Devolutions.CIEM
0.3.28
Cloud Infrastructure Entitlement Management (CIEM) module for Azure identity and access security checks. Provides 46 identity-focused checks for Entra ID, IAM/RBAC, KeyVault, and Storage services.
Minimum PowerShell version
7.4
Installation Options
Owners
Copyright
(c) 2025 Devolutions Inc. All rights reserved.
Package Details
Author(s)
- Adam Bertram
Tags
Azure CIEM Security Identity IAM Entra RBAC Compliance PowerShellUniversal app
PSEditions
Dependencies
This module has no dependencies.
Release Notes
## 0.2.65 - PSU Cache Configuration Storage
- Migrated configuration from config.json to PSU persistent cache
- Config is now stored in PSU cache with key 'CIEM:Config'
- Added Get-CIEMDefaultConfig (Private) - returns hardcoded defaults
- Added Reset-CIEMConfig (Public) - resets config to defaults
- Removed config.json file and Get-CIEMConfigPath function
- Configuration automatically initializes with defaults on first run
## 0.2.20 - Dashboard Function Scope Fix
- Fixed: Get-CIEMConfigPath not found at dashboard runtime
- Moved Get-CIEMConfigPath from nested function to Private module function
- Function is now dot-sourced at module load, available to PSU dashboard pages
## 0.2.19 - Code Quality Improvements
- Renamed Get-CIEMRequiredPermissions to Get-CIEMRequiredPermission (singular noun)
- Fixed PSScriptAnalyzer warnings for return statements
- Fixed helper function naming to avoid ShouldProcess requirements
- Improved code structure in Get-PSUInstalledEnvironment and Get-CIEMRequiredPermission
- Added proper begin/process block structure to Set-CIEMConfig
- Added suppression attributes for PSU dashboard callback return statements
## 0.2.14 - Multi-Provider Authentication Support
- Renamed "Azure Authentication" to "Cloud Provider Authentication"
- Added Provider dropdown (Azure enabled, AWS coming soon)
- Added comprehensive Azure authentication methods:
- Current Context (existing Az PowerShell session)
- Service Principal with Client Secret
- Service Principal with Certificate (thumbprint or file path)
- Managed Identity (system-assigned or user-assigned)
- Device Code (for MFA/restricted environments)
- Interactive Browser
- Dynamic input fields based on selected authentication method
- Updated config.json schema for multi-provider support
- Prepared AWS configuration structure for future release
## 0.2.12 - PSU Environment Auto-Detection
- Added Get-PSUInstalledEnvironment function to detect Azure Web App vs on-premises deployment
- Configuration page now displays deployment environment with visual indicator
- Managed Identity auth option shows warning when running on-premises
- Prevents saving Managed Identity configuration in unsupported environments
## 0.2.7 - PSResourceGet Publishing Fix
- Switched from Publish-Module to Publish-PSResource for publishing
- Root cause: PowerShellGet v2's Publish-Module uses Get-ChildItem WITHOUT -Force
- This excludes hidden directories (.universal) on Unix systems (macOS/Linux)
- PSResourceGet uses .NET Directory.GetFiles/GetDirectories which includes all files
- See: https://github.com/PowerShell/PowerShellGetv2/blob/master/src/PowerShellGet/public/psgetfunctions/Publish-Module.ps1
## 0.2.6 - FileList Fix for .universal Directory (Failed)
- Added explicit FileList to manifest to include .universal/dashboards.ps1
- Publish-Module was excluding dot-prefixed directories without FileList
## 0.2.5 - PSU App Auto-Registration (Republish)
- Republish to verify .universal directory is included in package
## 0.2.4 - PSU App Auto-Registration Fix
- Fixed: Include .universal directory in published module
- PSU now auto-discovers and creates the CIEM app when module is installed
- App registration uses -Module/-Command pattern for PSU Gallery compatibility
## 0.2.0 - PSU App Integration
- Added New-DevolutionsCIEMApp function for PSU module-based discovery
- Switched from -FilePath to -Module/-Command pattern for PSU Gallery compatibility
- App now auto-discovers when module is installed to PSU Modules directory
## 0.1.0 - Initial Release
- 46 Azure identity-focused security checks
- Entra ID: 15 checks (MFA, conditional access, security defaults, etc.)
- IAM/RBAC: 3 checks (custom roles, permissions)
- KeyVault: 10 checks (access policies, RBAC, expiration)
- Storage: 18 checks (access controls, encryption, network rules)
- Parallel check execution with ForEach-Object -Parallel
- Auto-detect Azure authentication (Managed Identity, CLI, Interactive)
FileList
- Devolutions.CIEM.nuspec
- ciem_checks.json
- Checks\Azure\Test-EntraNonPrivilegedUserHasMfa.ps1
- Checks\Aws\Test-Wafv2WebaclRuleLoggingEnabled.ps1
- Checks\Aws\Test-CloudwatchAlarmActionsAlarmStateConfigured.ps1
- Checks\Aws\Test-EksClusterKmsCmkEncryptionInSecretsEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortMemcachedExposedToInternet.ps1
- Checks\Aws\Test-AwslambdaFunctionUrlCorsPolicy.ps1
- Checks\Aws\Test-ElasticacheRedisClusterAutomaticFailoverEnabled.ps1
- Checks\Aws\Test-RedshiftClusterMultiAzEnabled.ps1
- Checks\Aws\Test-MacieAutomatedSensitiveDataDiscoveryEnabled.ps1
- Checks\Aws\Test-CloudfrontDistributionsHttpsSniEnabled.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterRootUsage.ps1
- Devolutions.CIEM.psm1
- Checks\Azure\Test-EntraPrivilegedUserHasMfa.ps1
- Checks\Aws\Test-Elbv2NlbTlsTerminationEnabled.ps1
- Checks\Aws\Test-NetworkfirewallInAllVpc.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterAwsOrganizationsChanges.ps1
- Checks\Aws\Test-CognitoUserPoolDeletionProtectionEnabled.ps1
- Checks\Aws\Test-DmsInstanceMinorVersionUpgradeEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortKafka9092.ps1
- Checks\Aws\Test-BedrockModelInvocationLoggingEnabled.ps1
- Checks\Aws\Test-CodebuildProjectUsesAllowedGithubOrganizations.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortPostgres5432.ps1
- Checks\Aws\Test-Elbv2InsecureSslCiphers.ps1
- Devolutions.CIEM.psd1
- Checks\Azure\Test-KeyvaultKeyRotationEnabled.ps1
- Checks\Aws\Test-NetworkfirewallDeletionProtection.ps1
- Checks\Aws\Test-GuarddutyEc2MalwareProtectionEnabled.ps1
- Checks\Aws\Test-AutoscalingGroupMultipleInstanceTypes.ps1
- Checks\Aws\Test-SagemakerTrainingJobsVpcSettingsConfigured.ps1
- Checks\Aws\Test-S3MultiRegionAccessPointPublicAccessBlock.ps1
- Checks\Aws\Test-FirehoseStreamEncryptedAtRest.ps1
- Checks\Aws\Test-S3BucketServerAccessLoggingEnabled.ps1
- Checks\Aws\Test-RedshiftClusterEnhancedVpcRouting.ps1
- Checks\Aws\Test-Wafv2WebaclLoggingEnabled.ps1
- Checks\Aws\Test-EksClusterDeletionProtectionEnabled.ps1
- Checks\Azure\Test-KeyvaultLoggingEnabled.ps1
- Checks\Aws\Test-AwslambdaFunctionUsingSupportedRuntimes.ps1
- Checks\Aws\Test-OrganizationsDelegatedAdministrators.ps1
- Checks\Aws\Test-CloudfrontDistributionsHttpsEnabled.ps1
- Checks\Aws\Test-GuarddutyEksRuntimeMonitoringEnabled.ps1
- Checks\Aws\Test-Ec2EbsDefaultEncryption.ps1
- Checks\Aws\Test-OpensearchServiceDomainsInternalUserDatabaseEnabled.ps1
- Checks\Aws\Test-WafRegionalRuleWithConditions.ps1
- Checks\Aws\Test-VpcSubnetSeparatePrivatePublic.ps1
- Checks\Aws\Test-RdsInstanceMultiAz.ps1
- Checks\Aws\Test-IamSupportRoleCreated.ps1
- Classes\CIEMScanResult.ps1
- Checks\Azure\Test-IamSubscriptionRolesOwnerCustomNotCreated.ps1
- Checks\Aws\Test-DocumentdbClusterCloudwatchLogExport.ps1
- Checks\Aws\Test-ShieldAdvancedProtectionInCloudfrontDistributions.ps1
- Checks\Aws\Test-CloudfrontDistributionsLoggingEnabled.ps1
- Checks\Aws\Test-Ec2EbsVolumeEncryption.ps1
- Checks\Aws\Test-CloudtrailThreatDetectionPrivilegeEscalation.ps1
- Checks\Aws\Test-S3BucketPublicWriteAcl.ps1
- Checks\Aws\Test-KafkaClusterUsesLatestVersion.ps1
- Checks\Aws\Test-SqsQueuesNotPubliclyAccessible.ps1
- Checks\Aws\Test-IamPasswordPolicyNumber.ps1
- Checks\Aws\Test-ElbConnectionDrainingEnabled.ps1
- Classes\CIEMCheck.ps1
- Checks\Azure\Test-KeyvaultKeyExpirationSetInNonRbac.ps1
- Checks\Aws\Test-EcsTaskDefinitionsLoggingEnabled.ps1
- Checks\Aws\Test-VpcFlowLogsEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortLdapExposedToInternet.ps1
- Checks\Aws\Test-Ec2InstanceInternetFacingWithInstanceProfile.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterDisableOrScheduledDeletionOfKmsCmk.ps1
- Checks\Aws\Test-IamRootHardwareMfaEnabled.ps1
- Checks\Aws\Test-AppsyncFieldLevelLoggingEnabled.ps1
- Checks\Aws\Test-NeptuneClusterPublicSnapshot.ps1
- Checks\Aws\Test-GlueDevelopmentEndpointsS3EncryptionEnabled.ps1
- Checks\Aws\Test-OrganizationsOptOutAiServicesPolicy.ps1
- .universal\dashboards.ps1
- Checks\Azure\Test-StorageGeoRedundantEnabled.ps1
- Checks\Aws\Test-EmrClusterAccountPublicBlockEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortElasticsearchKibana920093005601.ps1
- Checks\Aws\Test-AutoscalingFindSecretsEc2LaunchConfiguration.ps1
- Checks\Aws\Test-MqBrokerLoggingEnabled.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterAndAlarmForCloudtrailConfigurationChangesEnabled.ps1
- Checks\Aws\Test-VpcSubnetDifferentAz.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterAndAlarmForAwsConfigConfigurationChangesEnabled.ps1
- Checks\Aws\Test-CloudfrontDistributionsGeoRestrictionsEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupFromLaunchWizard.ps1
- Checks\Aws\Test-S3BucketPublicAccess.ps1
- Public\Get-PSUInstalledEnvironment.ps1
- Checks\Azure\Test-StorageSmbChannelEncryptionWithSecureAlgorithm.ps1
- Checks\Aws\Test-GlueEtlJobsAmazonS3EncryptionEnabled.ps1
- Checks\Aws\Test-EfsMultiAzEnabled.ps1
- Checks\Aws\Test-CognitoUserPoolPasswordPolicyLowercase.ps1
- Checks\Aws\Test-RdsClusterCopyTagsToSnapshots.ps1
- Checks\Aws\Test-NetworkfirewallPolicyDefaultActionFragmentedPackets.ps1
- Checks\Aws\Test-SagemakerNotebookInstanceVpcSettingsConfigured.ps1
- Checks\Aws\Test-ConfigRecorderAllRegionsEnabled.ps1
- Checks\Aws\Test-RedshiftClusterNonDefaultUsername.ps1
- Checks\Aws\Test-KmsKeyNotPubliclyAccessible.ps1
- Checks\Aws\Test-OpensearchServiceDomainsAuditLoggingEnabled.ps1
- Public\Get-CIEMRequiredPermission.ps1
- Checks\Azure\Test-KeyvaultPublicNetworkAccessDisabled.ps1
- Checks\Aws\Test-KmsCmkAreUsed.ps1
- Checks\Aws\Test-GlueDevelopmentEndpointsCloudwatchLogsEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortTelnetExposedToInternet.ps1
- Checks\Aws\Test-CognitoUserPoolBlocksPotentialMaliciousSignInAttempts.ps1
- Checks\Aws\Test-DynamodbAcceleratorClusterMultiAz.ps1
- Checks\Aws\Test-DynamodbTablesKmsCmkEncryptionEnabled.ps1
- Checks\Aws\Test-DirectconnectVirtualInterfaceRedundancy.ps1
- Checks\Aws\Test-DocumentdbClusterStorageEncrypted.ps1
- Checks\Aws\Test-RdsInstanceCertificateExpiration.ps1
- Checks\Aws\Test-RdsInstanceBackupEnabled.ps1
- Public\New-PSUAzureServicePrincipal.ps1
- Checks\Azure\Test-StorageInfrastructureEncryptionIsEnabled.ps1
- Checks\Aws\Test-Ec2InstancePublicIp.ps1
- Checks\Aws\Test-Elbv2ListenersUnderneath.ps1
- Checks\Aws\Test-Ec2InstanceImdsv2Enabled.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterPolicyChanges.ps1
- Checks\Aws\Test-ElbIsInMultipleAz.ps1
- Checks\Aws\Test-RedshiftClusterAutomaticUpgrades.ps1
- Checks\Aws\Test-CognitoUserPoolWafAclAttached.ps1
- Checks\Aws\Test-NetworkfirewallPolicyRuleGroupAssociated.ps1
- Checks\Aws\Test-ElbSslListenersUseAcmCertificate.ps1
- Checks\Aws\Test-SsmincidentsEnabledWithPlans.ps1
- Public\New-CIEMAzureManagedIdentity.ps1
- Checks\Azure\Test-StorageDefaultToEntraAuthorizationEnabled.ps1
- Checks\Aws\Test-S3BucketAclProhibited.ps1
- Checks\Aws\Test-AthenaWorkgroupLoggingEnabled.ps1
- Checks\Aws\Test-EksClusterNetworkPolicyEnabled.ps1
- Checks\Aws\Test-IamInlinePolicyAllowsPrivilegeEscalation.ps1
- Checks\Aws\Test-GlueEtlJobsJobBookmarkEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToAllPorts.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortOracle15212483.ps1
- Checks\Aws\Test-WafGlobalWebaclWithRules.ps1
- Checks\Aws\Test-Ec2InstancePortKafkaExposedToInternet.ps1
- Checks\Aws\Test-AutoscalingGroupElbHealthCheckEnabled.ps1
- Public\Get-CIEMProvider.ps1
- Checks\Azure\Test-StorageEnsureEncryptionWithCustomerManagedKey.ps1
- Checks\Aws\Test-AppsyncGraphqlApiNoApiKeyAuthentication.ps1
- Checks\Aws\Test-Ec2InstancePortMysqlExposedToInternet.ps1
- Checks\Aws\Test-CodebuildProjectUserControlledBuildspec.ps1
- Checks\Aws\Test-EksControlPlaneLoggingAllTypesEnabled.ps1
- Checks\Aws\Test-BedrockApiKeyNoLongTermCredentials.ps1
- Checks\Aws\Test-DmsInstanceNoPublicAccess.ps1
- Checks\Aws\Test-IamUserWithTemporaryCredentials.ps1
- Checks\Aws\Test-DirectoryserviceLdapCertificateExpiration.ps1
- Checks\Aws\Test-EcrRepositoriesLifecyclePolicyEnabled.ps1
- Checks\Aws\Test-CodebuildProjectNotPubliclyAccessible.ps1
- Public\Get-CIEMAuthenticationContext.ps1
- Checks\Azure\Test-KeyvaultNonRbacSecretExpirationSet.ps1
- Checks\Aws\Test-GlueEtlJobsLoggingEnabled.ps1
- Checks\Aws\Test-SagemakerTrainingJobsVolumeAndOutputEncryptionEnabled.ps1
- Checks\Aws\Test-AccountSecurityQuestionsAreRegisteredInTheAwsAccount.ps1
- Checks\Aws\Test-SsmManagedCompliantPatching.ps1
- Checks\Aws\Test-CloudformationStacksTerminationProtectionEnabled.ps1
- Checks\Aws\Test-WorkspacesVpc2private1publicSubnetsNat.ps1
- Checks\Aws\Test-ApigatewayRestapiCacheEncrypted.ps1
- Checks\Aws\Test-Ec2InstancePortOracleExposedToInternet.ps1
- Checks\Aws\Test-IamRoleCrossAccountReadonlyaccessPolicy.ps1
- Checks\Aws\Test-Ec2AmiPublic.ps1
- Public\Test-CIEMAuthenticated.ps1
- Checks\Azure\Test-EntraGlobalAdminCountWithinLimit.ps1
- Checks\Aws\Test-MqBrokerNotPubliclyAccessible.ps1
- Checks\Aws\Test-IamPasswordPolicyMinimumLength14.ps1
- Checks\Aws\Test-NetworkfirewallLoggingEnabled.ps1
- Checks\Aws\Test-DirectconnectConnectionRedundancy.ps1
- Checks\Aws\Test-OpensearchServiceDomainsFaultTolerantDataNodes.ps1
- Checks\Aws\Test-IamPasswordPolicyExpiresPasswordsWithin90DaysOrLess.ps1
- Checks\Aws\Test-AppstreamFleetSessionIdleDisconnectTimeout.ps1
- Checks\Aws\Test-OpensearchServiceDomainsHttpsCommunicationsEnforced.ps1
- Checks\Aws\Test-CloudtrailMultiRegionEnabledLoggingManagementEvents.ps1
- Checks\Aws\Test-SqsQueuesServerSideEncryptionEnabled.ps1
- Public\Get-CIEMSecret.ps1
- Checks\Azure\Test-StorageBlobVersioningIsEnabled.ps1
- Checks\Aws\Test-CognitoIdentityPoolGuestAccessDisabled.ps1
- Checks\Aws\Test-RdsInstanceDefaultAdmin.ps1
- Checks\Aws\Test-WafGlobalWebaclLoggingEnabled.ps1
- Checks\Aws\Test-S3AccessPointPublicAccessBlock.ps1
- Checks\Aws\Test-CodebuildProjectS3LogsEncrypted.ps1
- Checks\Aws\Test-IamUserAccesskeyUnused.ps1
- Checks\Aws\Test-RedshiftClusterEncryptedAtRest.ps1
- Checks\Aws\Test-RdsClusterNonDefaultPort.ps1
- Checks\Aws\Test-BackupVaultsEncrypted.ps1
- Checks\Aws\Test-LightsailInstancePublic.ps1
- Public\Sync-ProwlerCheck.ps1
- Checks\Azure\Test-EntraPolicyEnsureDefaultUserCannotCreateTenant.ps1
- Checks\Aws\Test-ShieldAdvancedProtectionInInternetFacingLoadBalancers.ps1
- Checks\Aws\Test-VpcEndpointMultiAzEnabled.ps1
- Checks\Aws\Test-VpcVpnConnectionTunnelsUp.ps1
- Checks\Aws\Test-IamNoRootAccessKey.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortCassandra719991608888.ps1
- Checks\Aws\Test-CodeartifactPackagesExternalPublicPublishingDisabled.ps1
- Checks\Aws\Test-ApigatewayRestapiTracingEnabled.ps1
- Checks\Aws\Test-IamUserConsoleAccessUnused.ps1
- Checks\Aws\Test-RdsClusterDefaultAdmin.ps1
- Checks\Aws\Test-DmsEndpointRedisInTransitEncryptionEnabled.ps1
- Public\Get-CIEMCheck.ps1
- Checks\Azure\Test-EntraUserCannotCreateMicrosoft365Group.ps1
- Checks\Aws\Test-EventbridgeSchemaRegistryCrossAccountAccess.ps1
- Checks\Aws\Test-Ec2EbsSnapshotAccountBlockPublicAccess.ps1
- Checks\Aws\Test-DynamodbTableProtectedByBackupPlan.ps1
- Checks\Aws\Test-CognitoUserPoolSelfRegistrationDisabled.ps1
- Checks\Aws\Test-EksClusterNotPubliclyAccessible.ps1
- Checks\Aws\Test-FsxFileSystemCopyTagsToVolumesEnabled.ps1
- Checks\Aws\Test-IamRoleCrossServiceConfusedDeputyPrevention.ps1
- Checks\Aws\Test-RdsInstanceProtectedByBackupPlan.ps1
- Checks\Aws\Test-S3BucketCrossRegionReplication.ps1
- Checks\Aws\Test-CognitoUserPoolClientPreventUserExistenceErrors.ps1
- Public\Get-CIEMDefaultConfig.ps1
- Checks\Azure\Test-StorageEnsureSoftDeleteIsEnabled.ps1
- Checks\Aws\Test-CloudfrontDistributionsDefaultRootObject.ps1
- Checks\Aws\Test-Ec2LaunchTemplateNoSecrets.ps1
- Checks\Aws\Test-Route53DomainsTransferlockEnabled.ps1
- Checks\Aws\Test-RedshiftClusterAuditLogging.ps1
- Checks\Aws\Test-ElbInternetFacing.ps1
- Checks\Aws\Test-Elbv2WafAclAttached.ps1
- Checks\Aws\Test-ApigatewayRestapiPublicWithAuthorizer.ps1
- Checks\Aws\Test-CloudtrailLogFileValidationEnabled.ps1
- Checks\Aws\Test-BackupPlansExist.ps1
- Checks\Aws\Test-CognitoUserPoolBlocksCompromisedCredentialsSignInAttempts.ps1
- Public\Get-ProwlerCheck.ps1
- Checks\Azure\Test-EntraPolicyEnsureDefaultUserCannotCreateApp.ps1
- Checks\Aws\Test-CognitoUserPoolPasswordPolicyNumber.ps1
- Checks\Aws\Test-LightsailDatabasePublic.ps1
- Checks\Aws\Test-CloudtrailLogsS3BucketIsNotPubliclyAccessible.ps1
- Checks\Aws\Test-DocumentdbClusterMultiAzEnabled.ps1
- Checks\Aws\Test-VpcPeeringRoutingTablesWithLeastPrivilege.ps1
- Checks\Aws\Test-S3BucketObjectVersioning.ps1
- Checks\Aws\Test-WafRegionalRulegroupNotEmpty.ps1
- Checks\Aws\Test-KafkaClusterIsPublic.ps1
- Checks\Aws\Test-LightsailStaticIpUnused.ps1
