AWS Foundational Security Best Practices

aws_foundational_security_best_practices_aws

AWS-Foundational-Security-Best-Practices

OfficialVerified

The AWS Foundational Security Best Practices standard is a set of controls that detect when your deployed accounts and resources deviate from security best practices.

286requirements204checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance aws_foundational_security_best_practices_aws

Requirements (286)

ACM22

ACM.1This control checks whether ACM certificates in your account are marked for expiration within 30 days. It checks both imported certificates and certificates provided by AWS Certificate Manager.1

Attributes

Item Id: ACM.1
Section: ACM
Service: ACM
Severity: medium
Section Description: This section contains recommendations for configuring ACM resources.

ACM.2This control checks whether RSA certificates managed by AWS Certificate Manager use a key length of at least 2,048 bits. The control fails if the key length is smaller than 2,048 bits.1

Attributes

Query: acm_certificate_rsa_key_length_2048_bits_or_greater
Item Id: ACM.2
Section: ACM
Service: ACM
Severity: high
Section Description: This section contains recommendations for configuring ACM resources.

API Gateway75

APIGateway.1This control checks whether all stages of an Amazon API Gateway REST or WebSocket API have logging enabled. The control fails if logging is not enabled for all methods of a stage or if loggingLevel is neither ERROR nor INFO.1

Attributes

Item Id: APIGateway.1
Section: API Gateway
Service: API Gateway
Severity: medium
Section Description: This section contains recommendations for configuring API Gateway resources.

APIGateway.2This control checks whether Amazon API Gateway REST API stages have SSL certificates configured. Backend systems use these certificates to authenticate that incoming requests are from API Gateway.1

Attributes

Item Id: APIGateway.2
Section: API Gateway
Service: API Gateway
Severity: medium
Section Description: This section contains recommendations for configuring API Gateway resources.

APIGateway.3This control checks whether AWS X-Ray active tracing is enabled for your Amazon API Gateway REST API stages.0

Attributes

Item Id: APIGateway.3
Section: API Gateway
Service: API Gateway
Severity: low
Section Description: This section contains recommendations for configuring API Gateway resources.

APIGateway.4This control checks whether an API Gateway stage uses an AWS WAF web access control list (ACL). This control fails if an AWS WAF web ACL is not attached to a REST API Gateway stage.1

Attributes

Item Id: APIGateway.4
Section: API Gateway
Service: API Gateway
Severity: medium
Section Description: This section contains recommendations for configuring API Gateway resources.

APIGateway.5This control checks whether all methods in API Gateway REST API stages that have cache enabled are encrypted. The control fails if any method in an API Gateway REST API stage is configured to cache and the cache is not encrypted.0

Attributes

Item Id: APIGateway.5
Section: API Gateway
Service: API Gateway
Severity: medium
Section Description: This section contains recommendations for configuring API Gateway resources.

APIGateway.8This control checks if Amazon API Gateway routes have an authorization type. The control fails if the API Gateway route does not specify an authorization type.1

Attributes

Item Id: APIGateway.8
Section: API Gateway
Service: API Gateway
Severity: medium
Section Description: This section contains recommendations for configuring API Gateway resources.

APIGateway.9This control checks if Amazon API Gateway V2 stages have access logging configured. This control fails if access log settings aren't defined.1

Attributes

Item Id: APIGateway.9
Section: API Gateway
Service: API Gateway
Severity: medium
Section Description: This section contains recommendations for configuring API Gateway resources.

Account11

Account.1This control checks if an Amazon Web Services (AWS) account has security contact information. The control fails if security contact information is not provided for the account.1

Attributes

Item Id: Account.1
Section: Account
Service: Account
Severity: medium
Section Description: This section contains recommendations for configuring Account resources.

AppSync20

AppSync.1This control checks whether an AWS AppSync API cache is encrypted at rest. The control fails if the API cache isn't encrypted at rest.0

Attributes

Item Id: AppSync.1
Section: AppSync
Service: AppSync
Severity: medium
Section Description: This section contains recommendations for configuring AppSync resources.

AppSync.2This control checks whether an AWS AppSync API has field-level logging turned on. The control fails if the field resolver log level is set to None. Unless you provide custom parameter values to indicate that a specific log type should be enabled, Security Hub produces a passed finding if the field resolver log level is either ERROR or ALL.0

Attributes

Query: appsync_graphql_api_field_level_logging_enabled
Item Id: AppSync.2
Section: AppSync
Service: AppSync
Severity: medium
Section Description: This section contains recommendations for configuring AppSync resources.

Athena11

Athena.1This control checks if an Athena workgroup is encrypted at rest. The control fails if an Athena workgroup isn't encrypted at rest.1

Attributes

Item Id: Athena.1
Section: Athena
Service: Athena
Severity: medium
Section Description: This section contains recommendations for configuring Athena resources.

AutoScaling71

AutoScaling.1This control checks whether your Auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. This ensures that the group can determine an instance's health based on additional tests provided by the load balancer. Using Elastic Load Balancing health checks can help support the availability of applications that use EC2 Auto Scaling groups.0

Attributes

Item Id: AutoScaling.1
Section: AutoScaling
Service: AutoScaling
Severity: low
Section Description: This section contains recommendations for configuring Auto Scaling resources.

AutoScaling.2This control checks whether an Auto Scaling group spans multiple Availability Zones. The control fails if an Auto Scaling group does not span multiple availability zones.1

Attributes

Item Id: AutoScaling.2
Section: AutoScaling
Service: AutoScaling
Severity: medium
Section Description: This section contains recommendations for configuring Auto Scaling resources.

AutoScaling.3This control checks whether IMDSv2 is enabled on all instances launched by Amazon EC2 Auto Scaling groups. The control fails if the Instance Metadata Service (IMDS) version is not included in the launch configuration or if both IMDSv1 and IMDSv2 are enabled.0

Attributes

Item Id: AutoScaling.3
Section: AutoScaling
Service: AutoScaling
Severity: high
Section Description: This section contains recommendations for configuring Auto Scaling resources.

AutoScaling.4This control checks the number of network hops that a metadata token can travel. The control fails if the metadata response hop limit is greater than 1.0

Attributes

Item Id: AutoScaling.4
Section: AutoScaling
Service: AutoScaling
Severity: high
Section Description: This section contains recommendations for configuring Auto Scaling resources.

AutoScaling.5This control checks whether an Auto Scaling groups associated launch configuration assigns a public IP address to the group's instances.0

Attributes

Item Id: AutoScaling.5
Section: AutoScaling
Service: AutoScaling
Severity: high
Section Description: This section contains recommendations for configuring Auto Scaling resources.

AutoScaling.6This control checks whether an Amazon EC2 Auto Scaling group uses multiple instance types. The control fails if the Auto Scaling group has only one instance type defined.0

Attributes

Item Id: AutoScaling.6
Section: AutoScaling
Service: AutoScaling
Severity: medium
Section Description: This section contains recommendations for configuring Auto Scaling resources.

AutoScaling.9This control checks whether an Amazon EC2 Auto Scaling group is created from an EC2 launch template. This control fails if an Amazon EC2 Auto Scaling group is not created with a launch template or if a launch template is not specified in a mixed instances policy.0

Attributes

Item Id: AutoScaling.9
Section: AutoScaling
Service: AutoScaling
Severity: medium
Section Description: This section contains recommendations for configuring Auto Scaling resources.

Backup10

Backup.1This control checks if an AWS Backup recovery point is encrypted at rest. The control fails if the recovery point isn't encrypted at rest.0

Attributes

Item Id: Backup.1
Section: Backup
Service: Backup
Severity: medium
Section Description: This section contains recommendations for configuring Backup resources.

CloudFormation10

CloudFormation.1This control checks whether an Amazon Simple Notification Service notification is integrated with a CloudFormation stack. The control fails for a CloudFormation stack if there is no SNS notification associated with it.0

Attributes

Item Id: CloudFormation.1
Section: CloudFormation
Service: CloudFormation
Severity: low
Section Description: This section contains recommendations for configuring CloudFormation resources.

CloudFront1110

CloudFront.1This control checks whether an Amazon CloudFront distribution is configured to return a specific object that is the default root object. The control fails if the CloudFront distribution does not have a default root object configured.1

Attributes

Item Id: CloudFront.1
Section: CloudFront
Service: CloudFront
Severity: critical
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.3This control checks whether an Amazon CloudFront distribution requires viewers to use HTTPS directly or whether it uses redirection. The control fails if ViewerProtocolPolicy is set to allow-all for defaultCacheBehavior or for cacheBehaviors.0

Attributes

Item Id: CloudFront.3
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.4This control checks whether an Amazon CloudFront distribution is configured with an origin group that has two or more origins. CloudFront origin failover can increase availability. Origin failover automatically redirects traffic to a secondary origin if the primary origin is unavailable or if it returns specific HTTP response status codes.1

Attributes

Item Id: CloudFront.4
Section: CloudFront
Service: CloudFront
Severity: low
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.5This control checks whether server access logging is enabled on CloudFront distributions. The control fails if access logging is not enabled for a distribution.1

Attributes

Item Id: CloudFront.5
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.6This control checks whether CloudFront distributions are associated with either AWS WAF or AWS WAFv2 web ACLs. The control fails if the distribution is not associated with a web ACL.1

Attributes

Item Id: CloudFront.6
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.7This control checks whether CloudFront distributions are using the default SSL/TLS certificate CloudFront provides. This control passes if the CloudFront distribution uses a custom SSL/TLS certificate. This control fails if the CloudFront distribution uses the default SSL/TLS certificate.1

Attributes

Item Id: CloudFront.7
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.8This control checks if Amazon CloudFront distributions are using a custom SSL/TLS certificate and are configured to use SNI to serve HTTPS requests. This control fails if a custom SSL/TLS certificate is associated but the SSL/TLS support method is a dedicated IP address.1

Attributes

Item Id: CloudFront.8
Section: CloudFront
Service: CloudFront
Severity: low
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.9This control checks if Amazon CloudFront distributions are encrypting traffic to custom origins. This control fails for a CloudFront distribution whose origin protocol policy allows 'http-only'. This control also fails if the distribution's origin protocol policy is 'match-viewer' while the viewer protocol policy is 'allow-all'.1

Attributes

Item Id: CloudFront.9
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.10This control checks if Amazon CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and your custom origins. This control fails if a CloudFront distribution has a CustomOriginConfig where OriginSslProtocols includes SSLv3.1

Attributes

Item Id: CloudFront.10
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.12This control checks whether Amazon CloudFront distributions are pointing to non-existent Amazon S3 origins. The control fails for a CloudFront distribution if the origin is configured to point to a non-existent bucket. This control only applies to CloudFront distributions where an S3 bucket without static website hosting is the S3 origin.1

Attributes

Item Id: CloudFront.12
Section: CloudFront
Service: CloudFront
Severity: high
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudFront.13This control checks whether an Amazon CloudFront distribution with an Amazon S3 origin has origin access control (OAC) configured. The control fails if OAC isn't configured for the CloudFront distribution.1

Attributes

Item Id: CloudFront.13
Section: CloudFront
Service: CloudFront
Severity: medium
Section Description: This section contains recommendations for configuring CloudFront resources.

CloudTrail76

CloudTrail.1This control checks that there is at least one multi-Region CloudTrail trail.1

Attributes

Item Id: CloudTrail.1
Section: CloudTrail
Service: CloudTrail
Severity: high
Section Description: This section contains recommendations for configuring CloudTrail resources.

CloudTrail.2This control checks whether CloudTrail is configured to use the server-side encryption (SSE) AWS Key Management Service customer master key (CMK) encryption. The check passes if the KmsKeyId is defined.1

Attributes

Item Id: CloudTrail.2
Section: CloudTrail
Service: CloudTrail
Severity: medium
Section Description: This section contains recommendations for configuring CloudTrail resources.

CloudTrail.3This control checks whether an AWS CloudTrail trail is enabled in your AWS account. The control fails if your account doesn't have at least one CloudTrail trail enabled.0

Attributes

Item Id: CloudTrail.3
Section: CloudTrail
Service: CloudTrail
Severity: high
Section Description: This section contains recommendations for configuring CloudTrail resources.

CloudTrail.4This control checks whether log file integrity validation is enabled on a CloudTrail trail. CloudTrail log file validation creates a digitally signed digest file that contains a hash of each log that CloudTrail writes to Amazon S3. You can use these digest files to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log.1

Attributes

Item Id: CloudTrail.4
Section: CloudTrail
Service: CloudTrail
Severity: low
Section Description: This section contains recommendations for configuring CloudTrail resources.

CloudTrail.5This control checks whether CloudTrail trails are configured to send logs to CloudWatch Logs. The control fails if the CloudWatchLogsLogGroupArn property of the trail is empty.1

Attributes

Item Id: CloudTrail.5
Section: CloudTrail
Service: CloudTrail
Severity: low
Section Description: This section contains recommendations for configuring CloudTrail resources.

CloudTrail.6CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. CIS recommends that the S3 bucket policy, or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs. Allowing public access to CloudTrail log content might aid an adversary in identifying weaknesses in the affected account's use or configuration.1

Attributes

Item Id: CloudTrail.6
Section: CloudTrail
Service: CloudTrail
Severity: critical
Section Description: This section contains recommendations for configuring CloudTrail resources.

CloudTrail.7S3 bucket access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed.1

Attributes

Item Id: CloudTrail.7
Section: CloudTrail
Service: CloudTrail
Severity: low
Section Description: This section contains recommendations for configuring CloudTrail resources.

CodeBuild62

CodeBuild.1Authentication credentials should never be stored or transmitted in clear text or appear in the repository URL. Instead of personal access tokens or user name and password, you should use OAuth to grant authorization for accessing GitHub or Bitbucket repositories. Using personal access tokens or a user name and password could expose your credentials to unintended data exposure and unauthorized access.1

Attributes

Item Id: CodeBuild.1
Section: CodeBuild
Service: CodeBuild
Severity: critical
Section Description: This section contains recommendations for configuring CodeBuild resources.

CodeBuild.2This control checks whether the project contains the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Authentication credentials AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY should never be stored in clear text, as this could lead to unintended data exposure and unauthorized access.1

Attributes

Item Id: CodeBuild.2
Section: CodeBuild
Service: CodeBuild
Severity: critical
Section Description: This section contains recommendations for configuring CodeBuild resources.

CodeBuild.3This control checks if Amazon S3 logs for an AWS CodeBuild project are encrypted. The control fails if encryption is deactivated for S3 logs for a CodeBuild project.0

Attributes

Item Id: CodeBuild.3
Section: CodeBuild
Service: CodeBuild
Severity: low
Section Description: This section contains recommendations for configuring CodeBuild resources.

CodeBuild.4This control checks whether a CodeBuild project environment has at least one log option, either to S3 or CloudWatch logs enabled. This control fails if a CodeBuild project environment does not have at least one log option enabled.0

Attributes

Item Id: CodeBuild.4
Section: CodeBuild
Service: CodeBuild
Severity: medium
Section Description: This section contains recommendations for configuring CodeBuild resources.

CodeBuild.5This control checks if an AWS CodeBuild project environment has privileged mode enabled. This control fails when an AWS CodeBuild project environment has privileged mode enabled.0

Attributes

Item Id: CodeBuild.5
Section: CodeBuild
Service: CodeBuild
Severity: high
Section Description: This section contains recommendations for configuring CodeBuild resources.

CodeBuild.7This control checks whether the test results of an AWS CodeBuild report group that are exported to an Amazon Simple Storage Service (Amazon S3) bucket are encrypted at rest. The control fails if the report group export isn't encrypted at rest.0

Attributes

Item Id: CodeBuild.7
Section: CodeBuild
Service: CodeBuild
Severity: medium
Section Description: This section contains recommendations for configuring CodeBuild resources.

Cognito11

Cognito.1This control checks whether an Amazon Cognito user pool has threat protection activated with the enforcement mode set to full function. The control fails if the user pool has threat protection deactivated or if the enforcement mode isn't set to full function. Unless you provide custom parameter values, Security Hub uses the default value of ENFORCED for enforcement mode set to full function.1

Attributes

Item Id: Cognito.1
Section: Cognito
Service: Cognito
Severity: medium
Section Description: This section contains recommendations for configuring Cognito resources.

Config11

Config.1This control checks whether AWS Config is enabled in the account for the local Region and is recording all resources. The AWS Config service performs configuration management of supported AWS resources in your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items, and any configuration changes between resources.1

Attributes

Item Id: Config.1
Section: Config
Service: Config
Severity: medium
Section Description: This section contains recommendations for configuring Config resources.

DMS53

DMS.1This control checks whether AWS DMS replication instances are public. To do this, it examines the value of the PubliclyAccessible field. A private replication instance has a private IP address that you cannot access outside of the replication network. A replication instance should have a private IP address when the source and target databases are in the same network. The network must also be connected to the replication instance's VPC using a VPN, AWS Direct Connect, or VPC peering. To learn more about public and private replication instances, see Public and private replication instances in the AWS Database Migration Service User Guide.1

Attributes

Item Id: DMS.1
Section: DMS
Service: DMS
Severity: critical
Section Description: This section contains recommendations for configuring DMS resources.

