> **Experimental**
>
> `@aws-cdk/aws-iot-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# AuditCheck

The AWS IoT Device Defender audit checks.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/scheduled-audit.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-iot-alpha/lib/scheduled-audit.ts#L46)

## Example

```ts
declare const config: iot.AccountAuditConfiguration;

// Daily audit
const dailyAudit = new iot.ScheduledAudit(this, 'DailyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.DAILY,
  auditChecks: [
    iot.AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK,
  ],
})

// Weekly audit
const weeklyAudit = new iot.ScheduledAudit(this, 'WeeklyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.WEEKLY,
  dayOfWeek: iot.DayOfWeek.SUNDAY,
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK,
  ],
});

// Monthly audit
const monthlyAudit = new iot.ScheduledAudit(this, 'MonthlyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.MONTHLY,
  dayOfMonth: iot.DayOfMonth.of(1),
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK,
  ],
});
```

## Members

| Member | Description |
| --- | --- |
| `AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK` | Checks the permissiveness of an authenticated Amazon Cognito identity pool role. |
| `CA_CERTIFICATE_EXPIRING_CHECK` | Checks if a CA certificate is expiring. |
| `CA_CERTIFICATE_KEY_QUALITY_CHECK` | Checks the quality of the CA certificate key. |
| `CONFLICTING_CLIENT_IDS_CHECK` | Checks if multiple devices connect using the same client ID. |
| `DEVICE_CERTIFICATE_EXPIRING_CHECK` | Checks if a device certificate is expiring. |
| `DEVICE_CERTIFICATE_KEY_QUALITY_CHECK` | Checks the quality of the device certificate key. |
| `DEVICE_CERTIFICATE_SHARED_CHECK` | Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT. |
| `IOT_POLICY_OVERLY_PERMISSIVE_CHECK` | Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role. |
| `IOT_ROLE_ALIAS_ALLOWS_ACCESS_TO_UNUSED_SERVICES_CHECK` | Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year. |
| `IOT_ROLE_ALIAS_OVERLY_PERMISSIVE_CHECK` | Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive. |
| `LOGGING_DISABLED_CHECK` | Checks if AWS IoT logs are disabled. |
| `REVOKED_CA_CERTIFICATE_STILL_ACTIVE_CHECK` | Checks if a revoked CA certificate is still active. |
| `REVOKED_DEVICE_CERTIFICATE_STILL_ACTIVE_CHECK` | Checks if a revoked device certificate is still active. |
| `UNAUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK` | Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive. |

## Referenced by

- [`ScheduledAuditProps`](/v2/docs/@aws-cdk_aws-iot-alpha.ScheduledAuditProps).auditChecks