- Checks\Aws\Test-OpensearchServiceDomainsUpdatedToTheLatestServiceSoftwareVersion.ps1
- Public\Invoke-CIEMScan.ps1
- Checks\Azure\Test-StorageEnsureFileSharesSoftDeleteIsEnabled.ps1
- Checks\Aws\Test-NeptuneClusterCopyTagsToSnapshots.ps1
- Checks\Aws\Test-EcsServiceFargateLatestPlatformVersion.ps1
- Checks\Aws\Test-RdsInstanceMinorVersionUpgradeEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToHighRiskTcpPorts.ps1
- Checks\Aws\Test-AwslambdaFunctionNotPubliclyAccessible.ps1
- Checks\Aws\Test-AutoscalingGroupCapacityRebalanceEnabled.ps1
- Checks\Aws\Test-SesIdentityNotPubliclyAccessible.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterAuthenticationFailures.ps1
- Checks\Aws\Test-OrganizationsScpCheckDenyRegions.ps1
- Checks\Aws\Test-SecretsmanagerAutomaticRotationEnabled.ps1
- Public\Write-CIEMLog.ps1
- Checks\Azure\Test-IamCustomRoleHasPermissionToAdministerResourceLock.ps1
- Checks\Aws\Test-CloudfrontDistributionsUsingDeprecatedSslProtocols.ps1
- Checks\Aws\Test-ApigatewayRestapiPublic.ps1
- Checks\Aws\Test-KafkaClusterInTransitEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2InstanceOlderThanSpecificDays.ps1
- Checks\Aws\Test-S3BucketLifecycleEnabled.ps1
- Checks\Aws\Test-EcsClusterContainerInsightsEnabled.ps1
- Checks\Aws\Test-S3BucketKmsEncryption.ps1
- Checks\Aws\Test-CognitoUserPoolPasswordPolicyUppercase.ps1
- Checks\Aws\Test-SnsTopicsNotPubliclyAccessible.ps1
- Checks\Aws\Test-AutoscalingGroupLaunchConfigurationNoPublicIp.ps1
- Public\Get-CIEMConfig.ps1
- Checks\Azure\Test-KeyvaultRbacEnabled.ps1
- Checks\Aws\Test-CloudfrontDistributionsMultipleOriginFailoverConfigured.ps1
- Checks\Aws\Test-VpcEndpointForEc2Enabled.ps1
- Checks\Aws\Test-Ec2NetworkaclUnused.ps1
- Checks\Aws\Test-EfsAccessPointEnforceUserIdentity.ps1
- Checks\Aws\Test-AutoscalingGroupLaunchConfigurationRequiresImdsv2.ps1
- Checks\Aws\Test-CodepipelineProjectRepoPrivate.ps1
- Checks\Aws\Test-Resourceexplorer2IndexesFound.ps1
- Checks\Aws\Test-AthenaWorkgroupEnforceConfiguration.ps1
- Checks\Aws\Test-NeptuneClusterBackupEnabled.ps1
- Checks\Aws\Test-DrsJobExist.ps1
- Public\Connect-CIEM.ps1
- Checks\Azure\Test-EntraConditionalAccessPolicyRequireMfaForManagementApi.ps1
- Checks\Aws\Test-CognitoUserPoolTemporaryPasswordExpiration.ps1
- Checks\Aws\Test-ServicecatalogPortfolioSharedWithinOrganizationOnly.ps1
- Checks\Aws\Test-ElasticacheRedisClusterInTransitEncryptionEnabled.ps1
- Checks\Aws\Test-WafGlobalRulegroupNotEmpty.ps1
- Checks\Aws\Test-Route53PublicHostedZonesCloudwatchLoggingEnabled.ps1
- Checks\Aws\Test-StepfunctionsStatemachineLoggingEnabled.ps1
- Checks\Aws\Test-EksClusterPrivateNodesEnabled.ps1
- Checks\Aws\Test-S3BucketEventNotificationsEnabled.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterSignInWithoutMfa.ps1
- Checks\Aws\Test-DmsInstanceMultiAzEnabled.ps1
- Public\Set-CIEMConfig.ps1
- Checks\Azure\Test-StorageKeyRotation90Day.ps1
- Checks\Aws\Test-CloudfrontDistributionsOriginTrafficEncrypted.ps1
- Checks\Aws\Test-OpensearchServiceDomainsFaultTolerantMasterNodes.ps1
- Checks\Aws\Test-DocumentdbClusterPublicSnapshot.ps1
- Checks\Aws\Test-IamPolicyAllowsPrivilegeEscalation.ps1
- Checks\Aws\Test-GlueMlTransformEncryptedAtRest.ps1
- Checks\Aws\Test-SagemakerTrainingJobsNetworkIsolationEnabled.ps1
- Checks\Aws\Test-CloudwatchChangesToNetworkGatewaysAlarmConfigured.ps1
- Checks\Aws\Test-DynamodbTableCrossAccountAccess.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortTelnet23.ps1
- Checks\Aws\Test-AwslambdaFunctionNoSecretsInVariables.ps1
- Public\Reset-CIEMConfig.ps1
- Checks\Azure\Test-KeyvaultRecoverable.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortRedis6379.ps1
- Checks\Aws\Test-AcmCertificatesExpirationCheck.ps1
- Checks\Aws\Test-Ec2InstancePortCifsExposedToInternet.ps1
- Checks\Aws\Test-EcsTaskDefinitionsHostNetworkingModeUsers.ps1
- Checks\Aws\Test-S3BucketPublicListAcl.ps1
- Checks\Aws\Test-IamInlinePolicyNoAdministrativePrivileges.ps1
- Checks\Aws\Test-CloudfrontDistributionsS3OriginNonExistentBucket.ps1
- Checks\Aws\Test-RdsClusterBacktrackEnabled.ps1
- Checks\Aws\Test-Ec2ClientVpnEndpointConnectionLoggingEnabled.ps1
- Checks\Aws\Test-SecretsmanagerNotPubliclyAccessible.ps1
- Public\New-CIEMUIContent.ps1
- Checks\Azure\Test-EntraPolicyGuestInviteOnlyForAdminRole.ps1
- Checks\Aws\Test-NeptuneClusterUsesPublicSubnet.ps1
- Checks\Aws\Test-IamPasswordPolicySymbol.ps1
- Checks\Aws\Test-KafkaClusterEncryptionAtRestUsesCmk.ps1
- Checks\Aws\Test-TransferServerInTransitEncryptionEnabled.ps1
- Checks\Aws\Test-AppstreamFleetSessionDisconnectTimeout.ps1
- Checks\Aws\Test-Elbv2DeletionProtection.ps1
- Checks\Aws\Test-IamUserNoSetupInitialAccessKey.ps1
- Checks\Aws\Test-EventbridgeBusCrossAccountAccess.ps1
- Checks\Aws\Test-GuarddutyS3ProtectionEnabled.ps1
- Checks\Aws\Test-Ec2EbsSnapshotsEncrypted.ps1
- Public\Get-CIEMScanResult.ps1
- Checks\Azure\Test-EntraSecurityDefaultsEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortRedisExposedToInternet.ps1
- Checks\Aws\Test-RdsInstanceDeletionProtection.ps1
- Checks\Aws\Test-RdsClusterProtectedByBackupPlan.ps1
- Checks\Aws\Test-CodebuildProjectLoggingEnabled.ps1
- Checks\Aws\Test-EcrRepositoriesTagImmutability.ps1
- Checks\Aws\Test-Ec2InstanceAccountImdsv2Enabled.ps1
- Checks\Aws\Test-BackupVaultsExist.ps1
- Checks\Aws\Test-DmsEndpointNeptuneIamAuthorizationEnabled.ps1
- Checks\Aws\Test-RdsInstanceEventSubscriptionParameterGroups.ps1
- Checks\Aws\Test-ShieldAdvancedProtectionInGlobalAccelerators.ps1
- Public\Get-CIEMScanRun.ps1
- Checks\Azure\Test-StorageEnsureAzureServicesAreTrustedToAccessIsEnabled.ps1
- Checks\Aws\Test-WafRegionalWebaclWithRules.ps1
- Checks\Aws\Test-RdsInstanceNoPublicAccess.ps1
- Checks\Aws\Test-IamUserTwoActiveAccessKey.ps1
- Checks\Aws\Test-GlueDataCatalogsNotPubliclyAccessible.ps1
