--- title: "AWS Test Library | Vishcore Inc." description: "A representative set of the read-only AWS tests in the Vishcore scanner: what each checks, when it passes or fails, and its SOC 2 criteria and CIS v3.0.0 IDs. Also as JSON." canonical: https://vishcore.com/resources/test-library --- 1. [Resources](https://vishcore.com/resources) 2. AWS Test Library test library # The AWS tests our scanner runs, in plain English. A representative 30 of the 193 read-only tests in our scanner's catalog. Each one says what it checks, when it passes or fails, and the SOC 2 criteria and CIS IDs Vishcore maps it to. [Start discovery](https://vishcore.com/start-discovery) [Download the JSON](https://vishcore.com/api/test-library.json) This library **In the library** 30 tests, all read-only **In the full catalog** 193 tests **Benchmark** CIS Amazon Web Services Foundations Benchmark v3.0.0 **JSON** [/api/test-library.json](https://vishcore.com/api/test-library.json) **Markdown** [/resources/test-library.md](https://vishcore.com/resources/test-library.md) by area ## The library, area by area. 30 tests in this library, 193 in the full catalog. Pick an area to show only its tests. - All areas, 30 in this library, 193 in the full catalog - Identity and access, 4 in this library, 17 in the full catalog - Logging and audit trails, 4 in this library, 21 in the full catalog - Network exposure, 4 in this library, 25 in the full catalog - Edge and TLS, 3 in this library, 11 in the full catalog - Data protection (encryption and backups), 6 in this library, 43 in the full catalog - Monitoring and alerting, 3 in this library, 22 in the full catalog - Compute, 3 in this library, 21 in the full catalog - Governance, 3 in this library, 33 in the full catalog ### Identity and access 4 in this library, 17 in the full catalog - #### IAM users with console access have MFA Read-only Every IAM user who can sign in to the AWS console has an MFA device registered, not just the root user. Passes when every IAM user with a console password has an MFA device. Fails when any IAM user can sign in to the console without MFA. **Service** IAM **SOC 2** CC6.1 CC6.6 **CIS v3.0.0** CIS 1.10 - #### The root user has MFA enabled Read-only The AWS root user has multi-factor authentication turned on, so a stolen root password alone cannot open the account. Passes when the root user has an MFA device active. Fails when the root user signs in with a password alone. **Service** IAM **SOC 2** CC6.1 CC6.6 **CIS v3.0.0** CIS 1.5 - #### Active IAM access keys are rotated within 90 days Read-only No active IAM access key is older than the rotation window, 90 days by default, so a leaked key has a limited useful life. Passes when every active IAM access key was created or rotated in the last 90 days. Fails when any active IAM access key is 90 days old or older. **Service** IAM **SOC 2** CC6.1 CC6.2 **CIS v3.0.0** CIS 1.14 - #### Cognito user pools define a password policy Read-only Each Cognito user pool has a password policy set, so sign-in rules for your application's users are defined rather than left at defaults. Passes when every Cognito user pool in scope has a password policy defined. Fails when any Cognito user pool in scope has no password policy defined. **Service** Cognito **SOC 2** CC6.1 CC6.2 **CIS v3.0.0** No CIS ID mapped ### Logging and audit trails 4 in this library, 21 in the full catalog - #### CloudTrail trails validate log file integrity Read-only Every CloudTrail trail has log file validation turned on, so a tampered or deleted log file is detectable. Passes when every CloudTrail trail has log file validation enabled. Fails when any CloudTrail trail has log file validation turned off. **Service** CloudTrail **SOC 2** CC7.1 CC7.2 **CIS v3.0.0** CIS 3.2 - #### A CloudTrail trail records activity in every Region Read-only At least one CloudTrail trail is logging in every AWS Region, so activity in a Region nobody watches still leaves a record. Passes when a trail is logging and covers every Region. Fails when no logging trail covers every Region. **Service** CloudTrail **SOC 2** CC2.1 CC7.2 **CIS v3.0.0** CIS 3.1 - #### CloudWatch log groups have a retention period Read-only Every CloudWatch log group has an explicit retention period, so logs are neither deleted by accident nor kept forever by default. Passes when every CloudWatch log group has a retention period set. Fails when any CloudWatch log group is set to never expire. **Service** CloudWatch Logs **SOC 2** CC2.1 CC7.2 **CIS v3.0.0** No CIS ID mapped - #### VPCs capture Flow Logs Read-only Every VPC has Flow Logs turned on, so there is a record of which network connections were accepted or rejected. Passes when every VPC in scope has an active flow log. Fails when any VPC in scope has no flow log. **Service** VPC **SOC 2** CC2.1 CC7.2 P6.1 **CIS v3.0.0** CIS 3.7 ### Network exposure 4 in this library, 25 in the full catalog - #### Security groups do not expose SSH to the internet Read-only No security group allows SSH on port 22 from anywhere on the internet, so remote