Ensure Userland Proxy is Disabled (Automated)
The Docker daemon starts a userland proxy service for port forwarding whenever a port is exposed. Where hairpin NAT is...
Blog
Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Automated)
You can choose to apply a custom seccomp profile at a daemon-wide level if needed with this overriding Docker's default...
Ensure containers are restricted from acquiring new privileges (Automated)
By default you should restrict containers from acquiring additional privileges via suid or sgid.
Ensure auditing is configured for Docker files and directories – containerd.sock (Automated)
Audit containerd.sock, if applicable.
Ensure auditing is configured for Docker files and directories – /etc/containerd/config.toml (Automated)
Audit /etc/containerd/config.toml if applicable.
Ensure syslog messages are not suppressed (Automated)
In more modern Syslog implementations, repeated message suppression can be configured (for example, $RepeatedMsgReduction in rsyslog).
Ensure ‘debug_print_plan’ is disabled (Automated)
Enabling any of the DEBUG printing variables may cause the logging of sensitive information that would otherwise be omitted based...
OpenSearch (Elasticsearch) domain has less than three data nodes
Amazon OpenSearch Service (Amazon Elasticsearch Service successor) is a managed service that simplifies the deployment, operation, and scaling of OpenSearch...
Elasticsearch without at least three dedicated master nodes
Amazon OpenSearch Service (Amazon Elasticsearch Service successor) is a managed service that simplifies the deployment, operation, and scaling of OpenSearch...