Security Policies¶
Cloudrift evaluates 49 OPA (Open Policy Agent) security policies across 15 service categories. Each policy checks a specific security best practice against your AWS resources.
Severity Levels¶
| Severity | Count | Meaning |
|---|---|---|
| CRITICAL | 7 | Immediate security risk — fix now |
| HIGH | 14 | Significant security concern |
| MEDIUM | 20 | Moderate risk, should be addressed |
| LOW | 8 | Best practice recommendation |
Policy Catalog¶
S3 Storage (9 policies)¶
S3-001: S3 Encryption Required — HIGH
All S3 buckets must have server-side encryption enabled to protect data at rest.
S3-002: S3 KMS Encryption Recommended — LOW
Use AWS KMS for server-side encryption for better key management and auditing.
S3-003: S3 Block Public ACLs — HIGH
S3 buckets must have block_public_acls enabled to prevent public access via ACLs.
S3-004: S3 Block Public Policy — HIGH
S3 buckets must have block_public_policy enabled to prevent public bucket policies.
S3-005: S3 Ignore Public ACLs — HIGH
S3 buckets must have ignore_public_acls enabled to override any public ACLs.
S3-006: S3 Restrict Public Buckets — HIGH
S3 buckets must have restrict_public_buckets enabled.
S3-007: S3 No Public Read ACL — CRITICAL
S3 buckets must not use public-read ACL. Public read access exposes data to the internet.
S3-008: S3 No Public Read-Write ACL — CRITICAL
S3 buckets must not use public-read-write ACL. Public write access is a critical risk.
S3-009: S3 Versioning Recommended — MEDIUM
Enable versioning for data protection and recovery from accidental deletion.
EC2 Compute (3 policies)¶
EC2-001: EC2 IMDSv2 Required — MEDIUM
EC2 instances must use Instance Metadata Service v2 (IMDSv2) to prevent SSRF attacks.
EC2-002: EC2 Root Volume Encryption — HIGH
EC2 instances must encrypt root EBS volumes to protect data at rest.
EC2-003: EC2 Public IP Warning — MEDIUM
EC2 instances should avoid public IP addresses unless explicitly required.
Security Groups (4 policies)¶
SG-001: No Unrestricted SSH — CRITICAL
Security groups must not allow SSH (port 22) from 0.0.0.0/0.
SG-002: No Unrestricted RDP — CRITICAL
Security groups must not allow RDP (port 3389) from 0.0.0.0/0.
SG-003: No Unrestricted All Ports — CRITICAL
Security groups must not allow all ports from 0.0.0.0/0.
SG-004: Database Ports Not Public — HIGH
Database ports (3306, 5432, 1433, 27017) must not be open to the internet.
RDS Databases (5 policies)¶
RDS-001: RDS Storage Encryption Required — HIGH
RDS instances must have storage encryption enabled.
RDS-002: RDS No Public Access — CRITICAL
RDS instances must have publicly_accessible set to false.
RDS-003: RDS Backup Retention Period — MEDIUM
RDS backup retention should be at least 7 days.
RDS-004: RDS Deletion Protection — MEDIUM
Enable deletion protection to prevent accidental database deletion.
RDS-005: RDS Multi-AZ Recommended — LOW
Use Multi-AZ deployment for high availability.
IAM (3 policies)¶
IAM-001: No Wildcard IAM Actions — CRITICAL
IAM policies must not use * (wildcard) for actions. Follow the principle of least privilege.
IAM-002: No Inline Policies on Users — MEDIUM
Use managed policies instead of inline policies on IAM users for better governance.
IAM-003: IAM Role Trust Not Too Broad — HIGH
IAM role trust policies should restrict who can assume the role.
CloudTrail (3 policies)¶
CT-001: CloudTrail KMS Encryption — HIGH
CloudTrail logs must be encrypted with AWS KMS.
CT-002: CloudTrail Log File Validation — MEDIUM
Enable log file validation to detect tampering.
CT-003: CloudTrail Multi-Region — MEDIUM
Enable CloudTrail for all regions.
KMS (2 policies)¶
KMS-001: KMS Key Rotation Enabled — HIGH
Enable automatic key rotation for KMS customer-managed keys.
KMS-002: KMS Deletion Window Minimum — MEDIUM
KMS key deletion window should be at least 14 days.
EBS (2 policies)¶
EBS-001: EBS Volume Encryption — HIGH
All EBS volumes must be encrypted.
EBS-002: EBS Snapshot Encryption — HIGH
All EBS snapshots must be encrypted.
Lambda (2 policies)¶
LAMBDA-001: Lambda X-Ray Tracing — MEDIUM
Enable X-Ray tracing for Lambda functions for observability.
LAMBDA-002: Lambda VPC Configuration — MEDIUM
Lambda functions should run inside a VPC for network isolation.
ELB/ALB (3 policies)¶
ELB-001: ALB Access Logging — MEDIUM
Enable access logging for Application Load Balancers.
ELB-002: ALB HTTPS Listener Required — HIGH
ALB listeners must use HTTPS protocol.
ELB-003: ALB Deletion Protection — MEDIUM
Enable deletion protection for ALBs.
CloudWatch Logging (2 policies)¶
LOG-001: CloudWatch Log Group KMS Encryption — MEDIUM
CloudWatch Log Groups should use KMS encryption.
LOG-002: CloudWatch Log Retention — MEDIUM
CloudWatch Log Groups should have a retention period configured.
VPC / Networking (2 policies)¶
VPC-001: Default Security Group Restrict All — HIGH
The default security group should restrict all inbound and outbound traffic.
VPC-002: Subnet No Auto-Assign Public IP — MEDIUM
Subnets should not auto-assign public IP addresses.
Secrets Manager (2 policies)¶
SECRET-001: Secrets Manager KMS Encryption — MEDIUM
Secrets should use customer-managed KMS keys for encryption.
SECRET-002: Secrets Automatic Rotation — MEDIUM
Secrets should have automatic rotation configured.
Cost Optimization (3 policies)¶
EC2-005: EC2 Large Instance Review — MEDIUM
Large EC2 instances should be reviewed for right-sizing opportunities.
COST-002: Very Large Instance Size — MEDIUM
Very large instance types (xlarge+) should be justified.
COST-003: Previous Generation Instance — LOW
Migrate from previous-generation instance types to current generation.
Tagging (4 policies)¶
TAG-001: Environment Tag Required — MEDIUM
All resources must have an Environment tag.
TAG-002: Owner Tag Recommended — LOW
Resources should have an Owner tag for accountability.
TAG-003: Project Tag Recommended — LOW
Resources should have a Project tag for cost allocation.
TAG-004: Name Tag Recommended — LOW
Resources should have a Name tag for identification.
Custom Policies¶
You can add custom OPA policies by placing .rego files in a custom directory and setting policy_dir in your config:
Or pass it via CLI flag: