AWS Audit Manager Control Tower Guardrails

aws_audit_manager_control_tower_guardrails_aws

AWS-Audit-Manager-Control-Tower-Guardrails

OfficialVerified

AWS Control Tower is a management and governance service that you can use to navigate through the setup process and governance requirements that are involved in creating a multi-account AWS environment.

14requirements18checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance aws_audit_manager_control_tower_guardrails_aws

Requirements (14)

EBS checks33

1.0.1Checks whether EBS optimization is enabled for your EC2 instances that can be EBS-optimized0

Attributes

Item Id: 1.0.1
Section: EBS checks
Service: ebs

1.0.2Checks whether EBS volumes are attached to EC2 instances1

Attributes

Item Id: 1.0.2
Section: EBS checks
Service: ebs

1.0.3Checks whether EBS volumes that are in an attached state are encrypted2

Attributes

Item Id: 1.0.3
Section: EBS checks
Service: ebs

Disallow Internet Connection22

2.0.1Checks whether security groups that are in use disallow unrestricted incoming TCP traffic to the specified1

Attributes

Item Id: 2.0.1
Section: Disallow Internet Connection
Service: vpc

2.0.2Checks whether security groups that are in use disallow unrestricted incoming SSH traffic.1

Attributes

Item Id: 2.0.2
Section: Disallow Internet Connection
Service: vpc

Multi-Factor Authentication39

3.0.1Checks whether the AWS Identity and Access Management users have multi-factor authentication (MFA) enabled.3

Attributes

Item Id: 3.0.1
Section: Multi-Factor Authentication
Service: iam

3.0.2Checks whether AWS Multi-Factor Authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password.3

Attributes

Item Id: 3.0.2
Section: Multi-Factor Authentication
Service: iam

3.0.3Checks whether the root user of your AWS account requires multi-factor authentication for console sign-in.3

Attributes

Item Id: 3.0.3
Section: Multi-Factor Authentication
Service: iam

Disallow Public Access47

4.0.1Checks whether the Amazon Relational Database Service (RDS) instances are not publicly accessible. The rule is non-compliant if the publiclyAccessible field is true in the instance configuration item.1

Attributes

Item Id: 4.0.1
Section: Disallow Public Access
Service: rds

4.0.2Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public. The rule is non-compliant if any existing and new Amazon RDS snapshots are public.1

Attributes

Item Id: 4.0.2
Section: Disallow Public Access
Service: rds

4.1.1Checks that your S3 buckets do not allow public read access.4

Attributes

Item Id: 4.1.1
Section: Disallow Public Access
Service: s3

4.1.2Checks that your S3 buckets do not allow public write access.1

Attributes

Item Id: 4.1.2
Section: Disallow Public Access
Service: s3

Disallow Instances23

5.0.1Checks whether storage encryption is enabled for your RDS DB instances.2

Attributes

Item Id: 5.0.1
Section: Disallow Instances
Service: rds

5.1.1Checks whether versioning is enabled for your S3 buckets.1

Attributes

Item Id: 5.1.1
Section: Disallow Instances
Service: s3