@aws-cdk/aws-iot-alpha.AuditCheck

Experimental

@aws-cdk/aws-iot-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

AuditCheck Enum

The AWS IoT Device Defender audit checks.

Stability

Experimental

Source

lib/scheduled-audit.ts

Example

declare const config: iot.AccountAuditConfiguration;

// Daily audit
const dailyAudit = new iot.ScheduledAudit(this, 'DailyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.DAILY,
  auditChecks: [
    iot.AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK,
  ],
})

// Weekly audit
const weeklyAudit = new iot.ScheduledAudit(this, 'WeeklyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.WEEKLY,
  dayOfWeek: iot.DayOfWeek.SUNDAY,
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK,
  ],
});

// Monthly audit
const monthlyAudit = new iot.ScheduledAudit(this, 'MonthlyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.MONTHLY,
  dayOfMonth: iot.DayOfMonth.of(1),
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK,
  ],
});

Members

Member	Description
AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK	Checks the permissiveness of an authenticated Amazon Cognito identity pool role.
CA_CERTIFICATE_EXPIRING_CHECK	Checks if a CA certificate is expiring.
CA_CERTIFICATE_KEY_QUALITY_CHECK	Checks the quality of the CA certificate key.
CONFLICTING_CLIENT_IDS_CHECK	Checks if multiple devices connect using the same client ID.
DEVICE_CERTIFICATE_EXPIRING_CHECK	Checks if a device certificate is expiring.
DEVICE_CERTIFICATE_KEY_QUALITY_CHECK	Checks the quality of the device certificate key.
DEVICE_CERTIFICATE_SHARED_CHECK	Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT.
IOT_POLICY_OVERLY_PERMISSIVE_CHECK	Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
IOT_ROLE_ALIAS_ALLOWS_ACCESS_TO_UNUSED_SERVICES_CHECK	Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
IOT_ROLE_ALIAS_OVERLY_PERMISSIVE_CHECK	Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
LOGGING_DISABLED_CHECK	Checks if AWS IoT logs are disabled.
REVOKED_CA_CERTIFICATE_STILL_ACTIVE_CHECK	Checks if a revoked CA certificate is still active.
REVOKED_DEVICE_CERTIFICATE_STILL_ACTIVE_CHECK	Checks if a revoked device certificate is still active.
UNAUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK	Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

Referenced by

• ScheduledAuditProps.auditChecksaudit_checksauditChecksAuditChecksAuditChecks