access stays behind a known network or a managed path. Passes when no security group allows port 22 from 0.0.0.0/0 or ::/0. Fails when any security group allows SSH from every address on the internet. **Service** EC2 **SOC 2** CC6.1 CC6.6 **CIS v3.0.0** CIS 5.2 CIS 5.3 - #### S3 buckets block public access at the bucket level Read-only Every S3 bucket has all four Block Public Access settings on, so a single bad policy or ACL cannot expose its contents. Passes when every S3 bucket has all four Block Public Access settings on. Fails when any S3 bucket has one or more Block Public Access settings off. **Service** S3 **SOC 2** CC6.1 CC6.6 **CIS v3.0.0** CIS 2.1.4 - #### RDS instances are not publicly accessible Read-only No RDS database instance is marked publicly accessible, so a database does not receive a public address by accident. Passes when no RDS instance in scope is marked publicly accessible. Fails when any RDS instance in scope is marked publicly accessible. **Service** RDS **SOC 2** CC6.1 CC6.6 **CIS v3.0.0** CIS 2.3.3 - #### S3 bucket policies deny requests that are not over TLS Read-only Every S3 bucket policy denies requests that do not use TLS, so data in transit to and from the bucket is encrypted. Passes when every S3 bucket policy denies requests made without TLS. Fails when any S3 bucket policy still accepts requests made without TLS. **Service** S3 **SOC 2** CC6.6 CC6.7 **CIS v3.0.0** CIS 2.1.1 ### Edge and TLS 3 in this library, 11 in the full catalog - #### Load balancer HTTP listeners redirect to HTTPS Read-only Every load balancer HTTP listener redirects to HTTPS, so a visitor who types a plain http address ends up on an encrypted connection. Passes when every HTTP listener on a load balancer redirects to HTTPS. Fails when any HTTP listener on a load balancer forwards traffic without redirecting. **Service** ELBv2 **SOC 2** CC6.6 CC6.7 **CIS v3.0.0** No CIS ID mapped - #### Load balancers terminate TLS with an ACM certificate Read-only Every load balancer has an HTTPS listener that uses an ACM certificate, so traffic from the internet is encrypted at the front door. Passes when every load balancer in scope has an HTTPS listener with an ACM certificate. Fails when any load balancer in scope has no HTTPS listener with an ACM certificate. **Service** ELBv2 **SOC 2** CC6.6 CC6.7 **CIS v3.0.0** No CIS ID mapped - #### CloudFront distributions require HTTPS from viewers Read-only Every CloudFront distribution redirects viewers to HTTPS or accepts only HTTPS, so visitors never browse your site in plain text. Passes when every CloudFront distribution redirects viewers to HTTPS or allows only HTTPS. Fails when any CloudFront distribution still serves viewers over plain HTTP. **Service** CloudFront **SOC 2** CC6.6 CC6.7 **CIS v3.0.0** No CIS ID mapped ### Data protection (encryption and backups) 6 in this library, 43 in the full catalog - #### RDS DB instances encrypt storage at rest Read-only Every RDS database instance has storage encryption turned on, so data at rest and its backups are unreadable without the key. Passes when every RDS instance in scope has storage encryption enabled. Fails when any RDS instance in scope stores data unencrypted. **Service** RDS **SOC 2** CC6.1 CC6.7 PI1.4 **CIS v3.0.0** CIS 2.3.1 - #### AWS Backup has at least one backup plan Read-only AWS Backup has at least one backup plan, which shows backups are scheduled by policy instead of by memory. Passes when AWS Backup has at least one backup plan. Fails when AWS Backup has no backup plan at all. **Service** AWS Backup **SOC 2** A1.2 A1.3 **CIS v3.0.0** No CIS ID mapped - #### DynamoDB tables have point-in-time recovery Read-only Every DynamoDB table has point-in-time recovery turned on, so a table can be restored to any second in the last 35 days. Passes when every DynamoDB table in scope has point-in-time recovery enabled. Fails when any DynamoDB table in scope has point-in-time recovery turned off. **Service** DynamoDB **SOC 2** A1.2 A1.3 **CIS v3.0.0** No CIS ID mapped - #### EBS encryption by default is on in each scoped Region Read-only EBS encryption by default is on in each scoped Region, so every new volume is encrypted without anyone having to remember. Passes when EBS encryption by default is on in every Region in scope. Fails when EBS encryption by default is off in any Region in scope. **Service** EBS **SOC 2** CC6.1 CC6.7 **CIS v3.0.0** CIS 2.2.1 - #### Customer-managed KMS keys rotate automatically Read-only Every customer-managed KMS key has automatic rotation turned on, so a key is not used unchanged year after year. Passes when every customer-managed KMS key has automatic rotation enabled. Fails when any customer-managed KMS key has automatic rotation turned off. **Service** KMS **SOC 2** CC6.1 CC6.7 **CIS v3.0.0** CIS 3.6 - #### S3 buckets encrypt objects by default Read-only Every S3 bucket encrypts new objects by default, so a missed upload setting does not leave data unencrypted. Passes when every S3 bucket has default encryption configured. Fails when any S3 bucket has no default encryption configured. **Service** S3 **SOC 2** CC6.1 CC6.7 **CIS v3.0.0** No CIS ID mapped ### Monitoring and alerting 3 in this library, 22 in the full catalog - #### The account has at least one CloudWatch alarm Read-only The account has at least one CloudWatch alarm, which shows that at least one metric threshold is watched rather than none. Passes when the account has at least one CloudWatch alarm. Fails when the account has no CloudWatch alarms. **Service** CloudWatch **SOC 2** A1.1 CC7.2 **CIS v3.0.0** No CIS ID mapped - #### AWS Config recorders are actively recording Read-only AWS Config is actively recording resource changes in each scoped Region, which gives you a history of what changed and when. Passes when an AWS Config recorder is recording in every Region in scope. Fails when any Region in scope has no Config recorder, or one that is stopped. **Service** AWS Config **SOC 2** CC7.1 CC7.2 CC8.1 **CIS v3.0.0** CIS 3.3 - #### GuardDuty has an enabled detector in each scoped Region Read-only GuardDuty has an enabled detector in each scoped Region, so AWS threat detection is watching account activity everywhere you run. Passes when GuardDuty has an enabled detector in every Region in scope. Fails when any Region in scope has no enabled GuardDuty detector. **Service** GuardDuty **SOC 2** A1.3 CC6.6 CC7.2 **CIS v3.0.0** No CIS ID mapped ### Compute 3 in this library, 21 in the full catalog - #### EC2 instances require IMDSv2 Read-only Every EC2 instance requires IMDSv2 for its metadata service, which blocks the request-forgery path that steals instance credentials. Passes when every EC2 instance in scope requires IMDSv2 session tokens. Fails when any EC2 instance in scope still accepts IMDSv1 requests. **Service** EC2 **SOC 2** CC6.1 CC6.6 **CIS v3.0.0** CIS 5.6 - #### ECR repositories scan images on push or through Inspector Read-only Every ECR repository scans images for known vulnerabilities on push or through Amazon Inspector, so a vulnerable image is flagged early. Passes when every ECR repository scans on push or is covered by Inspector scanning. Fails when any ECR repository has neither scan on push nor Inspector coverage. **Service** ECR **SOC 2** CC6.8 CC7.1 **CIS v3.0.0** No CIS ID mapped - #### Running EC2 instances report to Systems Manager Read-only Every running EC2 instance reports to Systems Manager, so patching and access can be managed without an open SSH port. Passes when every running EC2 instance in scope reports to Systems Manager. Fails when any running EC2 instance in scope is missing from Systems Manager. **Service** SSM **SOC 2** CC6.1 CC7.1 **CIS v3.0.0** No CIS ID mapped ### Governance 3 in this library, 33 in the full catalog - #### The account has a security alternate contact Read-only The AWS account has a security alternate contact on record, so AWS security notices reach a person who can act on them. Passes when the account has a security alternate contact on record. Fails when the account has no security alternate contact on record. **Service** AWS Account **SOC 2** CC2.3 CC7.4 **CIS v3.0.0** CIS 1.2 - #### The organization applies service control policy guardrails Read-only The AWS Organization applies service control policies beyond the default allow-all, so guardrails hold even when a single account is misconfigured. Passes when the organization has service control policies attached beyond the default. Fails when the organization relies only on the default allow-all policy. **Service** AWS Organizations **SOC 2** CC5.1 CC6.1 **CIS v3.0.0** No CIS ID mapped - #### Critical resources carry an Owner tag Read-only Critical resources carry an Owner tag, so when something looks wrong there is a named person or team to ask. Passes when every critical resource in scope has an Owner tag. Fails when any critical resource in scope has no Owner tag. **Service** Tagging **SOC 2** CC1.3 CC6.1 **CIS v3.0.0** No CIS ID mapped SOC 2, CIS and FSBP references are Vishcore's mapping guidance, not an auditor's determination; CIS references are shown only where verified against CIS Amazon Web Services Foundations Benchmark v3.0.0. The CIS AWS Foundations Benchmark v3.0.0 and the AICPA Trust Services Criteria are cited by ID only, never their text. The library lists tests, not results, and is not an audit opinion. Use it your way The same tests as data, for your compliance platform, a spreadsheet, or a review with your auditor. No email needed. The JSON Schema describes every field. - [JSON /api/test-library.json](https://vishcore.com/api/test-library.json) - [JSON Schema /api/test-library.schema.json](https://vishcore.com/api/test-library.schema.json) - [Markdown /resources/test-library.md](https://vishcore.com/resources/test-library.md) ## See how your account does on these tests. Start with a short note. After the fit check and signed engagement terms, a Cloud Control Scan evaluates the full catalog against your account, read-only. [How the scan works](https://vishcore.com/scan) [Start discovery](https://vishcore.com/start-discovery)