3 | P a g e
1.15 Ensure RAM policies that allow full "*:*" administrative privileges are not
created (Automated) ..................................................................................................................... 43
1.16 Ensure RAM policies are attached only to groups or roles (Automated) ....... 46
2 Logging and Monitoring .......................................................................................................................... 49
2.1 Ensure that ActionTrail are configured to export copies of all Log entries
(Automated) ...................................................................................................................................... 50
2.2 Ensure the OSS used to store ActionTrail logs is not publicly accessible
(Automated) ...................................................................................................................................... 53
2.3 Ensure audit logs for multiple cloud resources are integrated with Log Service
(Manual) ............................................................................................................................................. 55
2.4 Ensure Log Service is enabled for Container Service for Kubernetes (Manual)
................................................................................................................................................................ 58
2.5 Ensure virtual network flow log service is enabled (Manual) ............................... 60
2.6 Ensure Anti-DDoS access and security log service is enabled (Manual) ............ 62
2.7 Ensure Web Application Firewall access and security log service is enabled
(Manual) ............................................................................................................................................. 64
2.8 Ensure Cloud Firewall access and security log analysis is enabled (Manual) . 66
2.9 Ensure Security Center Network, Host and Security log analysis is enabled
(Manual) ............................................................................................................................................. 68
2.10 Ensure log monitoring and alerts are set up for RAM Role changes (Manual)
................................................................................................................................................................ 71
2.11 Ensure log monitoring and alerts are set up for Cloud Firewall changes
(Manual) ............................................................................................................................................. 73
2.12 Ensure log monitoring and alerts are set up for VPC network route changes
(Manual) ............................................................................................................................................. 75
2.13 Ensure log monitoring and alerts are set up for VPC changes (Manual) ......... 77
2.14 Ensure log monitoring and alerts are set up for OSS permission changes
(Manual) ............................................................................................................................................. 79
2.15 Ensure log monitoring and alerts are set up for RDS instance configuration
changes (Manual) ............................................................................................................................ 81
2.16 Ensure a log monitoring and alerts are set up for unauthorized API calls
(Manual) ............................................................................................................................................. 84
2.17 Ensure a log monitoring and alerts are set up for Management Console sign-
in without MFA (Manual) ............................................................................................................. 86
