Prufing

Catalog / Cloud Security

Cloud Security AWS · Azure · OCI

IAM, logging, networking, data protection, and key management across AWS, Azure, and OCI — each control paired with a read-only command you can run yourself.

4
domains
145
controls
145
tests the agent runs

Control catalog

Amazon Web Services (AWS)

AWS · 40 controls
  • AWS-001

    Root account MFA is enabled.

    Root account MFA is enabled.

  • AWS-002

    No access keys exist on the root account.

    No access keys exist on the root account.

  • AWS-003

    Root account is not used for day-to-day activity.

    Root account is not used for day-to-day activity.

  • AWS-004

    Strong IAM password policy is enforced.

    Strong IAM password policy is enforced.

  • AWS-005

    MFA is enabled for all IAM users with console access.

    MFA is enabled for all IAM users with console access.

  • AWS-006

    No IAM identity has unrestricted administrator (*:*) policies beyond a justified few.

    No IAM identity has unrestricted administrator (*:*) policies beyond a justified few.

  • AWS-007

    Active access keys are rotated at least every 90 days.

    Active access keys are rotated at least every 90 days.

  • AWS-008

    Credentials unused for 90+ days are disabled.

    Credentials unused for 90+ days are disabled.

  • AWS-009

    Permissions are granted via groups/roles, not directly to users.

    Permissions are granted via groups/roles, not directly to users.

  • AWS-010

    CloudTrail is enabled in ALL regions with a multi-region trail.

    CloudTrail is enabled in ALL regions with a multi-region trail.

  • AWS-011

    CloudTrail log-file validation is enabled.

    CloudTrail log-file validation is enabled.

  • AWS-012

    CloudTrail logs are encrypted with a KMS CMK.

    CloudTrail logs are encrypted with a KMS CMK.

  • AWS-013

    AWS Config is enabled in all regions.

    AWS Config is enabled in all regions.

  • AWS-014

    Amazon GuardDuty is enabled.

    Amazon GuardDuty is enabled.

  • AWS-015

    CloudWatch metric filters & alarms exist for critical events.

    CloudWatch metric filters & alarms exist for critical events.

  • AWS-016

    No Security Group allows unrestricted (0.0.0.0/0) ingress to SSH (22) or RDP (3389).

    No Security Group allows unrestricted (0.0.0.0/0) ingress to SSH (22) or RDP (3389).

  • AWS-017

    Default security group of every VPC restricts all traffic.

    Default security group of every VPC restricts all traffic.

  • AWS-018

    VPC Flow Logs are enabled on all VPCs.

    VPC Flow Logs are enabled on all VPCs.

  • AWS-019

    No Security Group exposes database ports (3306/5432/1433/27017) to 0.0.0.0/0.

    No Security Group exposes database ports (3306/5432/1433/27017) to 0.0.0.0/0.

  • AWS-020

    S3 Block Public Access is enabled at the account level.

    S3 Block Public Access is enabled at the account level.

  • AWS-021

    No individual S3 bucket is publicly readable/writable.

    No individual S3 bucket is publicly readable/writable.

  • AWS-022

    S3 default encryption is enabled on all buckets.

    S3 default encryption is enabled on all buckets.

  • AWS-023

    EBS volume encryption-by-default is enabled per region.

    EBS volume encryption-by-default is enabled per region.

  • AWS-024

    RDS instances are encrypted at rest.

    RDS instances are encrypted at rest.

  • AWS-025

    RDS instances are not publicly accessible.

    RDS instances are not publicly accessible.

  • AWS-026

    Automatic rotation is enabled on KMS customer keys.

    Automatic rotation is enabled on KMS customer keys.

  • AWS-027

    EC2 instances enforce IMDSv2 (token-required metadata).

    EC2 instances enforce IMDSv2 (token-required metadata).

  • AWS-028

    Public-facing EC2 instances are intentional and minimal.

    Public-facing EC2 instances are intentional and minimal.

  • AWS-029

    Lambda functions hold no secrets in plaintext env vars and use least-privilege roles.

    Lambda functions hold no secrets in plaintext env vars and use least-privilege roles.

  • AWS-030

    ECR repositories have image scanning enabled.

    ECR repositories have image scanning enabled.

  • AWS-031

    EKS clusters log control-plane and restrict public API endpoint.

    EKS clusters log control-plane and restrict public API endpoint.