- Checks\Aws\Test-ElbCrossZoneLoadBalancingEnabled.ps1
- Checks\Aws\Test-VpcEndpointConnectionsTrustBoundaries.ps1
- Checks\Aws\Test-NeptuneClusterSnapshotEncrypted.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterUnauthorizedApiCalls.ps1
- Checks\Aws\Test-IamAwsAttachedPolicyNoAdministrativePrivileges.ps1
- Checks\Aws\Test-CognitoUserPoolPasswordPolicySymbol.ps1
- Public\New-DevolutionsCIEMApp.ps1
- Checks\Azure\Test-EntraPolicyGuestUserAccessRestriction.ps1
- Checks\Aws\Test-StoragegatewayFileshareEncryptionEnabled.ps1
- Checks\Aws\Test-CloudtrailS3DataeventsWriteEnabled.ps1
- Checks\Aws\Test-Ec2LaunchTemplateNoPublicIp.ps1
- Checks\Aws\Test-BackupRecoveryPointEncrypted.ps1
- Checks\Aws\Test-CognitoUserPoolAdvancedSecurityEnabled.ps1
- Checks\Aws\Test-DirectoryserviceRadiusServerSecurityProtocol.ps1
- Checks\Aws\Test-Ec2InstancePortElasticsearchKibanaExposedToInternet.ps1
- Checks\Aws\Test-Apigatewayv2ApiAuthorizersEnabled.ps1
- Checks\Aws\Test-GlueDatabaseConnectionsSslEnabled.ps1
- Checks\Aws\Test-RdsInstanceExtendedSupport.ps1
- Private\Save-CIEMToken.ps1
- Checks\Azure\Test-StorageSecureTransferRequiredIsEnabled.ps1
- Checks\Aws\Test-CloudwatchLogGroupRetentionPolicySpecificDaysEnabled.ps1
- Checks\Aws\Test-MqBrokerClusterDeploymentMode.ps1
- Checks\Aws\Test-Ec2InstancePortRdpExposedToInternet.ps1
- Checks\Aws\Test-CloudfrontDistributionsS3OriginAccessControl.ps1
- Checks\Aws\Test-Ec2TransitgatewayAutoAcceptVpcAttachments.ps1
- Checks\Aws\Test-DirectoryserviceDirectoryLogForwardingEnabled.ps1
- Checks\Aws\Test-SnsTopicsKmsEncryptionAtRestEnabled.ps1
- Checks\Aws\Test-Elbv2CrossZoneLoadBalancingEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortPostgresqlExposedToInternet.ps1
- Checks\Aws\Test-AwslambdaFunctionInsideVpc.ps1
- Private\Get-AllGraphPage.ps1
- Checks\Azure\Test-EntraUserWithVmAccessHasMfa.ps1
- Checks\Aws\Test-NeptuneClusterIntegrationCloudwatchLogs.ps1
- Checks\Aws\Test-Ec2InstanceProfileAttached.ps1
- Checks\Aws\Test-Inspector2IsEnabled.ps1
- Checks\Aws\Test-IamCustomerAttachedPolicyNoAdministrativePrivileges.ps1
- Checks\Aws\Test-ElasticacheRedisClusterRestEncryptionEnabled.ps1
- Checks\Aws\Test-NetworkfirewallPolicyDefaultActionFullPackets.ps1
- Checks\Aws\Test-CloudformationStackCdktoolkitBootstrapVersion.ps1
- Checks\Aws\Test-RedshiftClusterNonDefaultDatabaseName.ps1
- Checks\Aws\Test-CloudwatchLogGroupKmsEncryptionEnabled.ps1
- Checks\Aws\Test-DirectoryserviceDirectoryMonitorNotifications.ps1
- Private\Initialize-EntraService.ps1
- Checks\Azure\Test-StorageAccountKeyAccessDisabled.ps1
- Checks\Aws\Test-FsxWindowsFileSystemMultiAzEnabled.ps1
- Checks\Aws\Test-IamInlinePolicyNoFullAccessToCloudtrail.ps1
- Checks\Aws\Test-RdsClusterStorageEncrypted.ps1
- Checks\Aws\Test-IamInlinePolicyNoFullAccessToKms.ps1
- Checks\Aws\Test-OrganizationsAccountPartOfOrganizations.ps1
- Checks\Aws\Test-Ec2EbsVolumeProtectedByBackupPlan.ps1
- Checks\Aws\Test-AwslambdaFunctionUrlPublic.ps1
- Checks\Aws\Test-DirectoryserviceSupportedMfaRadiusEnabled.ps1
- Checks\Aws\Test-S3AccountLevelPublicAccessBlocks.ps1
- Checks\Aws\Test-SagemakerNotebookInstanceEncryptionEnabled.ps1
- Private\Test-EntraAuthorizationPolicyBooleanSetting.ps1
- Checks\Azure\Test-StorageEnsurePrivateEndpointInStorageAccount.ps1
- Checks\Aws\Test-RdsInstanceDeprecatedEngineVersion.ps1
- Checks\Aws\Test-CloudwatchLogGroupNotPubliclyAccessible.ps1
- Checks\Aws\Test-LightsailInstanceAutomatedSnapshots.ps1
- Checks\Aws\Test-S3BucketShadowResourceVulnerability.ps1
- Checks\Aws\Test-KafkaConnectorInTransitEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2ElasticIpUnassigned.ps1
- Checks\Aws\Test-EcsTaskDefinitionsContainersReadonlyAccess.ps1
- Checks\Aws\Test-ApigatewayRestapiAuthorizersEnabled.ps1
- Checks\Aws\Test-EmrClusterPubliclyAccesible.ps1
- Checks\Aws\Test-RdsInstanceCopyTagsToSnapshots.ps1
- Private\Initialize-IAMService.ps1
- Checks\Azure\Test-EntraPolicyDefaultUserCannotCreateSecurityGroup.ps1
- Checks\Aws\Test-EfsMountTargetNotPubliclyAccessible.ps1
- Checks\Aws\Test-DynamodbAcceleratorClusterEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2NetworkaclAllowIngressTcpPort3389.ps1
- Checks\Aws\Test-Ec2ElasticIpShodan.ps1
- Checks\Aws\Test-IamRootMfaEnabled.ps1
- Checks\Aws\Test-EcsTaskDefinitionsLoggingBlockMode.ps1
- Checks\Aws\Test-BedrockAgentGuardrailEnabled.ps1
- Checks\Aws\Test-OpensearchServiceDomainsUseCognitoAuthenticationForKibana.ps1
- Checks\Aws\Test-S3BucketPolicyPublicWriteAccess.ps1
- Checks\Aws\Test-IamPolicyNoFullAccessToKms.ps1
- Private\Initialize-KeyVaultService.ps1
- Checks\Azure\Test-EntraTrustedNamedLocationExist.ps1
- Checks\Aws\Test-RdsSnapshotsPublicAccess.ps1
- Checks\Aws\Test-IamPasswordPolicyUppercase.ps1
- Checks\Aws\Test-GuarddutyIsEnabled.ps1
- Checks\Aws\Test-ApigatewayRestapiWafAclAttached.ps1
- Checks\Aws\Test-RdsInstanceEventSubscriptionSecurityGroups.ps1
- Checks\Aws\Test-ElbDesyncMitigationMode.ps1
- Checks\Aws\Test-WafGlobalRuleWithConditions.ps1
- Checks\Aws\Test-AccessanalyzerEnabled.ps1
- Checks\Aws\Test-DirectoryserviceDirectorySnapshotsLimit.ps1
- Checks\Aws\Test-TrustedadvisorErrorsAndWarnings.ps1
- Private\Test-StorageAccountProperty.ps1
- Checks\Azure\Test-KeyvaultRbacKeyExpirationSet.ps1
- Checks\Aws\Test-Ec2NetworkaclAllowIngressAnyPort.ps1
- Checks\Aws\Test-AwslambdaFunctionInvokeApiOperationsCloudtrailLoggingEnabled.ps1
- Checks\Aws\Test-DynamodbTableDeletionProtectionEnabled.ps1
- Checks\Aws\Test-GuarddutyLambdaProtectionEnabled.ps1
- Checks\Aws\Test-RdsClusterDeletionProtection.ps1
- Checks\Aws\Test-CloudfrontDistributionsCustomSslCertificate.ps1
- Checks\Aws\Test-DocumentdbClusterDeletionProtection.ps1
- Checks\Aws\Test-ElasticacheRedisClusterMultiAzEnabled.ps1
