test library
A representative 30 of the 193 read‑only tests in our scanner's catalog. Each one says what it checks, when it passes or fails, and the SOC 2 criteria and CIS IDs Vishcore maps it to.
by area
30 tests in this library, 193 in the full catalog. Pick an area to show only its tests.
4 in this library, 17 in the full catalog
Every IAM user who can sign in to the AWS console has an MFA device registered, not just the root user.
Passes when every IAM user with a console password has an MFA device.
Fails when any IAM user can sign in to the console without MFA.
The AWS root user has multi-factor authentication turned on, so a stolen root password alone cannot open the account.
Passes when the root user has an MFA device active.
Fails when the root user signs in with a password alone.
No active IAM access key is older than the rotation window, 90 days by default, so a leaked key has a limited useful life.
Passes when every active IAM access key was created or rotated in the last 90 days.
Fails when any active IAM access key is 90 days old or older.
Each Cognito user pool has a password policy set, so sign-in rules for your application's users are defined rather than left at defaults.
Passes when every Cognito user pool in scope has a password policy defined.
Fails when any Cognito user pool in scope has no password policy defined.
4 in this library, 21 in the full catalog
Every CloudTrail trail has log file validation turned on, so a tampered or deleted log file is detectable.
Passes when every CloudTrail trail has log file validation enabled.
Fails when any CloudTrail trail has log file validation turned off.
At least one CloudTrail trail is logging in every AWS Region, so activity in a Region nobody watches still leaves a record.
Passes when a trail is logging and covers every Region.
Fails when no logging trail covers every Region.
Every CloudWatch log group has an explicit retention period, so logs are neither deleted by accident nor kept forever by default.
Passes when every CloudWatch log group has a retention period set.
Fails when any CloudWatch log group is set to never expire.
Every VPC has Flow Logs turned on, so there is a record of which network connections were accepted or rejected.
Passes when every VPC in scope has an active flow log.
Fails when any VPC in scope has no flow log.
4 in this library, 25 in the full catalog
No security group allows SSH on port 22 from anywhere on the internet, so remote access stays behind a known network or a managed path.
Passes when no security group allows port 22 from 0.0.0.0/0 or ::/0.
Fails when any security group allows SSH from every address on the internet.
Every S3 bucket has all four Block Public Access settings on, so a single bad policy or ACL cannot expose its contents.
Passes when every S3 bucket has all four Block Public Access settings on.
Fails when any S3 bucket has one or more Block Public Access settings off.
No RDS database instance is marked publicly accessible, so a database does not receive a public address by accident.
Passes when no RDS instance in scope is marked publicly accessible.
Fails when any RDS instance in scope is marked publicly accessible.
Every S3 bucket policy denies requests that do not use TLS, so data in transit to and from the bucket is encrypted.
Passes when every S3 bucket policy denies requests made without TLS.
Fails when any S3 bucket policy still accepts requests made without TLS.
3 in this library, 11 in the full catalog
Every load balancer HTTP listener redirects to HTTPS, so a visitor who types a plain http address ends up on an encrypted connection.
Passes when every HTTP listener on a load balancer redirects to HTTPS.
Fails when any HTTP listener on a load balancer forwards traffic without redirecting.
Every load balancer has an HTTPS listener that uses an ACM certificate, so traffic from the internet is encrypted at the front door.
Passes when every load balancer in scope has an HTTPS listener with an ACM certificate.
Fails when any load balancer in scope has no HTTPS listener with an ACM certificate.
Every CloudFront distribution redirects viewers to HTTPS or accepts only HTTPS, so visitors never browse your site in plain text.
Passes when every CloudFront distribution redirects viewers to HTTPS or allows only HTTPS.
Fails when any CloudFront distribution still serves viewers over plain HTTP.
6 in this library, 43 in the full catalog
Every RDS database instance has storage encryption turned on, so data at rest and its backups are unreadable without the key.
Passes when every RDS instance in scope has storage encryption enabled.