DMS.6This control checks if automatic minor version upgrade is enabled for an AWS DMS replication instance. The control fails if automatic minor version upgrade isn't enabled for a DMS replication instance.1

Attributes

Item Id: DMS.6
Section: DMS
Service: DMS
Severity: medium
Section Description: This section contains recommendations for configuring DMS resources.

DMS.7This control checks whether logging is enabled with the minimum severity level of LOGGER_SEVERITY_DEFAULT for DMS replication tasks TARGET_APPLY and TARGET_LOAD. The control fails if logging isn't enabled for these tasks or if the minimum severity level is less than LOGGER_SEVERITY_DEFAULT.0

Attributes

Item Id: DMS.7
Section: DMS
Service: DMS
Severity: medium
Section Description: This section contains recommendations for configuring DMS resources.

DMS.8This control checks whether logging is enabled with the minimum severity level of LOGGER_SEVERITY_DEFAULT for DMS replication tasks SOURCE_CAPTURE and SOURCE_UNLOAD. The control fails if logging isn't enabled for these tasks or if the minimum severity level is less than LOGGER_SEVERITY_DEFAULT.0

Attributes

Item Id: DMS.8
Section: DMS
Service: DMS
Severity: medium
Section Description: This section contains recommendations for configuring DMS resources.

DMS.9This control checks whether an AWS DMS endpoint uses an SSL connection. The control fails if the endpoint doesn't use SSL.1

Attributes

Item Id: DMS.9
Section: DMS
Service: DMS
Severity: medium
Section Description: This section contains recommendations for configuring DMS resources.

DocumentDB55

DocumentDB.1This control checks whether an Amazon DocumentDB cluster is encrypted at rest. The control fails if an Amazon DocumentDB cluster isn't encrypted at rest.1

Attributes

Item Id: DocumentDB.1
Section: DocumentDB
Service: DocumentDB
Severity: medium
Section Description: This section contains recommendations for configuring DocumentDB resources.

DocumentDB.2This control checks whether an Amazon DocumentDB cluster has a backup retention period greater than or equal to 7 days. The control fails if the backup retention period is less than 7 days.1

Attributes

Item Id: DocumentDB.2
Section: DocumentDB
Service: DocumentDB
Severity: medium
Section Description: This section contains recommendations for configuring DocumentDB resources.

DocumentDB.3This control checks whether an Amazon DocumentDB manual cluster snapshot is public. The control fails if the manual cluster snapshot is public.1

Attributes

Item Id: DocumentDB.3
Section: DocumentDB
Service: DocumentDB
Severity: critical
Section Description: This section contains recommendations for configuring DocumentDB resources.

DocumentDB.4This control checks whether an Amazon DocumentDB cluster publishes audit logs to Amazon CloudWatch Logs. The control fails if the cluster doesn't publish audit logs to CloudWatch Logs.1

Attributes

Item Id: DocumentDB.4
Section: DocumentDB
Service: DocumentDB
Severity: medium
Section Description: This section contains recommendations for configuring DocumentDB resources.

DocumentDB.5This control checks whether an Amazon DocumentDB cluster has deletion protection enabled. The control fails if the cluster doesn't have deletion protection enabled.1

Attributes

Item Id: DocumentDB.5
Section: DocumentDB
Service: DocumentDB
Severity: medium
Section Description: This section contains recommendations for configuring DocumentDB resources.

DynamoDB65

DynamoDB.1This control checks whether an Amazon DynamoDB table can scale its read and write capacity as needed. This control passes if the table uses either on-demand capacity mode or provisioned mode with auto scaling configured. Scaling capacity with demand avoids throttling exceptions, which helps to maintain availability of your applications.0

Attributes

Item Id: DynamoDB.1
Section: DynamoDB
Service: DynamoDB
Severity: medium
Section Description: This section contains recommendations for configuring DynamoDB resources.

DynamoDB.2This control checks whether point-in-time recovery (PITR) is enabled for an Amazon DynamoDB table. Backups help you to recover more quickly from a security incident. They also strengthen the resilience of your systems. DynamoDB point-in-time recovery automates backups for DynamoDB tables. It reduces the time to recover from accidental delete or write operations. DynamoDB tables that have PITR enabled can be restored to any point in time in the last 35 days.1

Attributes

Item Id: DynamoDB.2
Section: DynamoDB
Service: DynamoDB
Severity: medium
Section Description: This section contains recommendations for configuring DynamoDB resources.

DynamoDB.3This control checks whether a DAX cluster is encrypted at rest. Encrypting data at rest reduces the risk of data stored on disk being accessed by a user not authenticated to AWS. The encryption adds another set of access controls to limit the ability of unauthorized users to access to the data. For example, API permissions are required to decrypt the data before it can be read.1

Attributes

Item Id: DynamoDB.3
Section: DynamoDB
Service: DynamoDB
Severity: medium
Section Description: This section contains recommendations for configuring DynamoDB resources.

DynamoDB.4This control evaluates whether an Amazon DynamoDB table in ACTIVE state is covered by a backup plan. The control fails if the DynamoDB table isn't covered by a backup plan. If you set the backupVaultLockCheck parameter equal to true, the control passes only if the DynamoDB table is backed up in an AWS Backup locked vault.1

Attributes

Item Id: DynamoDB.4
Section: DynamoDB
Service: DynamoDB
Severity: medium
Section Description: This section contains recommendations for configuring DynamoDB resources.

DynamoDB.6This control checks whether an Amazon DynamoDB table has deletion protection enabled. The control fails if a DynamoDB table doesn't have deletion protection enabled.1

Attributes

Item Id: DynamoDB.6
Section: DynamoDB
Service: DynamoDB
Severity: medium
Section Description: This section contains recommendations for configuring DynamoDB resources.

DynamoDB.7This control checks whether an Amazon DynamoDB Accelerator (DAX) cluster is encrypted in transit, with the endpoint encryption type set to TLS. The control fails if the DAX cluster isn't encrypted in transit.1

Attributes

Item Id: DynamoDB.7
Section: DynamoDB
Service: DynamoDB
Severity: medium
Section Description: This section contains recommendations for configuring DynamoDB resources.

EC22525

EC2.1Amazon EBS snapshots should not be public, determined by the ability to be restorable by anyone. EBS snapshots are used to back up the data on your EBS volumes to Amazon S3 at a specific point in time. You can use the snapshots to restore previous states of EBS volumes. It is rarely acceptable to share a snapshot with the public. Typically the decision to share a snapshot publicly was made in error or without a complete understanding of the implications. This check helps ensure that all such sharing was fully planned and intentional.1

Attributes

Item Id: EC2.1
Section: EC2
Service: EC2
Severity: critical
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.2This control checks that the default security group of a VPC does not allow inbound or outbound traffic. The rules for the default security group allow all outbound and inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.1

Attributes

Item Id: EC2.2
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.3This control checks whether the EBS volumes that are in an attached state are encrypted. To pass this check, EBS volumes must be in use and encrypted. If the EBS volume is not attached, then it is not subject to this check.1

Attributes

Item Id: EC2.3
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.4This control checks whether any EC2 instances have been stopped for more than the allowed number of days. An EC2 instance fails this check if it is stopped for longer than the maximum allowed time period, which by default is 30 days.1

Attributes

Item Id: EC2.4
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.6This control checks whether Amazon VPC Flow Logs are found and enabled for VPCs. The traffic type is set to Reject. With the VPC Flow Logs feature, you can capture information about the IP address traffic going to and from network interfaces in your VPC. After you create a flow log, you can view and retrieve its data in CloudWatch Logs. To reduce cost, you can also send your flow logs to Amazon S3.1

Attributes

Item Id: EC2.6
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.7This control checks whether account-level encryption is enabled by default for Amazon Elastic Block Store(Amazon EBS). The control fails if the account level encryption is not enabled.1

Attributes

Item Id: EC2.7
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.8This control checks whether your EC2 instance metadata version is configured with Instance Metadata Service Version 2 (IMDSv2). The control passes if HttpTokens is set to required for IMDSv2. The control fails if HttpTokens is set to optional.1

Attributes

Item Id: EC2.8
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.9This control checks whether EC2 instances have a public IP address. The control fails if the publicIp field is present in the EC2 instance configuration item. This control applies to IPv4 addresses only.1

Attributes

Item Id: EC2.9
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.10This control checks whether a service endpoint for Amazon EC2 is created for each VPC. The control fails if a VPC does not have a VPC endpoint created for the Amazon EC2 service.1

Attributes

Item Id: EC2.10
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.12This control checks whether Elastic IP (EIP) addresses that are allocated to a VPC are attached to EC2 instances or in-use elastic network interfaces (ENIs).1