- Checks\Aws\Test-CloudtrailMultiRegionEnabled.ps1
- Checks\Aws\Test-KmsCmkNotMultiRegion.ps1
- Private\Get-AzureAuthContext.ps1
- Checks\Azure\Test-StorageCrossTenantReplicationDisabled.ps1
- Checks\Aws\Test-RdsInstanceCriticalEventSubscription.ps1
- Checks\Aws\Test-AccountMaintainCurrentContactDetails.ps1
- Checks\Aws\Test-S3BucketCrossAccountAccess.ps1
- Checks\Aws\Test-GuarddutyEksAuditLogEnabled.ps1
- Checks\Aws\Test-WellarchitectedWorkloadNoHighOrMediumRisks.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPort3389.ps1
- Checks\Aws\Test-RdsClusterCriticalEventSubscription.ps1
- Checks\Aws\Test-KafkaClusterMutualTlsAuthenticationEnabled.ps1
- Checks\Aws\Test-Wafv2WebaclWithRules.ps1
- Checks\Aws\Test-EcrRepositoriesScanVulnerabilitiesInLatestImage.ps1
- Private\Convert-ProwlerCheck.ps1
- Checks\Azure\Test-EntraPolicyRestrictUserConsentForApp.ps1
- Checks\Aws\Test-SagemakerTrainingJobsIntercontainerEncryptionEnabled.ps1
- Checks\Aws\Test-RdsInstanceNonDefaultPort.ps1
- Checks\Aws\Test-SecretsmanagerSecretRotatedPeriodically.ps1
- Checks\Aws\Test-IamNoCustomPolicyPermissiveRoleAssumption.ps1
- Checks\Aws\Test-EksClusterUsesASupportedVersion.ps1
- Checks\Aws\Test-Ec2LaunchTemplateImdsv2Required.ps1
- Checks\Aws\Test-ConfigRecorderUsingAwsServiceRole.ps1
- Checks\Aws\Test-Ec2InstanceWithOutdatedAmi.ps1
- Checks\Aws\Test-RedshiftClusterInTransitEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2InstanceUsesSingleEni.ps1
- Private\Set-CIEMSecret.ps1
- Checks\Aws\Test-Apigatewayv2ApiAccessLoggingEnabled.ps1
- Checks\Aws\Test-AwslambdaFunctionVpcMultiAz.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPort22.ps1
- Checks\Aws\Test-IamAdministratorAccessWithMfa.ps1
- Checks\Aws\Test-Ec2InstancePortMongodbExposedToInternet.ps1
- Checks\Aws\Test-Elbv2IsInMultipleAz.ps1
- Checks\Aws\Test-EmrClusterMasterNodesNoPublicIp.ps1
- Checks\Aws\Test-Ec2SecuritygroupNotUsed.ps1
- Checks\Aws\Test-AppstreamFleetDefaultInternetAccessDisabled.ps1
- Checks\Aws\Test-SsmDocumentsSetAsPublic.ps1
- Checks\Aws\Test-CodebuildProjectSourceRepoUrlNoSensitiveCredentials.ps1
- Private\Test-KeyVaultItemExpiration.ps1
- Checks\Aws\Test-RdsInstanceIntegrationCloudwatchLogs.ps1
- Checks\Aws\Test-GlueDevelopmentEndpointsJobBookmarkEncryptionEnabled.ps1
- Checks\Aws\Test-CognitoUserPoolMfaEnabled.ps1
- Checks\Aws\Test-Ec2EbsPublicSnapshot.ps1
- Checks\Aws\Test-OpensearchServiceDomainsEncryptionAtRestEnabled.ps1
- Checks\Aws\Test-CloudtrailS3DataeventsReadEnabled.ps1
- Checks\Aws\Test-IamUserHardwareMfaEnabled.ps1
- Checks\Aws\Test-ShieldAdvancedProtectionInClassicLoadBalancers.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterForS3BucketPolicyChanges.ps1
- Checks\Aws\Test-Ec2SecuritygroupDefaultRestrictTraffic.ps1
- Checks\Aws\Test-AccessanalyzerEnabledWithoutFindings.ps1
- Private\Test-GitRemote.ps1
- Checks\Aws\Test-RedshiftClusterAutomatedSnapshot.ps1
- Checks\Aws\Test-NeptuneClusterStorageEncrypted.ps1
- Checks\Aws\Test-EventbridgeGlobalEndpointEventReplicationEnabled.ps1
- Checks\Aws\Test-SecurityhubEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortFtpExposedToInternet.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToAnyPort.ps1
- Checks\Aws\Test-ElasticbeanstalkEnvironmentCloudwatchLoggingEnabled.ps1
- Checks\Aws\Test-IamUserMfaEnabledConsoleAccess.ps1
- Checks\Aws\Test-Ec2InstanceParavirtualType.ps1
- Checks\Aws\Test-DynamodbTablesPitrEnabled.ps1
- Checks\Aws\Test-KinesisStreamDataRetentionPeriod.ps1
- Private\Update-CIEMScanRun.ps1
- Checks\Aws\Test-KafkaClusterEnhancedMonitoringEnabled.ps1
- Checks\Aws\Test-S3BucketObjectLock.ps1
- Checks\Aws\Test-CloudwatchChangesToNetworkAclsAlarmConfigured.ps1
- Checks\Aws\Test-BedrockGuardrailSensitiveInformationFilterEnabled.ps1
- Checks\Aws\Test-KmsCmkRotationEnabled.ps1
- Checks\Aws\Test-CloudwatchLogGroupNoSecretsInLogs.ps1
- Checks\Aws\Test-ElbSslListeners.ps1
- Checks\Aws\Test-ElasticbeanstalkEnvironmentEnhancedHealthReporting.ps1
- Checks\Aws\Test-CloudwatchLogMetricFilterSecurityGroupChanges.ps1
- Checks\Aws\Test-VpcEndpointServicesAllowedPrincipalsTrustBoundaries.ps1
- Checks\Aws\Test-IamCustomerUnattachedPolicyNoAdministrativePrivileges.ps1
- Private\Get-CIEMToken.ps1
- Checks\Aws\Test-IamPolicyCloudshellAdminNotAttached.ps1
- Checks\Aws\Test-EcsTaskDefinitionsHostNamespaceNotShared.ps1
- Checks\Aws\Test-SagemakerModelsVpcSettingsConfigured.ps1
- Checks\Aws\Test-CloudfrontDistributionsUsingWaf.ps1
- Checks\Aws\Test-CodebuildReportGroupExportEncrypted.ps1
- Checks\Aws\Test-DlmEbsSnapshotLifecyclePolicyExists.ps1
- Checks\Aws\Test-SagemakerNotebookInstanceRootAccessDisabled.ps1
- Checks\Aws\Test-Elbv2LoggingEnabled.ps1
- Checks\Aws\Test-RdsInstanceEnhancedMonitoringEnabled.ps1
- Checks\Aws\Test-NeptuneClusterIamAuthenticationEnabled.ps1
- Checks\Aws\Test-CloudtrailThreatDetectionEnumeration.ps1
- Private\New-CIEMScanRun.ps1
- Checks\Aws\Test-CloudwatchChangesToNetworkRouteTablesAlarmConfigured.ps1
- Checks\Aws\Test-NetworkfirewallMultiAz.ps1
- Checks\Aws\Test-MemorydbClusterAutoMinorVersionUpgrades.ps1
- Checks\Aws\Test-CloudwatchCrossAccountSharingDisabled.ps1
- Checks\Aws\Test-Route53DanglingIpSubdomainTakeover.ps1
- Checks\Aws\Test-Elbv2InternetFacing.ps1
- Checks\Aws\Test-OpensearchServiceDomainsNotPubliclyAccessible.ps1
- Checks\Aws\Test-IamPolicyAttachedOnlyToGroupOrRoles.ps1
- Checks\Aws\Test-CloudtrailCloudwatchLoggingEnabled.ps1
- Checks\Aws\Test-DmsEndpointSslEnabled.ps1
- Checks\Aws\Test-BackupReportplansExist.ps1
- Private\Get-GitHubRepoTree.ps1
- Checks\Aws\Test-S3BucketLevelPublicAccessBlock.ps1
- Checks\Aws\Test-CloudwatchChangesToVpcsAlarmConfigured.ps1
- Checks\Aws\Test-EfsHaveBackupEnabled.ps1
- Checks\Aws\Test-MqBrokerAutoMinorVersionUpgrades.ps1
