_COGNITO_HAS_MFA_DISABLED	229. Request access credentials 231. Implement a biometric verification component 264. Request authentication 319. Make authentication options equally secure 328. Request MFA for critical systems
AWS_CREDENTIALS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
AWS_DYNAMODB_ENCRYPTED_WITH_AWS_MASTER_KEYS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_DYNAMODB_HAS_NOT_POINT_IN_TIME_RECOVERY	186. Use the principle of least privilege 265. Restrict access to critical processes
AWS_DYNAMODB_NOT_DEL_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
AWS_EBS_HAS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 266. Disable insecure functionalities 300. Mask sensitive data
AWS_EC2_ACL_ALLOW_ALL_INGRESS_TRAFFIC	255. Allow access only to the necessary ports
AWS_EC2_ACL_ALLOW_EGRESS_TRAFFIC	255. Allow access only to the necessary ports
AWS_EC2_ANYONE_ADMIN_PORTS	255. Allow access only to the necessary ports
AWS_EC2_DEFAULT_ALL_TRAFFIC	255. Allow access only to the necessary ports
AWS_EC2_DEFAULT_SECURITY_GROUP	266. Disable insecure functionalities
AWS_EC2_HAS_ASSOCIATE_PUBLIC_IP_ADDRESS	266. Disable insecure functionalities
AWS_EC2_HAS_DEFAULT_SECURITY_GROUPS_IN_USE	266. Disable insecure functionalities
AWS_EC2_HAS_INSTANCES_USING_UNAPPROVED_AMIS	266. Disable insecure functionalities
AWS_EC2_HAS_MODIFY_ATTRIBUTE	266. Disable insecure functionalities
AWS_EC2_HAS_NOT_TERMINATION_PROTECTION	186. Use the principle of least privilege
AWS_EC2_HAS_TERMINATE_SHUTDOWN_BEHAVIO	266. Disable insecure functionalities
AWS_EC2_HAS_UNENCRYPTED_AMIS	266. Disable insecure functionalities
AWS_EC2_HAS_UNENCRYPTED_SNAPSHOTS	266. Disable insecure functionalities
AWS_EC2_HAS_UNUSED_KEY_PAIRS	266. Disable insecure functionalities
AWS_EC2_HAS_UNUSED_SEGGROUPS	266. Disable insecure functionalities
AWS_EC2_IAM_INSTANCE_WITHOUT_PROFILE	266. Disable insecure functionalities
AWS_EC2_INSECURE_PORT_RANGE	255. Allow access only to the necessary ports
AWS_EC2_INSTANCES_WITHOUT_PROFILE	255. Allow access only to the necessary ports
AWS_EC2_OPEN_ALL_PORTS_TO_THE_PUBLIC	255. Allow access only to the necessary ports
AWS_EC2_SEC_GROUPS_RFC1918	255. Allow access only to the necessary ports
AWS_EC2_UNRESTRICTED_CIDRS	255. Allow access only to the necessary ports
AWS_EC2_UNRESTRICTED_DNS_ACCESS	255. Allow access only to the necessary ports
AWS_EC2_UNRESTRICTED_FTP_ACCESS	255. Allow access only to the necessary ports
AWS_EC2_UNRESTRICTED_IP_PROTOCOLS	255. Allow access only to the necessary ports
AWS_EC2_VPC_ENDPOINTS_EXPOSED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_EC2_VPC_WITHOUT_FLOWLOG	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_EFS_IS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 266. Disable insecure functionalities 300. Mask sensitive data
AWS_EKS_HAS_ENDPOINTS_PUBLICLY_ACCESSIBLE	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_ELASTICACHE_REST_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_ELASTICACHE_TRANSIT_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_ELASTICACHE_USES_DEFAULT_PORT	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_ELB2_HAS_NOT_DELETION_PROTECTION	186. Use the principle of least privilege 265. Restrict access to critical processes
AWS_ELB2_HAS_NOT_HTTPS	181. Transmit data using secure protocols 266. Disable insecure functionalities
AWS_ELBV2_HAS_ACCESS_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_ELBV2_INSECURE_PROTOCOLS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AWS_ELBV2_INSECURE_SSL_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AWS_HAS_PUBLICLY_SHARED_AMIS	266. Disable insecure functionalities
AWS_IAM_ADMIN_POLICY_ATTACHED	035. Manage privilege modifications 095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_ALLOWS_PRIV_ESCALATION_BY_ATTACH_POLICY	035. Manage privilege modifications
AWS_IAM_ALLOWS_PRIV_ESCALATION_BY_POLICIES_VERSIONS	035. Manage privilege modifications
AWS_IAM_FULL_ACCESS_SSM	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_GROUP_WITH_INLINE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_HAS_MFA_DISABLED	229. Request access credentials 231. Implement a biometric verification component 264. Request authentication 319. Make authentication options equally secure 328. Request MFA for critical systems