Attributes

Item Id: EC2.12
Section: EC2
Service: EC2
Severity: low
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.13This control checks whether an Amazon EC2 security group allows ingress from 0.0.0.0/0 or ::/0 to port 22. The control fails if the security group allows ingress from 0.0.0.0/0 or ::/0 to port 22.1

Attributes

Item Id: EC2.13
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.14This control checks whether an Amazon EC2 security group allows ingress from 0.0.0.0/0 or ::/0 to port 3389. The control fails if the security group allows ingress from 0.0.0.0/0 or ::/0 to port 3389.1

Attributes

Item Id: EC2.14
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.15This control checks whether the assignment of public IPs in Amazon Virtual Private Cloud (Amazon VPC) subnets have MapPublicIpOnLaunch set to FALSE. The control passes if the flag is set to FALSE.1

Attributes

Item Id: EC2.15
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.16This control checks whether there are any unused network access control lists (ACLs). The control checks the item configuration of the resource AWS::EC2::NetworkAcl and determines the relationships of the network ACL.1

Attributes

Item Id: EC2.16
Section: EC2
Service: EC2
Severity: low
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.17This control checks whether an EC2 instance uses multiple Elastic Network Interfaces (ENIs) or Elastic Fabric Adapters (EFAs). This control passes if a single network adapter is used. The control includes an optional parameter list to identify the allowed ENIs.1

Attributes

Item Id: EC2.17
Section: EC2
Service: EC2
Severity: low
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.18This control checks whether the security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443.0

Attributes

Item Id: EC2.18
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.19This control checks whether unrestricted incoming traffic for the security groups is accessible to the specified ports that have the highest risk. This control passes when none of the rules in a security group allow ingress traffic from 0.0.0.0/0 for those ports.1

Attributes

Item Id: EC2.19
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.20This control checks that both VPN tunnels provided by AWS Site-to-Site VPN are in UP status. The control fails if one or both tunnels are in DOWN status.1

Attributes

Item Id: EC2.20
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.21This control checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted. The rule fails if a NACL inbound entry allows a source CIDR block of '0.0.0.0/0' or '::/0' for ports 22 or 3389.2

Attributes

Item Id: EC2.21
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.22This control checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted. The rule fails if a NACL inbound entry allows a source CIDR block of '0.0.0.0/0' or '::/0' for ports 22 or 3389.1

Attributes

Item Id: EC2.22
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.23This control checks if EC2 Transit Gateways are automatically accepting shared VPC attachments. This control fails for a Transit Gateway that automatically accepts shared VPC attachment requests.1

Attributes

Item Id: EC2.23
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.24This control checks whether the virtualization type of an EC2 instance is paravirtual. The control fails if the virtualizationType of the EC2 instance is set to paravirtual.1

Attributes

Item Id: EC2.24
Section: EC2
Service: EC2
Severity: medium
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.25This control checks if Amazon EC2 launch templates are configured to assign public IP addresses to network interfaces upon launch. The control fails if an EC2 launch template is configured to assign a public IP address to network interfaces or if there is at least one network interface that has a public IP address.1

Attributes

Item Id: EC2.25
Section: EC2
Service: EC2
Severity: high
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.28This control evaluates if an Amazon EBS volume in in-use state is covered by a backup plan. The control fails if an EBS volume isn't covered by a backup plan. If you set the backupVaultLockCheck parameter equal to true, the control passes only if the EBS volume is backed up in an AWS Backup locked vault.1

Attributes

Item Id: EC2.28
Section: EC2
Service: EC2
Severity: low
Section Description: This section contains recommendations for configuring EC2 resources.

EC2.51This control checks whether an AWS Client VPN endpoint has client connection logging enabled. The control fails if the endpoint doesn't have client connection logging enabled.1

Attributes

Item Id: EC2.51
Section: EC2
Service: EC2
Severity: low
Section Description: This section contains recommendations for configuring EC2 resources.

ECR33

ECR.1This control checks whether a private ECR repository has image scanning configured. This control fails if a private ECR repository doesn't have image scanning configured.1

Attributes

Query: ecr_repository_image_scan_on_push_enabled
Item Id: ECR.1
Section: ECR
Service: ECR
Severity: high
Section Description: This section contains recommendations for configuring ECR resources.

ECR.2This control checks whether a private ECR repository has tag immutability enabled. This control fails if a private ECR repository has tag immutability disabled. This rule passes if tag immutability is enabled and has the value IMMUTABLE.1

Attributes

Item Id: ECR.2
Section: ECR
Service: ECR
Severity: medium
Section Description: This section contains recommendations for configuring ECR resources.

ECR.3This control checks whether an Amazon ECR repository has at least one lifecycle policy configured. This control fails if an ECR repository does not have any lifecycle policies configured.1

Attributes

Item Id: ECR.3
Section: ECR
Service: ECR
Severity: medium
Section Description: This section contains recommendations for configuring ECR resources.

ECS97

ECS.1This control checks whether an Amazon ECS task definition that has host networking mode also has 'privileged' or 'user' container definitions. The control fails for task definitions that have host network mode and container definitions where privileged=false or is empty and user=root or is empty.1

Attributes

Item Id: ECS.1
Section: ECS
Service: ECS
Severity: medium
Section Description: This section contains recommendations for configuring ECS resources.

ECS.2This control checks whether Amazon ECS services are configured to automatically assign public IP addresses. This control fails if AssignPublicIP is ENABLED. This control passes if AssignPublicIP is DISABLED.1

Attributes

Item Id: ECS.2
Section: ECS
Service: ECS
Severity: high
Section Description: This section contains recommendations for configuring ECS resources.

ECS.3This control checks if Amazon ECS task definitions are configured to share a hostâs process namespace with its containers. The control fails if the task definition shares the host's process namespace with the containers running on it.1

Attributes

Item Id: ECS.3
Section: ECS
Service: ECS
Severity: high
Section Description: This section contains recommendations for configuring ECS resources.

ECS.4This control checks if the privileged parameter in the container definition of Amazon ECS Task Definitions is set to true. The control fails if this parameter is equal to true.1

Attributes

Item Id: ECS.4
Section: ECS
Service: ECS
Severity: high
Section Description: This section contains recommendations for configuring ECS resources.

ECS.5This control checks if ECS containers are limited to read-only access to mounted root filesystems. This control fails if the ReadonlyRootFilesystem parameter in the container definition of ECS task definitions is set to false.1

Attributes

Item Id: ECS.5
Section: ECS
Service: ECS
Severity: high
Section Description: This section contains recommendations for configuring ECS resources.

ECS.8This control checks if the key value of any variables in the environment parameter of container definitions includes AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ECS_ENGINE_AUTH_DATA. This control fails if a single environment variable in any container definition equals AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ECS_ENGINE_AUTH_DATA. This control does not cover environmental variables passed in from other locations such as Amazon S3.1

Attributes

Item Id: ECS.8
Section: ECS
Service: ECS
Severity: high
Section Description: This section contains recommendations for configuring ECS resources.

ECS.9This control checks if the latest active Amazon ECS task definition has a logging configuration specified. The control fails if the task definition doesn't have the logConfiguration property defined or if the value for logDriver is null in at least one container definition.1

Attributes

Item Id: ECS.9
Section: ECS
Service: ECS
Severity: high
Section Description: This section contains recommendations for configuring ECS resources.

ECS.10This control checks if Amazon ECS Fargate services are running the latest Fargate platform version. This control fails if the platform version is not the latest.0

Attributes

Item Id: ECS.10
Section: ECS
Service: ECS
Severity: medium
Section Description: This section contains recommendations for configuring ECS resources.

ECS.12This control checks if ECS clusters use Container Insights. This control fails if Container Insights are not set up for a cluster.0

Attributes

Item Id: ECS.12
Section: ECS
Service: ECS
Severity: medium
Section Description: This section contains recommendations for configuring ECS resources.

EFS42

EFS.1This control checks whether Amazon Elastic File System is configured to encrypt the file data using AWS KMS.1

Attributes

Item Id: EFS.1
Section: EFS
Service: EFS
Severity: medium
Section Description: This section contains recommendations for configuring EFS resources.

EFS.2This control checks whether Amazon Elastic File System (Amazon EFS) file systems are added to the backup plans in AWS Backup. The control fails if Amazon EFS file systems are not included in the backup plans.1

Attributes

Item Id: EFS.2
Section: EFS
Service: EFS
Severity: medium
Section Description: This section contains recommendations for configuring EFS resources.

EFS.3This control checks if Amazon EFS access points are configured to enforce a root directory. The control fails if the value of Path is set to / (the default root directory of the file system).0

Attributes

Item Id: EFS.3
Section: EFS
Service: EFS
Severity: medium
Section Description: This section contains recommendations for configuring EFS resources.

EFS.4This control checks whether Amazon EFS access points are configured to enforce a user identity. This control fails if a POSIX user identity is not defined while creating the EFS access point.0

Attributes

Item Id: EFS.4
Section: EFS
Service: EFS
Severity: medium
Section Description: This section contains recommendations for configuring EFS resources.

EKS44

EKS.1This control checks whether an Amazon EKS cluster endpoint is publicly accessible. The control fails if an EKS cluster has an endpoint that is publicly accessible.1

Attributes

Item Id: EKS.1
Section: EKS
Service: EKS
Severity: high
Section Description: This section contains recommendations for configuring EKS resources.

EKS.2This control checks whether an Amazon EKS cluster is running on a supported Kubernetes version. The control fails if the EKS cluster is running on an unsupported version. If your application doesn't require a specific version of Kubernetes, we recommend that you use the latest available Kubernetes version that's supported by EKS for your clusters.1

Attributes

Item Id: EKS.2
Section: EKS
Service: EKS
Severity: high
Section Description: This section contains recommendations for configuring EKS resources.

EKS.3This control checks whether an Amazon EKS cluster uses encrypted Kubernetes secrets. The control fails if the cluster's Kubernetes secrets aren't encrypted.1

Attributes

Item Id: EKS.3
Section: EKS
Service: EKS
Severity: medium
Section Description: This section contains recommendations for configuring EKS resources.

EKS.8This control checks whether an Amazon EKS cluster has audit logging enabled. The control fails if audit logging isn't enabled for the cluster.1

Attributes

Item Id: EKS.8
Section: EKS
Service: EKS
Severity: medium
Section Description: This section contains recommendations for configuring EKS resources.

ELB1311

ELB.1This control checks whether HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers. The control fails if any of the HTTP listeners of Application Load Balancers do not have HTTP to HTTPS redirection configured.1

Attributes

Item Id: ELB.1
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.2This control checks whether the Classic Load Balancer uses HTTPS/SSL certificates provided by AWS Certificate Manager (ACM). The control fails if the Classic Load Balancer configured with HTTPS/SSL listener does not use a certificate provided by ACM.0

Attributes

Item Id: ELB.2
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.3This control checks whether your Classic Load Balancer listeners are configured with HTTPS or TLS protocol for front-end (client to load balancer) connections. The control is applicable if a Classic Load Balancer has listeners. If your Classic Load Balancer does not have a listener configured, then the control does not report any findings. The control passes if the Classic Load Balancer listeners are configured with TLS or HTTPS for front-end connections. The control fails if the listener is not configured with TLS or HTTPS for front-end connections.1

Attributes

Item Id: ELB.3
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.4This control evaluates AWS Application Load Balancers (ALB) to ensure they are configured to drop invalid HTTP headers. The control fails if the value of routing.http.drop_invalid_header_fields.enabled is set to false. By default, ALBs are not configured to drop invalid HTTP header values. Removing these header values prevents HTTP desync attacks.1

Attributes

Item Id: ELB.4
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.5This control checks whether the Application Load Balancer and the Classic Load Balancer have logging enabled. The control fails if access_logs.s3.enabled is false.2

Attributes

Item Id: ELB.5
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.6This control checks whether an Application Load Balancer has deletion protection enabled. The control fails if deletion protection is not configured. Enable deletion protection to protect your Application Load Balancer from deletion.1

Attributes

Item Id: ELB.6
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.7This control checks whether Classic Load Balancers have connection draining enabled.0

Attributes

Query: ec2_classic_lb_connection_draining_enabled
Item Id: ELB.7
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.9This control checks if cross-zone load balancing is enabled for the Classic Load Balancers (CLBs). This control fails if cross-zone load balancing is not enabled for a CLB.1

Attributes

Item Id: ELB.9
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.10This control checks whether a Classic Load Balancer has been configured to span multiple Availability Zones. The control fails if the Classic Load Balancer does not span multiple Availability Zones.1

Attributes

Item Id: ELB.10
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.12This control checks whether an Application Load Balancer is configured with defensive or strictest desync mitigation mode. The control fails if an Application Load Balancer is not configured with defensive or strictest desync mitigation mode.1

Attributes

Item Id: ELB.12
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.13This control checks whether an Elastic Load Balancer V2 (Application, Network, or Gateway Load Balancer) has registered instances from multiple Availability Zones. The control fails if an Elastic Load Balancer V2 has instances registered in fewer than two Availability Zones.1

Attributes

Item Id: ELB.13
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.14This control checks whether a Classic Load Balancer is configured with defensive or strictest desync mitigation mode. This control will fail if the Classic Load Balancer is not configured with defensive or strictest desync mitigation mode.0

Attributes

Item Id: ELB.14
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

ELB.16This control checks whether an Application Load Balancer is associated with an AWS WAF Classic or AWS WAF web access control list (web ACL). The control fails if the Enabled field for the AWS WAF configuration is set to false.1

Attributes

Item Id: ELB.16
Section: ELB
Service: ELB
Severity: medium
Section Description: This section contains recommendations for configuring ELB resources.

EMR22

EMR.1This control checks whether master nodes on Amazon EMR clusters have public IP addresses. The control fails if the master node has public IP addresses that are associated with any of its instances. Public IP addresses are designated in the PublicIp field of the NetworkInterfaces configuration for the instance. This control only checks Amazon EMR clusters that are in a RUNNING or WAITING state.1

Attributes

Item Id: EMR.1
Section: EMR
Service: EMR
Severity: high
Section Description: This section contains recommendations for configuring EMR resources.

EMR.2This control checks whether your account is configured with Amazon EMR block public access. The control fails if the block public access setting isn't enabled or if any port other than port 22 is allowed.1

Attributes

Query: emr_account_public_access_blocked
Item Id: EMR.2
Section: EMR
Service: EMR
Severity: critical
Section Description: This section contains recommendations for configuring EMR resources.

ES85

ES.1This control checks whether Amazon Elasticsearch Service (Amazon ES) domains have encryption at rest configuration enabled. The check fails if encryption at rest is not enabled.1

Attributes

Item Id: ES.1
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.2This control checks whether Amazon Elasticsearch Service domains are in a VPC. It does not evaluate the VPC subnet routing configuration to determine public access. You should ensure that Amazon ES domains are not attached to public subnets.1

Attributes

Item Id: ES.2
Section: ES
Service: ES
Severity: critical
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.3This control checks whether Amazon ES domains have node-to-node encryption enabled.1

Attributes

Item Id: ES.3
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.4This control checks whether Elasticsearch domains are configured to send error logs to CloudWatch Logs.1

Attributes

Item Id: ES.4
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.5This control checks whether Elasticsearch domains have audit logging enabled. This control fails if an Elasticsearch domain does not have audit logging enabled.1

Attributes

Item Id: ES.5
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.6This control checks whether Elasticsearch domains are configured with at least three data nodes and zoneAwarenessEnabled is true.0

Attributes

Item Id: ES.6
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.7This control checks whether Elasticsearch domains are configured with at least three dedicated master nodes. This control fails if the domain does not use dedicated master nodes. This control passes if Elasticsearch domains have five dedicated master nodes. However, using more than three master nodes might be unnecessary to mitigate the availability risk, and will result in additional cost.0

Attributes

Item Id: ES.7
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ES.8This controls checks whether an Elasticsearch domain endpoint is configured to use the latest TLS security policy. The control fails if the Elasticsearch domain endpoint isn't configured to use the latest supported policy or if HTTPs isn't enabled. The current latest supported TLS security policy is Policy-Min-TLS-1-2-PFS-2023-10.0

Attributes

Item Id: ES.8
Section: ES
Service: ES
Severity: medium
Section Description: This section contains recommendations for configuring Elasticsearch resources.

ElastiCache73

ElastiCache.1This control evaluates if Amazon ElastiCache for Redis clusters have automatic backup scheduled. The control fails if the SnapshotRetentionLimit for the Redis cluster is less than 1.1

Attributes

Item Id: ElastiCache.1
Section: ElastiCache
Service: ElastiCache
Severity: high
Section Description: This section contains recommendations for configuring ElastiCache resources.

ElastiCache.2This control evaluates whether ElastiCache for Redis automatically applies minor version upgrades to cache clusters. This control fails if ElastiCache for Redis cache clusters do not have minor version upgrades automatically applied.1

Attributes

Item Id: ElastiCache.2
Section: ElastiCache
Service: ElastiCache
Severity: high
Section Description: This section contains recommendations for configuring ElastiCache resources.

ElastiCache.3This control checks if ElastiCache for Redis replication groups have automatic failover enabled. This control fails if automatic failover isn't enabled for a Redis replication group.0

Attributes

Item Id: ElastiCache.3
Section: ElastiCache
Service: ElastiCache
Severity: medium
Section Description: This section contains recommendations for configuring ElastiCache resources.

ElastiCache.4This control checks if ElastiCache for Redis replication groups are encrypted at rest. This control fails if an ElastiCache for Redis replication group isn't encrypted at rest.0

Attributes

Item Id: ElastiCache.4
Section: ElastiCache
Service: ElastiCache
Severity: medium
Section Description: This section contains recommendations for configuring ElastiCache resources.

ElastiCache.5This control checks if ElastiCache for Redis replication groups are encrypted in transit. This control fails if an ElastiCache for Redis replication group isn't encrypted in transit.0

Attributes

Item Id: ElastiCache.5
Section: ElastiCache
Service: ElastiCache
Severity: medium
Section Description: This section contains recommendations for configuring ElastiCache resources.

ElastiCache.6This control checks if ElastiCache for Redis replication groups have Redis AUTH enabled. The control fails for an ElastiCache for Redis replication group if the Redis version of its nodes is below 6.0 and AuthToken isn't in use.1

Attributes

Item Id: ElastiCache.6
Section: ElastiCache
Service: ElastiCache
Severity: medium
Section Description: This section contains recommendations for configuring ElastiCache resources.

ElastiCache.7This control checks if ElastiCache clusters are configured with a custom subnet group. The control fails for an ElastiCache cluster if CacheSubnetGroupName has the value default.0

Attributes

Item Id: ElastiCache.7
Section: ElastiCache
Service: ElastiCache
Severity: high
Section Description: This section contains recommendations for configuring ElastiCache resources.

Elastic Beanstalk20

ElasticBeanstalk.1This control checks whether enhanced health reporting is enabled for your AWS Elastic Beanstalk environments.Elastic Beanstalk enhanced health reporting enables a more rapid response to changes in the health of the underlying infrastructure. These changes could result in a lack of availability of the application.0

Attributes

Item Id: ElasticBeanstalk.1
Section: Elastic Beanstalk
Service: Elastic Beanstalk
Severity: low
Section Description: This section contains recommendations for configuring Elastic Beanstalk resources.

ElasticBeanstalk.3This control checks whether an Elastic Beanstalk environment is configured to send logs to CloudWatch Logs. The control fails if an Elastic Beanstalk environment isn't configured to send logs to CloudWatch Logs. Optionally, you can provide a custom value for the RetentionInDays parameter if you want the control to pass only if logs are retained for the specified number of days before expiration.0

Attributes

Item Id: ElasticBeanstalk.3
Section: Elastic Beanstalk
Service: Elastic Beanstalk
Severity: high
Section Description: This section contains recommendations for configuring Elastic Beanstalk resources.

EventBridge10

EventBridge.3This control checks if an Amazon EventBridge custom event bus has a resource-based policy attached. This control fails if the custom event bus doesn't have a resource-based policy.0

Attributes

Item Id: EventBridge.3
Section: EventBridge
Service: EventBridge
Severity: low
Section Description: This section contains recommendations for configuring EventBridge resources.

FSx10

FSx.1This control checks if an Amazon FSx for OpenZFS file system is configured to copy tags to backups and volumes. The control fails if the OpenZFS file system isn't configured to copy tags to backups and volumes.0

Attributes

Item Id: FSx.1
Section: FSx
Service: FSx
Severity: low
Section Description: This section contains recommendations for configuring FSx resources.

GuardDuty33

GuardDuty.1This control checks whether Amazon GuardDuty is enabled in your GuardDuty account and Region. It is highly recommended that you enable GuardDuty in all supported AWS Regions. Doing so allows GuardDuty to generate findings about unauthorized or unusual activity, even in Regions that you do not actively use. This also allows GuardDuty to monitor CloudTrail events for global AWS services such as IAM.1

Attributes

Item Id: GuardDuty.1
Section: GuardDuty
Service: GuardDuty
Severity: high
Section Description: This section contains recommendations for configuring GuardDuty resources.

GuardDuty.9This control checks whether GuardDuty RDS Protection is enabled. For a standalone account, the control fails if GuardDuty RDS Protection is disabled in the account. In a multi-account environment, the control fails if the delegated GuardDuty administrator account and all member accounts don't have RDS Protection enabled.1

Attributes

Item Id: GuardDuty.9
Section: GuardDuty
Service: GuardDuty
Severity: high
Section Description: This section contains recommendations for configuring GuardDuty resources.

GuardDuty.10This control checks whether GuardDuty S3 Protection is enabled. For a standalone account, the control fails if GuardDuty S3 Protection is disabled in the account. In a multi-account environment, the control fails if the delegated GuardDuty administrator account and all member accounts don't have S3 Protection enabled.1

Attributes

Item Id: GuardDuty.10
Section: GuardDuty
Service: GuardDuty
Severity: high
Section Description: This section contains recommendations for configuring GuardDuty resources.

IAM1429

IAM.1This control checks whether the default version of IAM policies (also known as customer managed policies) has administrator access that includes a statement with 'Effect': 'Allow' with 'Action': '*' over 'Resource': '*'. The control only checks the customer managed policies that you create. It does not check inline and AWS managed policies.3

Attributes

Item Id: IAM.1
Section: IAM
Service: IAM
Severity: high
Section Description: This section contains recommendations for configuring IAM resources.

IAM.2This control checks that none of your IAM users have policies attached. Instead, IAM users must inherit permissions from IAM groups or roles.0

Attributes

Item Id: IAM.2
Section: IAM
Service: IAM
Severity: low
Section Description: This section contains recommendations for configuring IAM resources.

IAM.3This control checks whether the active access keys are rotated within 90 days.1

Attributes

Item Id: IAM.3
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.4This control checks whether the root user access key is present. The root account is the most privileged user in an AWS account. AWS access keys provide programmatic access to a given account.1

Attributes

Item Id: IAM.4
Section: IAM
Service: IAM
Severity: critical
Section Description: This section contains recommendations for configuring IAM resources.

IAM.5This control checks whether AWS multi-factor authentication (MFA) is enabled for all IAM users that use a console password.1

Attributes

Item Id: IAM.5
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.6This control checks whether your AWS account is enabled to use a hardware multi-factor authentication (MFA) device to sign in with root user credentials.1

Attributes

Item Id: IAM.6
Section: IAM
Service: IAM
Severity: critical
Section Description: This section contains recommendations for configuring IAM resources.

IAM.7This control checks whether the account password policy for IAM users uses the recommended configurations.7

Attributes

Item Id: IAM.7
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.8This control checks whether your IAM users have passwords or active access keys that have not been used for 90 days.2

Attributes

Item Id: IAM.8
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.9The root user has complete access to all the services and resources in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to the AWS Management Console, they're prompted for their user name and password and for an authentication code from their AWS MFA device.1

Attributes

Item Id: IAM.9
Section: IAM
Service: IAM
Severity: critical
Section Description: This section contains recommendations for configuring IAM resources.

IAM.10This control checks whether the account password policy for IAM users uses the following minimum PCI DSS configurations.RequireUppercaseCharacters â Require at least one uppercase character in password. (Default = true)RequireLowercaseCharacters â Require at least one lowercase character in password. (Default = true)RequireNumbers â Require at least one number in password. (Default = true)MinimumPasswordLength â Password minimum length. (Default = 7 or longer)PasswordReusePrevention â Number of passwords before allowing reuse. (Default = 4)MaxPasswordAge â Number of days before password expiration. (Default = 90).7

Attributes

Item Id: IAM.10
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.19This control checks whether the IAM users have multi-factor authentication (MFA) enabled.1

Attributes

Item Id: IAM.19
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.21This control checks whether the IAM identity-based policies that you create have Allow statements that use the * wildcard to grant permissions for all actions on any service. The control fails if any policy statement includes 'Effect': 'Allow' with 'Action': 'Service:*'.0

Attributes

Item Id: IAM.21
Section: IAM
Service: IAM
Severity: low
Section Description: This section contains recommendations for configuring IAM resources.

IAM.22This control checks whether your IAM users have passwords or active access keys that have not been used for 45 days or more. To do so, it checks whether the maxCredentialUsageAge parameter of the AWS Config rule is equal to 45 or more.2

Attributes

Item Id: IAM.22
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

IAM.26This controls checks whether an active SSL/TLS server certificate that is managed in IAM has expired. The control fails if the expired SSL/TLS server certificate isn't removed.2

Attributes

Item Id: IAM.26
Section: IAM
Service: IAM
Severity: medium
Section Description: This section contains recommendations for configuring IAM resources.

