Strongly Recommended Governance Policies

RGC-GR_CONFIG_MULTI_REGION_CTS_TRACKER_EXISTS

This policy checks whether a CTS tracker has been created and enabled for the specified region list for an account. If not, the account is considered non-compliant.

Establishing logging and monitoring

High

cts:::tracker

RGC-GR_CONFIG_IAM_ROOT_ACCESS_KEY_CHECK

This policy checks whether there are available access keys for an account. If yes, the account is considered non-compliant.

Enforcing the least privilege

Critical

identity:::accessKey

RGC-GR_CONFIG_ROOT_ACCOUNT_MFA_ENABLED

This policy checks whether multi-factor authentication (MFA) is enabled for an account. If not, the account is considered non-compliant.

Enforcing the least privilege

High

identity:::acl

RGC-GR_CONFIG_IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS

This policy checks whether an IAM policy grants the admin permission (*:*:*, *:*, or *). If yes, the IAM policy is considered non-compliant.

Enforcing the least privilege

High

identity:::protectionPolicy

RGC-GR_CONFIG_IAM_ROLE_HAS_ALL_PERMISSIONS

This policy checks whether an IAM custom policy grants the allow *:* permission. If yes, the IAM policy is considered non-compliant.

Enforcing the least privilege

Low

identity:::role

RGC-GR_CONFIG_IAM_USER_MFA_ENABLED

This policy checks whether MFA is enabled for an IAM user. If not, the user is considered non-compliant.

Enforcing the least privilege

Medium

identity:::user

RGC-GR_CONFIG_RDS_INSTANCE_NO_PUBLIC_IP

This policy checks whether a public IP address is bound to an RDS instance. If yes, the instance is considered non-compliant.

Controlling network access

High

rds:::instance

RGC-GR_CONFIG_VOLUME_UNUSED_CHECK

This policy checks whether an EVS disk is attached to a cloud server. If not, the EVS disk is considered non-compliant.

Optimizing costs

High

evs:::volume

RGC-GR_CONFIG_VPC_SG_PORTS_CHECK

This policy checks whether the inbound source IP address of a security group is set to 0.0.0.0/0 and all TCP/UDP ports are enabled. If yes, the security group is considered non-compliant.

Controlling network access

High

networking:::secgroup

RGC-GR_CONFIG_VPC_DEFAULT_SG_CLOSED

This policy checks whether the default security group of a VPC allows inbound or outbound traffic. If yes, the default security group is considered non-compliant.

Controlling network access

High

networking:::secgroup

RGC-GR_CONFIG_VPC_FLOW_LOGS_ENABLED

This policy checks whether flow logs are enabled for a VPC. If not, the VPC is considered non-compliant.

Establishing logging and monitoring

Medium

vpc:::flowLog

RGC-GR_CONFIG_VPC_SG_RESTRICTED_SSH

This policy checks whether the inbound source IP address of a security group is set to 0.0.0.0/0 and TCP port 22 is enabled. If yes, the security group is considered non-compliant.

Controlling network access

High

networking:::secgroup

RGC-GR_CONFIG_CCE_ENDPOINT_PUBLIC_ACCESS

This policy checks whether a public IP address is bound to a CCE cluster. If yes, the CCE cluster is considered non-compliant.

Controlling network access

Medium

cce:::cluster

RGC-GR_CONFIG_CSS_CLUSTER_HTTPS_REQUIRED

This policy checks whether HTTPS access is enabled for a CSS cluster. If not, the cluster is considered non-compliant.

Encrypting data in transit

Medium

css:::cluster

RGC-GR_CONFIG_DWS_ENABLE_LOG_DUMP

This policy checks whether log dump is enabled for a DWS cluster. If not, the cluster is considered non-compliant.

Establishing logging and monitoring

Medium

dws:::cluster

RGC-GR_CONFIG_ECS_INSTANCE_NO_PUBLIC_IP

This policy checks whether a public IP address is bound to an ECS. If yes, the ECS is considered non-compliant.

Controlling network access

Medium

compute:::instance

RGC-GR_CONFIG_ECS_MULTIPLE_PUBLIC_IP_CHECK

This policy checks whether multiple public IP addresses are bound to an ECS. If yes, the ECS is considered non-compliant.

Controlling network access

Low

compute:::instance

RGC-GR_CONFIG_ELB_TLS_HTTPS_LISTENERS_ONLY

This policy checks whether HTTPS is configured for any listener of a load balancer. If not, the load balancer is considered non-compliant.

Encrypting data in transit

Medium

elb:::listener

RGC-GR_CONFIG_MRS_CLUSTER_NO_PUBLIC_IP

This policy checks whether a public IP address is bound to an MRS cluster. If yes, the cluster is considered non-compliant.

Controlling network access

Medium

mrs:::cluster

RGC-GR_CONFIG_APIG_INSTANCES_EXECUTION_LOGGING_ENABLED

This policy checks whether a dedicated API gateway is configured with access logs. If not, the gateway is considered non-compliant.

Establishing logging and monitoring

Medium

apig:::instance

RGC-GR_CONFIG_APIG_INSTANCES_AUTHORIZATION_TYPE_CONFIGURED

This policy checks whether security authentication is provided for a dedicated API gateway. If not, the gateway is considered non-compliant.

Encrypting data in transit

Medium

apig:::instance

RGC-GR_CONFIG_APIG_INSTANCES_SSL_ENABLED

This policy checks whether any domain name of a dedicated API gateway is associated with an SSL certificate. If not, the gateway is considered non-compliant.

Encrypting data in transit

Medium

apig:::instance

RGC-GR_CONFIG_FUNCTION_GRAPH_PUBLIC_ACCESS_PROHIBITED

This policy checks whether functions in FunctionGraph allow public access. If yes, the functions are considered non-compliant.

Controlling network access

Critical

fgs:::function

RGC-GR_CONFIG_SMN_LTS_ENABLE

This policy checks whether event analysis is enabled for an SMN topic. If not, the topic is considered non-compliant.

Establishing logging and monitoring

Medium

smn:::topic