AWS_IAM_HAS_OLD_ACCESS_KEYS	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_HAS_OLD_CREDS_ENABLED	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_HAS_OLD_SSH_PUBLIC_KEYS	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_HAS_PERMISSIVE_ROLE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_HAS_ROOT_ACTIVE_SIGNING_CERTIFICATES	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_IAM_HAS_WILDCARD_RESOURCE_IN_WRITE_ACTION	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_IS_POLICY_MISS_CONFIGURED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_MFA_DISABLED_FOR_USERS_WITH_CONSOLE_PASSWD	229. Request access credentials 231. Implement a biometric verification component 264. Request authentication 319. Make authentication options equally secure 328. Request MFA for critical systems
AWS_IAM_MIN_PASSWORD_LEN_UNSAFE	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_NEGATIVE_STATEMENT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_NOT_REQUIRES_LOWERCASE	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_NOT_REQUIRES_NUMBERS	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_NOT_REQUIRES_SYMBOLS	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_NOT_REQUIRES_UPPERCASE	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_OPEN_PASSROLE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_PASSWORD_EXPIRATION_UNSAFE	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_PASSWORD_REUSE_UNSAFE	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
AWS_IAM_PERMISSIVE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_POLICIES_ATTACHED_TO_USERS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_IAM_ROOT_HAS_ACCESS_KEYS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_IAM_ROOT_HAS_MFA_DISABLED	229. Request access credentials 231. Implement a biometric verification component 264. Request authentication 319. Make authentication options equally secure 328. Request MFA for critical systems
AWS_IAM_USERS_WITH_PASSWORD_AND_ACCESS_KEYS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_USER_WITH_INLINE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_IAM_USER_WITH_MULTIPLE_ACCESS_KEYS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_KMS_HAS_MASTER_KEYS_EXPOSED_TO_EVERYONE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_KMS_IS_KEY_ROTATION_DISABLED	266. Disable insecure functionalities
AWS_RDS_HAS_NOT_AUTOMATED_BACKUPS	186. Use the principle of least privilege 265. Restrict access to critical processes
AWS_RDS_HAS_NOT_DELETION_PROTECTION	186. Use the principle of least privilege 265. Restrict access to critical processes
AWS_RDS_HAS_PUBLIC_INSTANCES	096. Set user's required privileges 176. Restrict system objects 265. Restrict access to critical processes
AWS_RDS_HAS_PUBLIC_SNAPSHOTS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_RDS_HAS_UNENCRYPTED_STORAGE	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 229. Request access credentials 264. Request authentication 300. Mask sensitive data
AWS_RDS_NOT_INSIDE_A_DB_SUBNET_GROUP	255. Allow access only to the necessary ports
AWS_RDS_NOT_USES_IAM_AUTHENTICATION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_RDS_UNRESTRICTED_DB_SECURITY_GROUPS	255. Allow access only to the necessary ports
AWS_REDSHIFT_HAS_AUDIT_LOGS_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_REDSHIFT_HAS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 300. Mask sensitive data
AWS_REDSHIFT_HAS_PUBLIC_CLUSTERS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_REDSHIFT_HAS_USER_ACTIVITY_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_REDSHIFT_NOT_REQUIRES_SSL	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_S3_ACL_PUBLIC_BUCKETS	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
AWS_S3_BUCKETS_ALLOW_UNAUTHORIZED_PUBLIC_ACCESS	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
AWS_S3_BUCKET_POLICY_ENCRYPTION_DISABLE	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 227. Display access notification 229. Request access credentials 264. Request authentication 300. Mask sensitive data
AWS_S3_BUCKET_VERSIONING_DISABLED	266. Disable insecure functionalities
AWS_S3_HAS_ACCESS_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AWS_S3_HAS_INSECURE_TRANSPORT	181. Transmit data using secure protocols
AWS_S3_PRIVATE_BUCKETS_NOT_BLOCKING_PUBLIC_ACLS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_S3_PUBLIC_BUCKETS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AWS_SECRETS_HAS_AUTOMATIC_ROTATION_DISABLED	266. Disable insecure functionalities
AWS_SNS_CAN_ANYONE_PUBLISH	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_SNS_CAN_ANYONE_SUBSCRIBE	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_SNS_HAS_SERVER_SIDE_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_SQS_HAS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
AWS_SQS_IS_PUBLIC	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege

Azure

Scanner method name	Related security requirement verified
AZ_SUBSCRIPTION_NOT_ALLOWED_RESOURCE_TYPES_POLICY	266. Disable insecure functionalities
AZURE_AKS_API_SERVER_ALLOWS_PUBLIC_ACCESS	266. Disable insecure functionalities
AZURE_AKS_HAS_ENABLE_LOCAL_ACCOUNTS	266. Disable insecure functionalities
AZURE_AKS_HAS_KUBENET_NETWORK_PLUGIN	266. Disable insecure functionalities
AZURE_AKS_HAS_RBAC_DISABLED	266. Disable insecure functionalities
AZURE_AKS_IS_NOT_USING_LATEST_VERSION	266. Disable insecure functionalities
AZURE_API_MGMT_BACK__INSECURE_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_API_MGMT_FRONT__INSECURE_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_APP_SERVICE_ALLOWS_FTP_DEPLOYMENTS	181. Transmit data using secure protocols
AZURE_APP_SERVICE_ALLOWS_HTTP_TRAFIC	181. Transmit data using secure protocols
AZURE_APP_SERVICE_ALWAYS_ON_IS_NOT_ENABLED	266. Disable insecure functionalities
AZURE_APP_SERVICE_AUTHENTICATION_IS_NOT_ENABLED	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
AZURE_APP_SERVICE_DOES_NOT_USE_A_MANAGED_IDENTITY	266. Disable insecure functionalities
AZURE_APP_SERVICE_LOGGING_IS_DISABLED	266. Disable insecure functionalities
AZURE_APP_SERVICE_MUTUAL_TLS_IS_DISABLED	266. Disable insecure functionalities
AZURE_APP_SERVICE_REMOTE_DEBUGGING_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
AZURE_BATCH_JOBS_RUNS_IN_ADMIN_MODE	266. Disable insecure functionalities
AZURE_BLOB_CONTAINERS_ARE_PUBLIC	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
AZURE_BLOB_SOFT_DELETED_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
AZURE_CONTAINER_REGISTRY_ADMIN_USER_ENABLED	266. Disable insecure functionalities
AZURE_CONTAINER_REGISTRY_IS_NOT_USING_REPLICATION	266. Disable insecure functionalities
AZURE_CONTAINERS_SOFT_DELETED_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
AZURE_DB_FOR_MYSQL_FLEX_SERVERS_INSECURE_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_DB_MYSQL_FIREWALL_ALLOWS_PUBLIC_ACCESS	266. Disable insecure functionalities
AZURE_DB_MYSQL_SSL_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_DB_POSTGRESQL_CONNECTION_THROTTLING_DISABLED	266. Disable insecure functionalities
AZURE_DB_POSTGRESQL_FIREWALL_ALLOWS_PUBLIC_ACCESS	266. Disable insecure functionalities
AZURE_DB_POSTGRESQL_INSECURE_LOG_RETENTION	186. Use the principle of least privilege 265. Restrict access to critical processes
AZURE_DB_POSTGRESQL_INSECURE_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_DB_POSTGRESQL_LOG_SETTINGS_DISABLED	266. Disable insecure functionalities
AZURE_DB_POSTGRESQL_SSL_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_DB_SQL_EXTENDED_AUDIT_DISABLED	266. Disable insecure functionalities
AZURE_DB_SQL_FIREWALL_ALLOWS_PUBLIC_ACCESS	266. Disable insecure functionalities
AZURE_DB_SQL_INSECURE_AUDIT_RETENTION_PERIOD	266. Disable insecure functionalities
AZURE_DEV_PORTAL_HAS_AUTH_METHODS_INACTIVE	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
AZURE_FIREWALL_NETWORK_RULES_UNRESTRICTED	255. Allow access only to the necessary ports
AZURE_FUNCTION_APP_USE_NOT_HOST_KEYS	266. Disable insecure functionalities
AZURE_FUNCTION_APP_WITH_ADMIN_PRIVILEGES	266. Disable insecure functionalities
AZURE_KEY_VAULT_ACCIDENTAL_PURGE_PREVENTION_IS_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
AZURE_KEY_VAULT_SOFT_DELETE_RETENTION	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AZURE_KEYS_EXPIRATION_DATE_IS_NOT_ENABLED	266. Disable insecure functionalities
AZURE_NETWORK_APP_GATEWAY_WAF_IS_DISABLED	266. Disable insecure functionalities
