Best Practices for Singapore Financial Industry

access-keys-rotated

iam

If an IAM user's access key is not rotated within the specified number of days, this user is noncompliant.

account-part-of-organizations

organizations

If an account has not been added to any organizations or to a specified organization, this account is noncompliant.

pca-certificate-authority-expiration-check

pca

If the validity period of a private CA is not within the specified period, this CA is noncompliant.

pca-certificate-expiration-check

pca

If the validity period of a private certificate is not within the specified period, this certificate is noncompliant.

elb-http-to-https-redirection-check

elb

If an HTTP listener does not have redirecting requests to an HTTPS listener enabled, this HTTP listener is noncompliant.

apig-instances-execution-logging-enabled

apig

If logging is not enabled for a dedicated APIG gateway, this gateway is considered non-compliant.

apig-instances-ssl-enabled

apig

If no SSL certificates are attached to a dedicated APIG gateway, this gateway is considered noncompliant.

as-group-elb-healthcheck-required

as

If an AS group does not have health check enabled, this AS group is noncompliant.

as-group-ipv6-disabled

as

If an AS group has an IPv6 shared bandwidth attached, this AS group is noncompliant

cts-lts-enable

cts

If a CTS tracker does not have trace transfer to LTS enabled, this tracker is noncompliant.

cts-tracker-exists

cts

If there are no trackers or all trackers are disabled in an account, this account is noncompliant.

cts-kms-encrypted-check

cts

If a CTS tracker does not have KMS encryption enabled, this tracker is noncompliant.

cts-support-validate-check

cts

If a CTS tracker does not have trace file verification enabled, this tacker is noncompliant.

cts-obs-bucket-track

cts

If no CTS trackers are created for the specified OBS bucket, this rule is noncompliant.

cts-tracker-enabled-security

cts

If there is no tracker that complies with security best practices, this rule is noncompliant.

kms-rotation-enabled

kms

If key rotation is not enabled for a KMS key, this key is noncompliant.

cloudbuildserver-encryption-parameter-check

codeartsbuild

If encryption is not enabled for custom parameters of a CodeArts build project, this project is noncompliant.

rds-instance-enable-backup

rds

If backup is not enabled for an RDS instance, this instance is noncompliant.

drs-data-guard-job-not-public

drs

If the network type of a DR task is set to public network, this DR task is noncompliant.

drs-migration-job-not-public

drs

If the network type of a migration task is set to public network, this migration task is noncompliant.

drs-synchronization-job-not-public

drs

If the network type of a synchronization task is not set to public network, this synchronization task is noncompliant.

volumes-encrypted-check-by-default

evs

If an EVS disk is not encrypted, this EVS disk is noncompliant.

ecs-instance-no-public-ip

ecs

If an ECS has an EIP attached, this ECS is noncompliant.

ecs-instance-agency-attach-iam-agency

ecs

If an ECS does not have any IAM agencies attached, this ECS is noncompliant.

sfsturbo-encrypted-check

sfsturbo

If KMS encryption is not enabled for an SFS Turbo file system, this file system is noncompliant.

css-cluster-in-vpc

css

If a CSS cluster is not in the specified VPCs, this cluster is noncompliant.

css-cluster-disk-encryption-check

css

If disk encryption is not enabled for a CSS cluster, this cluster is noncompliant.

elb-multiple-az-check

elb

If a load balancer is mapped to only one availability zone (AZ), this load balancer is noncompliant. If a load balancer is mapped to fewer than two AZs, this load balancer is noncompliant.

elb-tls-https-listeners-only

elb

If any listener of a load balancer does not have the frontend protocol set to HTTPS, this load balancer is noncompliant.

mrs-cluster-kerberos-enabled

mrs

If an MRS cluster does not have Kerberos authentication enabled, this cluster is noncompliant.

mrs-cluster-no-public-ip

mrs

If an MRS cluster has an EIP attached, this cluster is noncompliant.

volumes-encrypted-check

ecs, evs

If a mounted EVS disk is not encrypted, this disk is noncompliant.

iam-customer-policy-blocked-kms-actions

iam, access-analyzer-verified

If an IAM policy allows any blocked actions on KMS keys, this policy is noncompliant.

iam-group-has-users-check

iam

If an IAM user group has no user, this user group is noncompliant.