  • AWS-032

    Highly-privileged access is minimal, justified and just-in-time

    Highly-privileged access is minimal, justified and just-in-time

  • AWS-033

    Audit log retention meets the required minimum

    Audit log retention meets the required minimum

  • AWS-034

    Encryption in transit enforced (HTTPS/TLS only)

    Encryption in transit enforced (HTTPS/TLS only)

  • AWS-035

    Versioning / soft-delete enabled on sensitive data stores

    Versioning / soft-delete enabled on sensitive data stores

  • AWS-036

    Key/secret store access is restricted and protected

    Key/secret store access is restricted and protected

  • AWS-037

    Budget / anomalous-spend alerts exist (abuse indicator)

    Budget / anomalous-spend alerts exist (abuse indicator)

  • AWS-038

    Deletion protection on critical resources

    Deletion protection on critical resources

  • AWS-039

    Workloads/accounts isolated for blast-radius control

    Workloads/accounts isolated for blast-radius control

  • AWS-040

    Preventive policy guardrails are assigned

    Preventive policy guardrails are assigned

Google Cloud Platform (GCP)

GCP · 36 controls
  • GCP-001

    MFA enforced for all human users, especially privileged identities

    MFA enforced for all human users, especially privileged identities

  • GCP-002

    Strong password policy enforced (length, complexity, reuse, lockout)

    Strong password policy enforced (length, complexity, reuse, lockout)

  • GCP-003

    No identity holds unrestricted wildcard/admin (*:* or owner) rights beyond a justified few

    No identity holds unrestricted wildcard/admin (*:* or owner) rights beyond a justified few

  • GCP-004

    Long-lived credentials/keys rotated at least every 90 days (or eliminated)

    Long-lived credentials/keys rotated at least every 90 days (or eliminated)

  • GCP-005

    Credentials unused for 90+ days are disabled

    Credentials unused for 90+ days are disabled

  • GCP-006

    Permissions granted via groups/roles, not directly to individual users

    Permissions granted via groups/roles, not directly to individual users

  • GCP-007

    Highly-privileged access is minimal, justified and just-in-time

    Highly-privileged access is minimal, justified and just-in-time

  • GCP-008

    Cloud audit logging enabled across all regions/services

    Cloud audit logging enabled across all regions/services

  • GCP-009

    Audit logs protected from tampering and encrypted

    Audit logs protected from tampering and encrypted

  • GCP-010

    Audit log retention meets the required minimum

    Audit log retention meets the required minimum

  • GCP-011

    Network flow logs enabled on all virtual networks

    Network flow logs enabled on all virtual networks

  • GCP-012

    Cloud-native threat detection / CSPM enabled

    Cloud-native threat detection / CSPM enabled

  • GCP-013

    Alerts exist for critical changes (IAM, network, policy, keys)

    Alerts exist for critical changes (IAM, network, policy, keys)

  • GCP-014

    No unrestricted (0.0.0.0/0) ingress to SSH (22)

    No unrestricted (0.0.0.0/0) ingress to SSH (22)

  • GCP-015

    No unrestricted (0.0.0.0/0) ingress to RDP (3389)

    No unrestricted (0.0.0.0/0) ingress to RDP (3389)

  • GCP-016

    No unrestricted ingress to database ports (3306/5432/1433/27017/1521)

    No unrestricted ingress to database ports (3306/5432/1433/27017/1521)

  • GCP-017

    Default network security group/list/firewall restricts all traffic

    Default network security group/list/firewall restricts all traffic

  • GCP-018

    Object storage buckets are not publicly accessible

    Object storage buckets are not publicly accessible

  • GCP-019

    Account/org-level public-access prevention is enabled

    Account/org-level public-access prevention is enabled

  • GCP-020

    Storage encrypted at rest (default; CMK where required)

    Storage encrypted at rest (default; CMK where required)

  • GCP-021

    Encryption in transit enforced (HTTPS/TLS only)

    Encryption in transit enforced (HTTPS/TLS only)

  • GCP-022

    Versioning / soft-delete enabled on sensitive data stores

    Versioning / soft-delete enabled on sensitive data stores

  • GCP-023

    Disk/block-volume encryption at rest enabled

    Disk/block-volume encryption at rest enabled

  • GCP-024

    Compute instances have no unintended public IPs

    Compute instances have no unintended public IPs

  • GCP-025

    Managed databases use encryption / TDE

    Managed databases use encryption / TDE

  • GCP-026

    Managed databases are not publicly accessible / network-restricted

    Managed databases are not publicly accessible / network-restricted

  • GCP-027

    Automatic rotation enabled on customer-managed keys

    Automatic rotation enabled on customer-managed keys

  • GCP-028

    Key/secret store access is restricted and protected

    Key/secret store access is restricted and protected

  • GCP-029

    Budget / anomalous-spend alerts exist (abuse indicator)

    Budget / anomalous-spend alerts exist (abuse indicator)

  • GCP-030

    Deletion protection on critical resources

    Deletion protection on critical resources

  • GCP-031

    Workloads/accounts isolated for blast-radius control

    Workloads/accounts isolated for blast-radius control

  • GCP-032

    Preventive policy guardrails are assigned

    Preventive policy guardrails are assigned

  • GCP-033

    No user-managed service account keys exist (use Workload Identity)

    No user-managed service account keys exist (use Workload Identity)

  • GCP-034

    OS Login is enabled project-wide

    OS Login is enabled project-wide

  • GCP-035

    Default service account is not used and lacks primitive roles

    Default service account is not used and lacks primitive roles

  • GCP-036

    Shielded VM is enabled on instances

    Shielded VM is enabled on instances

Microsoft Azure

AZURE · 38 controls
  • AZ-001

    MFA is enforced for all users, especially privileged roles.