- Checks\Aws\Test-IamCheckSamlProvidersSts.ps1
- Checks\Aws\Test-EcsTaskDefinitionsNoEnvironmentSecrets.ps1
- Checks\Aws\Test-CloudtrailThreatDetectionLlmJacking.ps1
- Checks\Aws\Test-IamPasswordPolicyLowercase.ps1
- Checks\Aws\Test-NeptuneClusterMultiAz.ps1
- Checks\Aws\Test-AutoscalingGroupUsingEc2LaunchTemplate.ps1
- Checks\Aws\Test-MacieIsEnabled.ps1
- Private\Save-GitHubRepoFile.ps1
- Checks\Aws\Test-Ec2EbsVolumeSnapshotsExists.ps1
- Checks\Aws\Test-Elbv2DesyncMitigationMode.ps1
- Checks\Aws\Test-GuarddutyNoHighSeverityFindings.ps1
- Checks\Aws\Test-IamRoleAdministratoraccessPolicy.ps1
- Checks\Aws\Test-CloudwatchAlarmActionsEnabled.ps1
- Checks\Aws\Test-AccountSecurityContactInformationIsRegistered.ps1
- Checks\Aws\Test-CodebuildProjectOlder90Days.ps1
- Checks\Aws\Test-OpensearchServiceDomainsAccessControlEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupWithManyIngressEgressRules.ps1
- Checks\Aws\Test-DmsEndpointMongodbAuthenticationEnabled.ps1
- Checks\Aws\Test-EcrRepositoriesScanImagesOnPushEnabled.ps1
- Private\Save-CIEMScanRun.ps1
- Checks\Aws\Test-GuarddutyCentrallyManaged.ps1
- Checks\Aws\Test-CloudtrailKmsEncryptionEnabled.ps1
- Checks\Aws\Test-EfsEncryptionAtRestEnabled.ps1
- Checks\Aws\Test-ElbLoggingEnabled.ps1
- Checks\Aws\Test-IamRotateAccessKey90Days.ps1
- Checks\Aws\Test-Ec2InstancePortCassandraExposedToInternet.ps1
- Checks\Aws\Test-NeptuneClusterDeletionProtection.ps1
- Checks\Aws\Test-RdsInstanceInsideVpc.ps1
- Checks\Aws\Test-AcmCertificatesWithSecureKeyAlgorithms.ps1
- Checks\Aws\Test-EcrRepositoriesNotPubliclyAccessible.ps1
- Checks\Aws\Test-CloudtrailLogsS3BucketAccessLoggingEnabled.ps1
- Private\Invoke-AzureApi.ps1
- Checks\Aws\Test-StoragegatewayGatewayFaultTolerant.ps1
- Checks\Aws\Test-CognitoUserPoolPasswordPolicyMinimumLength14.ps1
- Checks\Aws\Test-GuarddutyRdsProtectionEnabled.ps1
- Checks\Aws\Test-EcrRegistryScanImagesOnPushEnabled.ps1
- Checks\Aws\Test-SagemakerModelsNetworkIsolationEnabled.ps1
- Checks\Aws\Test-MqBrokerActiveDeploymentMode.ps1
- Checks\Aws\Test-AutoscalingGroupMultipleAz.ps1
- Checks\Aws\Test-RdsClusterIntegrationCloudwatchLogs.ps1
- Checks\Aws\Test-VpcDifferentRegions.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowWideOpenPublicIpv4.ps1
- Checks\Aws\Test-TrustedadvisorPremiumSupportPlanSubscribed.ps1
- Private\Initialize-StorageService.ps1
- Checks\Aws\Test-Route53DomainsPrivacyProtectionEnabled.ps1
- Checks\Aws\Test-IamGroupAdministratorAccessPolicy.ps1
- Checks\Aws\Test-ElasticacheRedisClusterBackupEnabled.ps1
- Checks\Aws\Test-GlueDataCatalogsConnectionPasswordsEncryptionEnabled.ps1
- Checks\Aws\Test-KinesisStreamEncryptedAtRest.ps1
- Checks\Aws\Test-CognitoUserPoolClientTokenRevocationEnabled.ps1
- Checks\Aws\Test-RedshiftClusterPublicAccess.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortMysql3306.ps1
- Checks\Aws\Test-RdsInstanceStorageEncrypted.ps1
- Checks\Aws\Test-BedrockGuardrailPromptAttackFilterEnabled.ps1
- Checks\Aws\Test-RdsSnapshotsEncrypted.ps1
- Checks\Azure\Test-IamRoleUserAccessAdminRestricted.ps1
- Checks\Aws\Test-Inspector2ActiveFindingsExist.ps1
- Checks\Aws\Test-AppstreamFleetMaximumSessionDuration.ps1
- Checks\Aws\Test-Ec2InstancePortKerberosExposedToInternet.ps1
- Checks\Aws\Test-DmsReplicationTaskTargetLoggingEnabled.ps1
- Checks\Aws\Test-SsmDocumentSecrets.ps1
- Checks\Aws\Test-EventbridgeBusExposed.ps1
- Checks\Aws\Test-GlacierVaultsPolicyPublicAccess.ps1
- Checks\Aws\Test-SagemakerNotebookInstanceWithoutDirectInternetAccessConfigured.ps1
- Checks\Aws\Test-CodebuildProjectNoSecretsInVariables.ps1
- Checks\Aws\Test-EfsNotPubliclyAccessible.ps1
- Checks\Aws\Test-DocumentdbClusterBackupEnabled.ps1
- Checks\Azure\Test-StorageBlobPublicAccessLevelIsDisabled.ps1
- Checks\Aws\Test-Ec2InstanceManagedBySsm.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortMemcached11211.ps1
- Checks\Aws\Test-ElasticacheRedisReplicationGroupAuthEnabled.ps1
- Checks\Aws\Test-DmsReplicationTaskSourceLoggingEnabled.ps1
- Checks\Aws\Test-ApigatewayRestapiClientCertificateEnabled.ps1
- Checks\Aws\Test-CloudformationStackOutputsFindSecrets.ps1
- Checks\Aws\Test-IamPolicyNoFullAccessToCloudtrail.ps1
- Checks\Aws\Test-Ec2InstanceDetailedMonitoringEnabled.ps1
- Checks\Aws\Test-Ec2InstanceSecretsUserData.ps1
- Checks\Aws\Test-SecretsmanagerSecretUnused.ps1
- Checks\Aws\Test-KafkaClusterUnrestrictedAccessDisabled.ps1
- Checks\Azure\Test-StorageSmbProtocolVersionIsLatest.ps1
- Checks\Aws\Test-ShieldAdvancedProtectionInRoute53HostedZones.ps1
- Checks\Aws\Test-SagemakerEndpointConfigProdVariantInstances.ps1
- Checks\Aws\Test-S3BucketDefaultEncryption.ps1
- Checks\Aws\Test-VpcSubnetNoPublicIpByDefault.ps1
- Checks\Aws\Test-OpensearchServiceDomainsNodeToNodeEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortSshExposedToInternet.ps1
- Checks\Aws\Test-AthenaWorkgroupEncryption.ps1
- Checks\Aws\Test-EcsServiceNoAssignPublicIp.ps1
- Checks\Aws\Test-IamUserAdministratorAccessPolicy.ps1
- Checks\Aws\Test-CodebuildProjectWebhookFiltersUseAnchoredPatterns.ps1
- Checks\Aws\Test-KmsCmkNotDeletedUnintentionally.ps1
- Checks\Azure\Test-EntraPolicyUserConsentForVerifiedApp.ps1
- Checks\Aws\Test-RdsInstanceIamAuthenticationEnabled.ps1
- Checks\Aws\Test-AcmCertificatesTransparencyLogsEnabled.ps1
- Checks\Aws\Test-DatasyncTaskLoggingEnabled.ps1
- Checks\Aws\Test-ShieldAdvancedProtectionInAssociatedElasticIps.ps1
- Checks\Aws\Test-CloudtrailBucketRequiresMfaDelete.ps1
- Checks\Aws\Test-S3BucketSecureTransportPolicy.ps1
- Checks\Aws\Test-ElasticacheClusterUsesPublicSubnet.ps1
- Checks\Aws\Test-AccountMaintainDifferentContactDetailsToSecurityBillingAndOperations.ps1
- Checks\Aws\Test-RdsClusterMinorVersionUpgradeEnabled.ps1
- Checks\Aws\Test-EcsTaskSetNoAssignPublicIp.ps1
