The 48 AWS security checks Black Cat runs
Black Cat SSPM evaluates 48 security policies against your AWS configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect AWS — what access Black Cat needs, and why.
Access control & privilege
11 checks · highest severity: critical
Logging & audit
6 checks · highest severity: critical
Configuration hardening
27 checks · highest severity: critical
Access control & privilege (11)
- Root Access Key Exists severity: critical
- Unused Access Keys severity: medium
- Old Access Keys Not Rotated severity: medium
- Inactive IAM Users severity: medium
- Password Never Used severity: medium
- Overly Permissive IAM Policy severity: critical
- Weak Password Policy severity: high
- Password Policy Expiration Too Long severity: medium
- SCP Not Attached to Root severity: high
- SCP Allows All Actions severity: medium
- SCP Overly Broad Deny Exception severity: medium
Logging & audit (6)
- CloudTrail Not Logging severity: critical
- CloudTrail Log Validation Disabled severity: medium
- CloudTrail Not Multi-Region severity: high
- CloudTrail Data Events Disabled severity: high
- VPC Flow Logs Disabled severity: high
- AWS Config Not Recording severity: high
Configuration hardening (27)
- S3 Bucket Encryption Disabled severity: high
- S3 Bucket Versioning Disabled severity: low
- S3 Bucket Logging Disabled severity: low
- Unrestricted SSH Access severity: critical
- Unrestricted RDP Access severity: critical
- Unrestricted Egress severity: medium
- Default Security Group Has Rules severity: medium
- KMS Key Rotation Disabled severity: medium
- KMS Key Pending Deletion severity: high
- KMS Key Disabled severity: medium
- Default VPC In Use severity: medium
- GuardDuty Not Enabled severity: high
- EC2 IMDSv2 Not Enforced severity: high
- EC2 Instance Has Public IP severity: medium
- RDS Publicly Accessible severity: critical
- RDS Storage Not Encrypted severity: high
- RDS Backup Retention Too Short severity: medium
- Organization All Features Not Enabled severity: high
- Resource Control Policies Not Used severity: medium
- Organization Account Security Alternate Contact Missing severity: low
- Organization Account Suspended severity: low
- Security Hub Not Enabled severity: high
- Security Hub No Standards Enabled severity: high
- Security Hub Critical Findings Unresolved severity: critical
- Security Hub High Findings Unresolved severity: high
- Security Hub Auto-Enable Controls Disabled severity: medium
- Security Hub CIS Standard Not Enabled severity: medium
Other checks (4)
severity: critical Root Account MFA Not Enabled fix difficulty: easy #
Enable MFA on the AWS root account
- Sign in to the AWS Management Console as the root user
- Navigate to IAM > Security credentials (top-right account menu)
- Under "Multi-factor authentication (MFA)", choose "Assign MFA device"
- Select a hardware MFA device, virtual MFA app (e.g. Google Authenticator), or FIDO2 security key
- Follow the wizard to register and activate the device
- Verify the MFA device appears as active in the Security credentials page
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: high User MFA Not Enabled fix difficulty: easy #
Enable MFA for the flagged IAM user
- Navigate to IAM > Users in the AWS Console
- Click the user name to open the user detail page
- Select the "Security credentials" tab
- Under "Multi-factor authentication (MFA)", click "Assign MFA device"
- Choose a virtual MFA app or hardware device and follow the enrollment wizard
- Verify the MFA device is listed as active
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: critical S3 Bucket Public Access Not Blocked fix difficulty: easy #
Enable S3 Block Public Access settings on the flagged bucket
- Navigate to S3 > Buckets in the AWS Console
- Click the bucket name to open it
- Select the "Permissions" tab
- Under "Block public access (bucket settings)", click "Edit"
- Enable all four Block Public Access options
- Click "Save changes" and confirm in the dialog
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12
severity: critical S3 Bucket Policy Public fix difficulty: medium #
Remove public Allow statements from the S3 bucket policy
- Navigate to S3 > Buckets in the AWS Console
- Open the flagged bucket and select the "Permissions" tab
- Under "Bucket policy", click "Edit"
- Remove or tighten any Statement entries that grant Principal="*" or Principal.AWS="*"
- Use Condition keys (aws:SourceIp, aws:PrincipalOrgID) to scope required access
- Click "Save changes" and confirm the bucket is no longer listed as public
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12