    MFA is enforced for all users, especially privileged roles.

  • AZ-002

    Number of Global Administrators is limited (typically 2-4).

    Number of Global Administrators is limited (typically 2-4).

  • AZ-003

    Privileged Identity Management (PIM) provides just-in-time elevation.

    Privileged Identity Management (PIM) provides just-in-time elevation.

  • AZ-004

    Legacy/basic authentication is blocked.

    Legacy/basic authentication is blocked.

  • AZ-005

    Guest user access and invitations are restricted.

    Guest user access and invitations are restricted.

  • AZ-006

    Diagnostic settings ship Activity Logs to Log Analytics / storage with retention.

    Diagnostic settings ship Activity Logs to Log Analytics / storage with retention.

  • AZ-007

    Microsoft Defender for Cloud is on the Standard/paid tier for key resource types.

    Microsoft Defender for Cloud is on the Standard/paid tier for key resource types.

  • AZ-008

    Activity-log alerts exist for critical changes (NSG, security policy, Key Vault).

    Activity-log alerts exist for critical changes (NSG, security policy, Key Vault).

  • AZ-009

    No NSG allows unrestricted inbound RDP (3389) from the internet.

    No NSG allows unrestricted inbound RDP (3389) from the internet.

  • AZ-010

    No NSG allows unrestricted inbound SSH (22) from the internet.

    No NSG allows unrestricted inbound SSH (22) from the internet.

  • AZ-011

    NSG flow logs are enabled.

    NSG flow logs are enabled.

  • AZ-012

    Storage accounts disallow public blob access.

    Storage accounts disallow public blob access.

  • AZ-013

    Secure transfer (HTTPS-only) is required.

    Secure transfer (HTTPS-only) is required.

  • AZ-014

    Storage account network rules default to Deny with explicit allow-lists.

    Storage account network rules default to Deny with explicit allow-lists.

  • AZ-015

    Storage blob soft delete is enabled.

    Storage blob soft delete is enabled.

  • AZ-016

    Key Vaults have soft-delete and purge protection enabled.

    Key Vaults have soft-delete and purge protection enabled.

  • AZ-017

    Key Vault network access is restricted (firewall / private endpoint).

    Key Vault network access is restricted (firewall / private endpoint).

  • AZ-018

    VM OS and data disks are encrypted (ADE/CMK or platform encryption).

    VM OS and data disks are encrypted (ADE/CMK or platform encryption).

  • AZ-019

    VMs use managed disks (not unmanaged page blobs).

    VMs use managed disks (not unmanaged page blobs).

  • AZ-020

    Azure SQL auditing is enabled.

    Azure SQL auditing is enabled.

  • AZ-021

    Transparent Data Encryption (TDE) is enabled.

    Transparent Data Encryption (TDE) is enabled.

  • AZ-022

    SQL server firewall does not allow 0.0.0.0 (all internet).

    SQL server firewall does not allow 0.0.0.0 (all internet).

  • AZ-023

    Microsoft Defender for SQL (threat detection) is enabled.

    Microsoft Defender for SQL (threat detection) is enabled.

  • AZ-024

    Resource locks protect critical resources from deletion.

    Resource locks protect critical resources from deletion.

  • AZ-025

    Azure Policy assigns guardrails for required configurations.

    Azure Policy assigns guardrails for required configurations.

  • AZ-026

    Strong password policy enforced (length, complexity, reuse, lockout)

    Strong password policy enforced (length, complexity, reuse, lockout)

  • AZ-027

    No identity holds unrestricted wildcard/admin (*:* or owner) rights beyond a justified few

    No identity holds unrestricted wildcard/admin (*:* or owner) rights beyond a justified few

  • AZ-028

    Long-lived credentials/keys rotated at least every 90 days (or eliminated)

    Long-lived credentials/keys rotated at least every 90 days (or eliminated)

  • AZ-029

    Credentials unused for 90+ days are disabled

    Credentials unused for 90+ days are disabled

  • AZ-030

    Permissions granted via groups/roles, not directly to individual users

    Permissions granted via groups/roles, not directly to individual users

  • AZ-031

    Audit logs protected from tampering and encrypted

    Audit logs protected from tampering and encrypted

  • AZ-032

    No unrestricted ingress to database ports (3306/5432/1433/27017/1521)

    No unrestricted ingress to database ports (3306/5432/1433/27017/1521)

  • AZ-033

    Default network security group/list/firewall restricts all traffic

    Default network security group/list/firewall restricts all traffic

  • AZ-034

    Storage encrypted at rest (default; CMK where required)

    Storage encrypted at rest (default; CMK where required)

  • AZ-035

    Compute instances have no unintended public IPs

    Compute instances have no unintended public IPs

  • AZ-036

    Automatic rotation enabled on customer-managed keys

    Automatic rotation enabled on customer-managed keys

  • AZ-037

    Budget / anomalous-spend alerts exist (abuse indicator)

    Budget / anomalous-spend alerts exist (abuse indicator)

  • AZ-038

    Workloads/accounts isolated for blast-radius control

    Workloads/accounts isolated for blast-radius control

Oracle Cloud Infrastructure (OCI)

OCI · 31 controls
  • OCI-001

    MFA is enforced for all IAM users, especially administrators.

    MFA is enforced for all IAM users, especially administrators.

  • OCI-002

    Customer secret keys / API keys are rotated regularly (<=90 days).

    Customer secret keys / API keys are rotated regularly (<=90 days).

  • OCI-003

    A strong password policy is configured.

    A strong password policy is configured.

  • OCI-004

    Membership of the Administrators group is minimal.

    Membership of the Administrators group is minimal.

  • OCI-005

    IAM policies follow least privilege (no broad 'manage all-resources').

    IAM policies follow least privilege (no broad 'manage all-resources').

  • OCI-006

    Audit log retention is set to the maximum (365 days).

    Audit log retention is set to the maximum (365 days).

  • OCI-007

    Oracle Cloud Guard is enabled at tenancy root.

    Oracle Cloud Guard is enabled at tenancy root.

  • OCI-008

    VCN Flow Logs are enabled.

    VCN Flow Logs are enabled.

  • OCI-009

    Notifications/Events alert on IAM, network and policy changes.

    Notifications/Events alert on IAM, network and policy changes.

  • OCI-010

    Security lists do not allow unrestricted SSH (22) from 0.0.0.0/0.

    Security lists do not allow unrestricted SSH (22) from 0.0.0.0/0.

  • OCI-011

    Security lists do not allow unrestricted RDP (3389) from 0.0.0.0/0.

    Security lists do not allow unrestricted RDP (3389) from 0.0.0.0/0.

  • OCI-012

    Default security list of each VCN restricts traffic.

    Default security list of each VCN restricts traffic.

  • OCI-013

    No Object Storage bucket has public access.

    No Object Storage bucket has public access.

  • OCI-014

    Buckets use customer-managed encryption keys where required.

    Buckets use customer-managed encryption keys where required.

  • OCI-015

    Versioning is enabled on sensitive buckets.

    Versioning is enabled on sensitive buckets.

  • OCI-016

    Vault keys have rotation configured.

    Vault keys have rotation configured.

  • OCI-017

    Block volumes are encrypted (default or CMK).

    Block volumes are encrypted (default or CMK).

  • OCI-018

    Compute instances have no unintended public IPs.

    Compute instances have no unintended public IPs.

  • OCI-019

    Database systems use encryption / TDE.

    Database systems use encryption / TDE.

  • OCI-020

    Autonomous Database network access is restricted (private endpoint / ACLs).

    Autonomous Database network access is restricted (private endpoint / ACLs).

  • OCI-021

    Compartment structure and IAM boundaries isolate workloads.

    Compartment structure and IAM boundaries isolate workloads.

  • OCI-022

    Budget alerts detect anomalous spend (abuse indicator).

    Budget alerts detect anomalous spend (abuse indicator).

  • OCI-023

    Credentials unused for 90+ days are disabled

    Credentials unused for 90+ days are disabled

  • OCI-024

    Permissions granted via groups/roles, not directly to individual users

    Permissions granted via groups/roles, not directly to individual users

  • OCI-025

    Audit logs protected from tampering and encrypted

    Audit logs protected from tampering and encrypted

  • OCI-026

    No unrestricted ingress to database ports (3306/5432/1433/27017/1521)

    No unrestricted ingress to database ports (3306/5432/1433/27017/1521)

  • OCI-027

    Account/org-level public-access prevention is enabled

    Account/org-level public-access prevention is enabled

  • OCI-028

    Encryption in transit enforced (HTTPS/TLS only)

    Encryption in transit enforced (HTTPS/TLS only)

  • OCI-029

    Key/secret store access is restricted and protected

    Key/secret store access is restricted and protected

  • OCI-030

    Deletion protection on critical resources

    Deletion protection on critical resources

  • OCI-031

    Preventive policy guardrails are assigned

    Preventive policy guardrails are assigned

See Cloud Security tested against your evidence.

Book a demo All frameworks