AZURE_NETWORK_FIREWALL_APP_RULES_UNRESTRICTED	255. Allow access only to the necessary ports
AZURE_NETWORK_FLOW_LOG_INSECURE_RETENTION_PERIOD	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AZURE_NETWORK_ICMP_INGRESS_NOT_RESTRICTED	255. Allow access only to the necessary ports
AZURE_NETWORK_OUT_OF_DATE_OWASP_RULES	266. Disable insecure functionalities
AZURE_NETWORK_SECURITY_GROUP_ACCESS_ON_PORTS	255. Allow access only to the necessary ports
AZURE_NETWORK_SECURITY_GROUP_ALLOWS_PUBLIC_ACCESS	255. Allow access only to the necessary ports
AZURE_NETWORK_SECURITY_GROUP_USING_PORT_RANGES	255. Allow access only to the necessary ports
AZURE_NETWORK_WATCHER_NOT_ENABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
AZURE_PUBLICLY_EXPOSED_FUNCT_APP	266. Disable insecure functionalities
AZURE_REDIS_AUTHNOTREQUIRED_ENABLE	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
AZURE_REDIS_FIREWALL_ALLOWS_PUBLIC_ACCESS	266. Disable insecure functionalities
AZURE_REDIS_INSECURE_PORT	181. Transmit data using secure protocols
AZURE_REDIS_INSECURE_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_REDIS_PUBLIC_NETWORK_ACCESS_ENABLED	266. Disable insecure functionalities
AZURE_ROLE_ACTIONS_IS_A_WILDCARD	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
AZURE_ROLE_BASED_ACCESS_CONTROL_ON_KEY_VAULT_IS_NOT_ENABLED	266. Disable insecure functionalities
AZURE_SEARCH_SERVICE__INSUFFICIENT_REPLICAS_CONFIGURED	266. Disable insecure functionalities
AZURE_SEARCH_SERVICE_DOES_NOT_USE_A_MANAGED_IDENTITY	266. Disable insecure functionalities
AZURE_SECRET_EXPIRATION_DATE_IS_NOT_ENABLED	266. Disable insecure functionalities
AZURE_STORAGE_ACCOUNT_ALLOWS_PUBLIC_BLOBS	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
AZURE_STORAGE_ACCOUNT_ALLOWS_PUBLIC_TRAFFIC	255. Allow access only to the necessary ports
AZURE_STORAGE_ACCOUNT_GEO_REPLICATION_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
AZURE_STORAGE_ACCOUNT_NOT_ENFORCING_HTTPS	181. Transmit data using secure protocols
AZURE_STORAGE_ACCOUNT_NOT_ENFORCING_LATEST_TLS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
AZURE_STORAGE_NOT_ENABLED_INFRASTRUCTURE_ENCRYPTION	266. Disable insecure functionalities
AZURE_SUBSCRIPTION_DOES_NOT_HAVE_A_LOCKING_RESOURCE_MANAGER	266. Disable insecure functionalities
AZURE_SUBSCRIPTION_HAS_AT_LEAST_TWO_OWNERS	266. Disable insecure functionalities
AZURE_VM_ENCRYPTION_AT_HOST_DISABLED	266. Disable insecure functionalities
AZURE_VM_SSH_KEY_AUTHENTICATION	266. Disable insecure functionalities
AZURE_WEB_APP_INSECURE_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions

GCP

Scanner method name	Related security requirement verified
GCP_STORAGE_LOGGING_IS_NOT_ENABLED_ON_STORAGE_BUCKET	075. Record exceptional events in logs 320. Avoid client-side control enforcement
GCP_STORAGE_OBJECT_VERSIONING_IS_NOT_ENABLED	075. Record exceptional events in logs 320. Avoid client-side control enforcement
GCP_STORAGE_PUBLIC_BUCKETS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
GCP_STORAGE_RETENTION_POLICY_IS_NOT_CONFIGURED	075. Record exceptional events in logs 320. Avoid client-side control enforcement
GCP_STORAGE_UNIFORM_BUCKET_LEVEL_ACCESS_IS_DISABLED	033. Restrict administrative access 176. Restrict system objects 265. Restrict access to critical processes 280. Restrict service root directory

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Security requirements verified in CSPM | Fluid Attacks Help

Security requirements verified in CSPM

AWS

Azure

GCP