Cloud Provider Evidence
Where to locate common evidence items on AWS, Azure, and GCP
AWS: Backup Schedule and Settings
AWS: Availability Monitoring Tool
AWS: Asset List, Server List
AWS: API Security
AWS: Role Access Management
AWS: Production System Restricted Access, Remote System Authentication
AWS: Password Policy and Settings, Password Policy Evidence
AWS: Patch Scan, Server Configuration
AWS: Network Admin Users
AWS: Network Access Log
AWS: Log Aggregation, Monitoring Tools Enabled
AWS: Multi-Factor Authentication Access, Multi Factor Authentication Evidence
AWS: IDS Screenshots
AWS: Hardening Configurations
AWS: Firewall Rules
AWS: Encryption Key Access, Key/Secrets Access
AWS: Encryption in Transit
AWS: Denial of Service
AWS: Cloud Service Access
AWS: Cloud Security Alerting
AWS: Cloud Monitoring Insights and Tools
AWS: Cloud Monitoring Dashboard
AWS: Application Firewall
AWS: Access to Production
AWS: Antivirus Install
GCP: Role Access Management
GCP: Production System Restricted Access, Remote System Authentication
GCP: Patch Scan, Server Configuration
GCP: Multi-Factor Authentication Access, Multi-Factor Authentication Evidence
GCP: IDS Screenshots
GCP: Hardening Configurations
GCP: Firewall Rules
GCP: Key & Secrets Access
GCP: Cloud Monitoring Dashboard, Cloud Security Alerting
GCP: Denial of Service
GCP: Cloud Key Evidence, Encryption Key Access
GCP: Change Network Infrastructure Evidence, Cloud Monitoring Insights and Tools, Log Aggregation, Monitoring Tools Enabled, Network Access Log
GCP: Breach Events, Security Alerts, Threat Detection Alerting
GCP: Backup Schedule and Settings
GCP: Availability Monitoring Tool
GCP: Asset List, Server List
GCP: Application Firewall
GCP: API Security
GCP: Antivirus Install
GCP: Access to Production, Cloud Service Access