iam-password-policy

iam

If the password of an IAM user does not meet the password strength requirements, this IAM user is noncompliant.

iam-policy-no-statements-with-admin-access

iam

If a custom policy or role allows all actions (with the action element set to *:*:*, *:*, or *) for all cloud services, this policy or role is noncompliant.

iam-role-has-all-permissions

iam

If a custom policy or role allows all actions for a cloud service, this policy or role is noncompliant.

iam-root-access-key-check

iam

If the account root user has an available access key, the account is noncompliant.

iam-user-group-membership-check

iam

If an IAM user is not in any of the specified IAM user groups, this user is noncompliant.

iam-user-mfa-enabled

iam

If multi-factor authentication is not enabled for an IAM user, this user is noncompliant.

iam-user-last-login-check

iam

If an IAM user does not log in to the system within the specified period, this user is non-compliant.

vpc-sg-restricted-ssh

vpc

If a security group allows all inbound traffic (with the source address set to 0.0.0.0/0 or ::/0) and opens the TCP 22 port, this security group is noncompliant.

ecs-instance-in-vpc

ecs, vpc

If an ECS is not within the specified VPC, this ECS is noncompliant.

kms-not-scheduled-for-deletion

kms

If a KMS key is scheduled for deletion, this key is noncompliant.

function-graph-public-access-prohibited

fgs

If a function can be accessed over a public network, this function is noncompliant.

function-graph-inside-vpc

fgs

If a function is not in the specified VPC, this function is noncompliant.

mfa-enabled-for-iam-console-access

iam

If an IAM user who is allowed to access Huawei Cloud console does not have MFA enabled, this IAM user is noncompliant.

css-cluster-https-required

css

If a CSS cluster does not have HTTPS enabled, this cluster is noncompliant.

rds-instance-no-public-ip

rds

If an RDS instance has an EIP attached, this RDS instance is noncompliant.

rds-instance-logging-enabled

rds

If an RDS instance does not have the collection of any types of logs enabled, this instance is noncompliant.

rds-instance-multi-az-support

rds

If an RDS instance does not support multi-AZ deployment, this RDS instance is noncompliant.

rds-instances-enable-kms

rds

If KMS encryption is not enabled for an RDS instance, this instance is noncompliant.

dws-enable-snapshot

dws

If automated snapshots are not enabled for a DWS cluster, this cluster is noncompliant.

gaussdb-instance-enable-backup

gaussdb

If a GaussDB instance does not have the backup enabled, this instance is noncompliant.

gaussdb-mysql-instance-enable-backup

taurusdb

If a TaurusDB instance does not have the backup enabled, this instance is noncompliant.

gaussdb-nosql-enable-backup

gemini db

If a GeminiDB instance does not have the backup enabled, this instance is noncompliant.

dws-enable-kms

dws

If KMS encryption is not enabled for a DWS cluster, this cluster is noncompliant.

gaussdb-nosql-enable-disk-encryption

gemini db

If a GeminiDB instance does not have disk encryption enabled, this instance is noncompliant.

dws-maintain-window-check

dws

If the O&M time window of a DWS cluster is not consistent with the specified time window, this cluster is noncompliant.

dws-clusters-no-public-ip

dws

If a DWS cluster has an EIP attached, this cluster is noncompliant.

dws-enable-ssl

dws

If SSL is not enabled for a DWS cluster, this cluster is noncompliant.

vpc-sg-restricted-common-ports

vpc

If a security group allows all IPv4 and IPv6 traffic (with the source address set to 0.0.0.0/0 or ::/0) to the specified ports, this security group is noncompliant.

root-account-mfa-enabled

iam

If the root user does not have MFA enabled, this root user is noncompliant.

csms-secrets-rotation-success-check

csms

If a CSMS secret fails to be rotated, this secret is noncompliant.

vpc-default-sg-closed

vpc

If a default security group allows all inbound or outbound traffic, this security group is noncompliant.

vpc-flow-logs-enabled

vpc

If a VPC does not have the flow log enabled, this VPC is noncompliant.

vpc-sg-ports-check

vpc

If a security group has the source address set to 0.0.0.0/0 or ::/0 and opens all TCP/UDP ports, this security group is noncompliant.

vpn-connections-active

vpnaas

If a VPN is not normally connected, this rule is noncompliant.