- Checks\Aws\Test-GlueEtlJobsCloudwatchLogsEncryptionEnabled.ps1
- Checks\Azure\Test-StorageDefaultNetworkAccessRuleIsDenied.ps1
- Checks\Aws\Test-OpensearchServiceDomainsCloudwatchLoggingEnabled.ps1
- Checks\Aws\Test-IamRootCredentialsManagementEnabled.ps1
- Checks\Aws\Test-FmsPolicyCompliant.ps1
- Checks\Aws\Test-ApigatewayRestapiLoggingEnabled.ps1
- Checks\Aws\Test-IamSecurityauditRoleCreated.ps1
- Checks\Aws\Test-S3BucketNoMfaDelete.ps1
- Checks\Aws\Test-EcsTaskDefinitionsNoPrivilegedContainers.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortFtp2021.ps1
- Checks\Aws\Test-ElasticacheRedisClusterAutoMinorVersionUpgrades.ps1
- Checks\Aws\Test-BedrockModelInvocationLogsEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortMongodb2701727018.ps1
- Checks\Azure\Test-KeyvaultPrivateEndpoint.ps1
- Checks\Aws\Test-FsxFileSystemCopyTagsToBackupsEnabled.ps1
- Checks\Aws\Test-SnsSubscriptionNotUsingHttpEndpoints.ps1
- Checks\Aws\Test-Elbv2SslListeners.ps1
- Checks\Aws\Test-WorkspacesVolumeEncryptionEnabled.ps1
- Checks\Aws\Test-DynamodbAcceleratorClusterInTransitEncryptionEnabled.ps1
- Checks\Aws\Test-Ec2InstancePortSqlserverExposedToInternet.ps1
- Checks\Aws\Test-ElbInsecureSslCiphers.ps1
- Checks\Aws\Test-CloudtrailInsightsExist.ps1
- Checks\Aws\Test-IamPasswordPolicyReuse24.ps1
- Checks\Aws\Test-AwslambdaFunctionNoSecretsInCode.ps1
- Checks\Aws\Test-ElasticbeanstalkEnvironmentManagedUpdatesEnabled.ps1
- Checks\Azure\Test-KeyvaultRbacSecretExpirationSet.ps1
- Checks\Aws\Test-DynamodbTableAutoscalingEnabled.ps1
- Checks\Aws\Test-RdsClusterMultiAz.ps1
- Checks\Aws\Test-Ec2NetworkaclAllowIngressTcpPort22.ps1
- Checks\Aws\Test-CloudfrontDistributionsFieldLevelEncryptionEnabled.ps1
- Checks\Aws\Test-RdsInstanceTransportEncrypted.ps1
- Checks\Aws\Test-EfsAccessPointEnforceRootDirectory.ps1
- Checks\Aws\Test-Ec2SecuritygroupAllowIngressFromInternetToTcpPortSqlServer14331434.ps1
- Checks\Aws\Test-OrganizationsTagsPoliciesEnabledAndAttached.ps1
- Checks\Aws\Test-IamAvoidRootUsage.ps1
- Checks\Aws\Test-RdsClusterIamAuthenticationEnabled.ps1
- Checks\Aws\Test-GlueDataCatalogsMetadataEncryptionEnabled.ps1
- Checks\Azure\Test-StorageEnsureMinimumTlsVersion12.ps1
- Checks\Aws\Test-IamNoExpiredServerCertificatesStored.ps1
- Checks\Aws\Test-BedrockApiKeyNoAdministrativePrivileges.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 0.3.28 (current version) | 6 | 2/6/2026 |
| 0.3.27 | 4 | 2/6/2026 |
| 0.3.26 | 6 | 2/6/2026 |
| 0.3.25 | 3 | 2/6/2026 |
| 0.3.24 | 3 | 2/6/2026 |
| 0.3.23 | 4 | 2/6/2026 |
| 0.3.22 | 5 | 2/6/2026 |
| 0.3.21 | 4 | 2/6/2026 |
| 0.3.20 | 3 | 2/6/2026 |
| 0.3.19 | 3 | 2/6/2026 |
| 0.3.18 | 3 | 2/6/2026 |
| 0.3.17 | 3 | 2/6/2026 |
| 0.3.16 | 3 | 2/6/2026 |
| 0.3.15 | 4 | 2/6/2026 |
| 0.3.14 | 4 | 2/5/2026 |
| 0.3.13 | 3 | 2/5/2026 |
| 0.3.12 | 3 | 2/5/2026 |
| 0.3.11 | 3 | 2/5/2026 |
| 0.3.10 | 3 | 2/5/2026 |
| 0.3.9 | 3 | 2/5/2026 |
| 0.3.8 | 3 | 2/5/2026 |
| 0.3.7 | 3 | 2/5/2026 |
| 0.3.6 | 5 | 2/4/2026 |
| 0.3.5 | 3 | 2/4/2026 |
| 0.3.4 | 3 | 2/4/2026 |
| 0.3.3 | 3 | 2/4/2026 |
| 0.3.2 | 3 | 2/4/2026 |
| 0.3.1 | 3 | 2/4/2026 |
| 0.3.0 | 3 | 2/4/2026 |
| 0.2.108 | 3 | 2/4/2026 |
| 0.2.107 | 3 | 2/4/2026 |
| 0.2.106 | 3 | 2/4/2026 |
| 0.2.105 | 3 | 2/4/2026 |
| 0.2.104 | 3 | 2/4/2026 |
| 0.2.103 | 3 | 2/4/2026 |
| 0.2.102 | 3 | 2/4/2026 |
| 0.2.101 | 3 | 2/4/2026 |
| 0.2.100 | 3 | 2/4/2026 |
| 0.2.99 | 5 | 2/4/2026 |
| 0.2.98 | 5 | 2/4/2026 |
| 0.2.97 | 4 | 2/3/2026 |
| 0.2.96 | 3 | 2/3/2026 |
| 0.2.95 | 4 | 2/3/2026 |
| 0.2.94 | 2 | 2/3/2026 |
| 0.2.93 | 2 | 2/3/2026 |
| 0.2.92 | 4 | 2/3/2026 |
| 0.2.91 | 3 | 2/3/2026 |
| 0.2.90 | 3 | 2/3/2026 |
| 0.2.89 | 4 | 2/3/2026 |
| 0.2.88 | 3 | 2/3/2026 |
| 0.2.86 | 2 | 2/3/2026 |
| 0.2.85 | 3 | 2/3/2026 |
| 0.2.84 | 3 | 2/3/2026 |
| 0.2.83 | 3 | 2/3/2026 |
| 0.2.82 | 4 | 2/3/2026 |
| 0.2.81 | 3 | 2/3/2026 |
| 0.2.80 | 3 | 2/3/2026 |
| 0.2.79 | 3 | 2/3/2026 |
| 0.2.78 | 3 | 2/3/2026 |
| 0.2.77 | 3 | 2/3/2026 |
| 0.2.76 | 3 | 2/2/2026 |
| 0.2.75 | 3 | 2/2/2026 |
| 0.2.74 | 3 | 2/2/2026 |
| 0.2.73 | 3 | 2/2/2026 |
| 0.2.72 | 3 | 2/2/2026 |
| 0.2.71 | 3 | 2/2/2026 |
| 0.2.70 | 3 | 2/2/2026 |
| 0.2.69 | 3 | 2/2/2026 |
| 0.2.68 | 3 | 2/2/2026 |
| 0.2.67 | 3 | 2/2/2026 |
| 0.2.66 | 10 | 2/2/2026 |
| 0.2.64 | 13 | 2/2/2026 |
| 0.2.63 | 13 | 2/2/2026 |
| 0.2.61 | 6 | 2/2/2026 |
| 0.2.60 | 9 | 1/30/2026 |
| 0.2.59 | 4 | 1/30/2026 |
| 0.2.58 | 3 | 1/30/2026 |
| 0.2.57 | 3 | 1/30/2026 |
| 0.2.56 | 3 | 1/30/2026 |
| 0.2.55 | 3 | 1/30/2026 |
| 0.2.54 | 4 | 1/30/2026 |
| 0.2.53 | 3 | 1/30/2026 |
| 0.2.52 | 3 | 1/30/2026 |
| 0.2.51 | 3 | 1/30/2026 |
| 0.2.50 | 4 | 1/30/2026 |
| 0.2.49 | 3 | 1/30/2026 |
| 0.2.48 | 3 | 1/30/2026 |
| 0.2.47 | 4 | 1/30/2026 |
| 0.2.46 | 3 | 1/30/2026 |
| 0.2.45 | 3 | 1/30/2026 |
| 0.2.44 | 4 | 1/30/2026 |
| 0.2.43 | 3 | 1/30/2026 |
| 0.2.42 | 3 | 1/30/2026 |
| 0.2.41 | 5 | 1/29/2026 |
| 0.2.40 | 5 | 1/29/2026 |
| 0.2.39 | 4 | 1/29/2026 |
| 0.2.38 | 4 | 1/29/2026 |
| 0.2.37 | 4 | 1/29/2026 |
| 0.2.36 | 5 | 1/29/2026 |
| 0.2.35 | 3 | 1/29/2026 |
| 0.2.34 | 4 | 1/29/2026 |
| 0.2.33 | 3 | 1/29/2026 |
| 0.2.32 | 4 | 1/29/2026 |
| 0.2.31 | 4 | 1/29/2026 |
| 0.2.30 | 5 | 1/29/2026 |
| 0.2.29 | 5 | 1/29/2026 |
| 0.2.28 | 3 | 1/29/2026 |
| 0.2.27 | 5 | 1/29/2026 |
| 0.2.26 | 5 | 1/29/2026 |
| 0.2.24 | 4 | 1/29/2026 |
| 0.2.23 | 5 | 1/29/2026 |
| 0.2.22 | 3 | 1/29/2026 |
| 0.2.21 | 6 | 1/28/2026 |
| 0.2.18 | 4 | 1/28/2026 |
| 0.2.17 | 5 | 1/28/2026 |
| 0.2.15 | 4 | 1/28/2026 |
| 0.2.13 | 5 | 1/28/2026 |
| 0.2.11 | 5 | 1/28/2026 |
| 0.2.10 | 3 | 1/28/2026 |
| 0.2.9 | 4 | 1/28/2026 |
| 0.2.7 | 6 | 1/27/2026 |
| 0.2.5 | 4 | 1/27/2026 |
| 0.2.4 | 7 | 1/27/2026 |
| 0.2.3 | 4 | 1/27/2026 |
| 0.2.1 | 6 | 1/27/2026 |
| 0.2.0 | 4 | 1/27/2026 |
| 0.1.1 | 5 | 1/27/2026 |
| 0.1.0-alpha | 3 | 1/27/2026 |