KMS53

KMS.1Checks whether the default version of IAM customer managed policies allow principals to use the AWS KMS decryption actions on all resources. This control uses Zelkova, an automated reasoning engine, to validate and warn you about policies that may grant broad access to your secrets across AWS accounts. This control fails if the kms:Decrypt or kms:ReEncryptFrom actions are allowed on all KMS keys. The control evaluates both attached and unattached customer managed policies. It does not check inline policies or AWS managed policies.0

Attributes

Item Id: KMS.1
Section: KMS
Service: KMS
Severity: medium
Section Description: This section contains recommendations for configuring KMS resources.

KMS.2Checks whether the inline policies that are embedded in your IAM identities (role, user, or group) allow the AWS KMS decryption actions on all KMS keys. This control uses Zelkova, an automated reasoning engine, to validate and warn you about policies that may grant broad access to your secrets across AWS accounts. This control fails if kms:Decrypt or kms:ReEncryptFrom actions are allowed on all KMS keys in an inline policy.0

Attributes

Item Id: KMS.2
Section: KMS
Service: KMS
Severity: medium
Section Description: This section contains recommendations for configuring KMS resources.

KMS.3This control checks whether AWS KMS customer managed keys (CMK) are scheduled for deletion. The control fails if a CMK is scheduled for deletion. CMKs cannot be recovered once deleted. Data encrypted under a KMS CMK is also permanently unrecoverable if the CMK is deleted. If meaningful data has been encrypted under a CMK scheduled for deletion,consider decrypting the data or re-encrypting the data under a new CMK unless you are intentionally performing a cryptographic erasure.1

Attributes

Item Id: KMS.3
Section: KMS
Service: KMS
Severity: critical
Section Description: This section contains recommendations for configuring KMS resources.

KMS.4TAWS KMS enables customers to rotate the backing key, which is key material stored in AWS KMS and is tied to the key ID of the KMS key. It's the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all previous backing keys so that decryption of encrypted data can take place transparently.1

Attributes

Item Id: KMS.4
Section: KMS
Service: KMS
Severity: medium
Section Description: This section contains recommendations for configuring KMS resources.

KMS.5This controls checks whether an AWS KMS key is publicly accessible. The control fails if the KMS key is publicly accessible.1

Attributes

Item Id: KMS.5
Section: KMS
Service: KMS
Severity: critical
Section Description: This section contains recommendations for configuring KMS resources.

Kinesis10

Kinesis.1This control checks if Kinesis Data Streams are encrypted at rest with server-side encryption. This control fails if a Kinesis stream is not encrypted at rest with server-side encryption.0

Attributes

Item Id: Kinesis.1
Section: Kinesis
Service: Kinesis
Severity: medium
Section Description: This section contains recommendations for configuring Kinesis resources.

Lambda44

Lambda.1This control checks whether the Lambda function resource-based policy prohibits public access outside of your account. The Lambda function should not be publicly accessible, as this may allow unintended access to your code stored in the function.1

Attributes

Item Id: Lambda.1
Section: Lambda
Service: Lambda
Severity: critical
Section Description: This section contains recommendations for configuring Lambda resources.

Lambda.2This control checks that the Lambda function settings for runtimes match the expected values set for the latest runtimes for each supported language. This control checks for the following runtimes: dotnet8, dotnet6, java21, java17, java11, java8.al2, nodejs22.x, nodejs20.x, nodejs18.x, python3.13, python3.12, python3.11, python3.10, python3.9, python3.8, ruby3.3, ruby3.21

Attributes

Item Id: Lambda.2
Section: Lambda
Service: Lambda
Severity: medium
Section Description: This section contains recommendations for configuring Lambda resources.

Lambda.3This control checks whether a Lambda function is deployed in a virtual private cloud (VPC). The control fails if the Lambda function isn't deployed in a VPC. Security Hub doesn't evaluate the VPC subnet routing configuration to determine public reachability. You might see failed findings for Lambda@Edge resources.1

Attributes

Item Id: Lambda.3
Section: Lambda
Service: Lambda
Severity: low
Section Description: This section contains recommendations for configuring Lambda resources.

Lambda.5This control checks if an AWS Lambda function that connects to a virtual private cloud (VPC) operates in at least the specified number of Availability Zone (AZs). The control fails if the function doesn't operate in at least the specified number of AZs.1

Attributes

Item Id: Lambda.5
Section: Lambda
Service: Lambda
Severity: medium
Section Description: This section contains recommendations for configuring Lambda resources.

MSK22

MSK.1This controls checks if an Amazon MSK cluster is encrypted in transit with HTTPS (TLS) among the broker nodes of the cluster. The control fails if plain text communication is enabled for a cluster broker node connection.1

Attributes

Item Id: MSK.1
Section: MSK
Service: MSK
Severity: medium
Section Description: This section contains recommendations for configuring MSK resources.

MSK.2This control checks whether an Amazon MSK cluster has enhanced monitoring configured, specified by a monitoring level of at least PER_TOPIC_PER_BROKER. The control fails if the monitoring level for the cluster is set to DEFAULT or PER_BROKER.1

Attributes

Item Id: MSK.2
Section: MSK
Service: MSK
Severity: low
Section Description: This section contains recommendations for configuring MSK resources.

Macie11

Macie.1This control checks whether Amazon Macie is enabled for an account. The control fails if Macie isn't enabled for the account.1

Attributes

Item Id: Macie.1
Section: Macie
Service: Macie
Severity: medium
Section Description: This section contains recommendations for configuring Macie resources.

Neptune98

Neptune.1This control checks whether a Neptune DB cluster is encrypted at rest. The control fails if a Neptune DB cluster isn't encrypted at rest.0

Attributes

Item Id: Neptune.1
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.2This control checks whether a Neptune DB cluster publishes audit logs to Amazon CloudWatch Logs. The control fails if a Neptune DB cluster doesn't publish audit logs to CloudWatch Logs. EnableCloudWatchLogsExport should be set to Audit.1

Attributes

Item Id: Neptune.2
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.3This control checks whether a Neptune manual DB cluster snapshot is public. The control fails if a Neptune manual DB cluster snapshot is public.1

Attributes

Item Id: Neptune.3
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.4This control checks if a Neptune DB cluster has deletion protection enabled. The control fails if a Neptune DB cluster doesn't have deletion protection enabled.1

Attributes

Item Id: Neptune.4
Section: Neptune
Service: Neptune
Severity: low
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.5This control checks whether a Neptune DB cluster has automated backups enabled, and a backup retention period greater than or equal to 7 days. The control fails if backups aren't enabled for the Neptune DB cluster, or if the retention period is less than 7 days.1

Attributes

Item Id: Neptune.5
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.6This control checks whether a Neptune DB cluster snapshot is encrypted at rest. The control fails if a Neptune DB cluster isn't encrypted at rest.1

Attributes

Item Id: Neptune.6
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.7This control checks if a Neptune DB cluster has IAM database authentication enabled. The control fails if IAM database authentication isn't enabled for a Neptune DB cluster.1

Attributes

Item Id: Neptune.7
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.8This control checks if a Neptune DB cluster is configured to copy all tags to snapshots when the snapshots are created. The control fails if a Neptune DB cluster isn't configured to copy tags to snapshots.1

Attributes

Item Id: Neptune.8
Section: Neptune
Service: Neptune
Severity: low
Section Description: This section contains recommendations for configuring Neptune resources.

Neptune.9This control checks if an Amazon Neptune DB cluster has read-replica instances in multiple Availability Zones (AZs). The control fails if the cluster is deployed in only one AZ.1

Attributes

Item Id: Neptune.9
Section: Neptune
Service: Neptune
Severity: medium
Section Description: This section contains recommendations for configuring Neptune resources.

Network Firewall62

NetworkFirewall.2This control checks whether logging is enabled for an AWS Network Firewall firewall. The control fails if logging isn't enabled for at least one log type or if the logging destination doesn't exist.0

Attributes

Item Id: NetworkFirewall.2
Section: Network Firewall
Service: Network Firewall
Severity: medium
Section Description: This section contains recommendations for configuring Network Firewall resources.

NetworkFirewall.3This control checks whether a Network Firewall policy has any stateful or stateless rule groups associated. The control fails if stateless or stateful rule groups are not assigned.1

Attributes

Item Id: NetworkFirewall.3
Section: Network Firewall
Service: Network Firewall
Severity: medium
Section Description: This section contains recommendations for configuring Network Firewall resources.

NetworkFirewall.4A firewall policy defines how your firewall monitors and handles traffic in Amazon VPC. You configure stateless and stateful rule groups to filter packets and traffic flows. Defaulting to Pass can allow unintended traffic.0

Attributes

Item Id: NetworkFirewall.4
Section: Network Firewall
Service: Network Firewall
Severity: medium
Section Description: This section contains recommendations for configuring Network Firewall resources.