Fails when any RDS instance in scope stores data unencrypted.
AWS Backup has at least one backup plan, which shows backups are scheduled by policy instead of by memory.
Passes when AWS Backup has at least one backup plan.
Fails when AWS Backup has no backup plan at all.
Every DynamoDB table has point-in-time recovery turned on, so a table can be restored to any second in the last 35 days.
Passes when every DynamoDB table in scope has point-in-time recovery enabled.
Fails when any DynamoDB table in scope has point-in-time recovery turned off.
EBS encryption by default is on in each scoped Region, so every new volume is encrypted without anyone having to remember.
Passes when EBS encryption by default is on in every Region in scope.
Fails when EBS encryption by default is off in any Region in scope.
Every customer-managed KMS key has automatic rotation turned on, so a key is not used unchanged year after year.
Passes when every customer-managed KMS key has automatic rotation enabled.
Fails when any customer-managed KMS key has automatic rotation turned off.
Every S3 bucket encrypts new objects by default, so a missed upload setting does not leave data unencrypted.
Passes when every S3 bucket has default encryption configured.
Fails when any S3 bucket has no default encryption configured.
3 in this library, 22 in the full catalog
The account has at least one CloudWatch alarm, which shows that at least one metric threshold is watched rather than none.
Passes when the account has at least one CloudWatch alarm.
Fails when the account has no CloudWatch alarms.
AWS Config is actively recording resource changes in each scoped Region, which gives you a history of what changed and when.
Passes when an AWS Config recorder is recording in every Region in scope.
Fails when any Region in scope has no Config recorder, or one that is stopped.
GuardDuty has an enabled detector in each scoped Region, so AWS threat detection is watching account activity everywhere you run.
Passes when GuardDuty has an enabled detector in every Region in scope.
Fails when any Region in scope has no enabled GuardDuty detector.
3 in this library, 21 in the full catalog
Every EC2 instance requires IMDSv2 for its metadata service, which blocks the request-forgery path that steals instance credentials.
Passes when every EC2 instance in scope requires IMDSv2 session tokens.
Fails when any EC2 instance in scope still accepts IMDSv1 requests.
Every ECR repository scans images for known vulnerabilities on push or through Amazon Inspector, so a vulnerable image is flagged early.
Passes when every ECR repository scans on push or is covered by Inspector scanning.
Fails when any ECR repository has neither scan on push nor Inspector coverage.
Every running EC2 instance reports to Systems Manager, so patching and access can be managed without an open SSH port.
Passes when every running EC2 instance in scope reports to Systems Manager.
Fails when any running EC2 instance in scope is missing from Systems Manager.
3 in this library, 33 in the full catalog
The AWS account has a security alternate contact on record, so AWS security notices reach a person who can act on them.
Passes when the account has a security alternate contact on record.
Fails when the account has no security alternate contact on record.
The AWS Organization applies service control policies beyond the default allow-all, so guardrails hold even when a single account is misconfigured.
Passes when the organization has service control policies attached beyond the default.
Fails when the organization relies only on the default allow-all policy.
Critical resources carry an Owner tag, so when something looks wrong there is a named person or team to ask.
Passes when every critical resource in scope has an Owner tag.
Fails when any critical resource in scope has no Owner tag.
SOC 2, CIS and FSBP references are Vishcore's mapping guidance, not an auditor's determination; CIS references are shown only where verified against CIS Amazon Web Services Foundations Benchmark v3.0.0.
The CIS AWS Foundations Benchmark v3.0.0 and the AICPA Trust Services Criteria are cited by ID only, never their text. The library lists tests, not results, and is not an audit opinion.
Use it your way
The same tests as data, for your compliance platform, a spreadsheet, or a review with your auditor. No email needed. The JSON Schema describes every field.
Start with a short note. After the fit check and signed engagement terms, a Cloud Control Scan evaluates the full catalog against your account, read‑only.
How the scan works