NetworkFirewall.5This control checks whether the default stateless action for fragmented packets for a Network Firewall policy is drop or forward. The control passes if Drop or Forward is selected, and fails if Pass is selected.0

Attributes

Item Id: NetworkFirewall.5
Section: Network Firewall
Service: Network Firewall
Severity: medium
Section Description: This section contains recommendations for configuring Network Firewall resources.

NetworkFirewall.6A rule group contains rules that define how your firewall processes traffic in your VPC. An empty stateless rule group when present in a firewall policy might give the impression that the rule group will process traffic. However, when the stateless rule group is empty, it does not process traffic.0

Attributes

Item Id: NetworkFirewall.6
Section: Network Firewall
Service: Network Firewall
Severity: medium
Section Description: This section contains recommendations for configuring Network Firewall resources.

NetworkFirewall.9This control checks whether an AWS Network Firewall firewall has deletion protection enabled. The control fails if deletion protection isn't enabled for a firewall.1

Attributes

Item Id: NetworkFirewall.9
Section: Network Firewall
Service: Network Firewall
Severity: medium
Section Description: This section contains recommendations for configuring Network Firewall resources.

Opensearch97

OpenSearch.1This control checks whether OpenSearch domains have encryption-at-rest configuration enabled. The check fails if encryption at rest is not enabled.1

Attributes

Item Id: OpenSearch.1
Section: Opensearch
Service: Opensearch
Severity: medium
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.2This control checks whether OpenSearch domains are in a VPC. It does not evaluate the VPC subnet routing configuration to determine public access.1

Attributes

Item Id: OpenSearch.2
Section: Opensearch
Service: Opensearch
Severity: critical
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.3This control checks whether OpenSearch domains have node-to-node encryption enabled. This control fails if node-to-node encryption is disabled on the domain.1

Attributes

Item Id: OpenSearch.3
Section: Opensearch
Service: Opensearch
Severity: medium
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.4This control checks whether OpenSearch domains are configured to send error logs to CloudWatch Logs. This control fails if error logging to CloudWatch is not enabled for a domain.1

Attributes

Item Id: OpenSearch.4
Section: Opensearch
Service: Opensearch
Severity: medium
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.5This control checks whether OpenSearch domains have audit logging enabled. This control fails if an OpenSearch domain does not have audit logging enabled.1

Attributes

Item Id: OpenSearch.5
Section: Opensearch
Service: Opensearch
Severity: medium
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.6This control checks whether OpenSearch domains are configured with at least three data nodes and zoneAwarenessEnabled is true. This control fails for an OpenSearch domain if instanceCount is less than 3 or zoneAwarenessEnabled is false.0

Attributes

Item Id: OpenSearch.6
Section: Opensearch
Service: Opensearch
Severity: medium
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.7This control checks whether OpenSearch domains have fine-grained access control enabled. The control fails if the fine-grained access control is not enabled. Fine-grained access control requires advanced-security-optionsin the OpenSearch parameter update-domain-config to be enabled.1

Attributes

Item Id: OpenSearch.7
Section: Opensearch
Service: Opensearch
Severity: high
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.8TThis controls checks whether an Amazon OpenSearch Service domain endpoint is configured to use the latest TLS security policy. The control fails if the OpenSearch domain endpoint isn't configured to use the latest supported policy or if HTTPs isn't enabled.0

Attributes

Item Id: OpenSearch.8
Section: Opensearch
Service: Opensearch
Severity: medium
Section Description: This section contains recommendations for configuring OpenSearch resources.

OpenSearch.10This control checks whether an Amazon OpenSearch Service domain has the latest software update installed. The control fails if a software update is available but not installed for the domain.1

Attributes

Item Id: OpenSearch.10
Section: Opensearch
Service: Opensearch
Severity: low
Section Description: This section contains recommendations for configuring OpenSearch resources.

Private Certificate Authority10

PrivateCertificateAuthority.1This control checks if AWS Private CA has a root certificate authority (CA) that is disabled. The control fails if the root CA is enabled.0

Attributes

Item Id: PrivateCertificateAuthority.1
Section: Private Certificate Authority
Service: Private Certificate Authority
Severity: low
Section Description: This section contains recommendations for configuring Private Certificate Authority resources.

RDS3330

RDS.1This control checks whether Amazon RDS snapshots are public. This control is intended for RDS instances. It can also return findings for snapshots of Aurora DB instances, Neptune DB instances, and Amazon DocumentDB clusters, even though they are not evaluated for public accessibility. If these findings are not useful, you can suppress them.1

Attributes

Item Id: RDS.1
Section: RDS
Service: RDS
Severity: critical
Section Description: This section contains recommendations for configuring RDS resources.

RDS.2This control checks whether Amazon RDS instances are publicly accessible by evaluating the PubliclyAccessible field in the instance configuration item. Neptune DB instances and Amazon DocumentDB clusters do not have the PubliclyAccessible flag and cannot be evaluated. However, this control can still generate findings for these resources. You can suppress these findings.1

Attributes

Item Id: RDS.2
Section: RDS
Service: RDS
Severity: critical
Section Description: This section contains recommendations for configuring RDS resources.

RDS.3This control checks whether storage encryption is enabled for your Amazon RDS DB instances. This control is intended for RDS DB instances. However, it can also generate findings for Aurora DB instances, Neptune DB instances, and Amazon DocumentDB clusters. If these findings are not useful, then you can suppress them.1

Attributes

Item Id: RDS.3
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.4This control checks whether RDS DB snapshots are encrypted. This control is intended for RDS DB instances. However, it can also generate findings for snapshots of Aurora DB instances, Neptune DB instances, and Amazon DocumentDB clusters. If these findings are not useful, then you can suppress them.1

Attributes

Item Id: RDS.4
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.5This control checks whether high availability is enabled for your RDS DB instances. RDS DB instances should be configured for multiple Availability Zones (AZs). This ensures the availability of the data stored. Multi-AZ deployments allow for automated failover if there is an issue with Availability Zone availability and during regular RDS maintenance.1

Attributes

Item Id: RDS.5
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.6This control checks whether enhanced monitoring is enabled for your RDS DB instances. In Amazon RDS, Enhanced Monitoring enables a more rapid response to performance changes in underlying infrastructure. These performance changes could result in a lack of availability of the data. Enhanced Monitoring provides real-time metrics of the operating system that your RDS DB instance runs on. An agent is installed on the instance. The agent can obtain metrics more accurately than is possible from the hypervisor layer.1

Attributes

Item Id: RDS.6
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.7This control checks whether RDS clusters have deletion protection enabled. This control is intended for RDS DB instances. However, it can also generate findings for Aurora DB instances, Neptune DB instances, and Amazon DocumentDB clusters. If these findings are not useful,then you can suppress them.1

Attributes

Item Id: RDS.7
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.8This control checks whether your RDS DB instances that use one of the listed database engines have deletion protection enabled. DatabaseEngines: mariadb,mysql,oracle-ee,oracle-se2,oracle-se1,oracle-se,postgres,sqlserver-ee,sqlserver-se,sqlserver-ex,sqlserver-web.1

Attributes

Item Id: RDS.8
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.9This control checks whether the logs of Amazon RDS are enabled and sent to CloudWatch Logs. RDS databases should have relevant logs enabled. Database logging provides detailed records of requests made to RDS. Database logs can assist with security and access audits and can help to diagnose availability issues.1

Attributes

Item Id: RDS.9
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.10This control checks whether an RDS DB instance has IAM database authentication enabled IAM database authentication allows authentication to database instances with an authentication token instead of a password. Network traffic to and from the database is encrypted using SSL.1

Attributes

Item Id: RDS.10
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.11This control checks whether Amazon Relational Database Service instances have automated backups enabled and the backup retention period is greater than or equal to seven days. The control fails if backups are not enabled, and if the retention period is less than 7 days.1

Attributes

Item Id: RDS.11
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.12This control checks whether an RDS DB cluster has IAM database authentication enabled. IAM database authentication allows for password-free authentication to database instances. The authentication uses an authentication token. Network traffic to and from the database is encrypted using SSL.1

Attributes

Item Id: RDS.12
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.13This control checks whether automatic minor version upgrades are enabled for the RDS database instance. Enabling automatic minor version upgrades ensures that the latest minor version updates to the relational database management system (RDBMS) are installed. These upgrades might include security patches and bug fixes. Keeping up to date with patch installation is an important step in securing systems.1

Attributes

Item Id: RDS.13
Section: RDS
Service: RDS
Severity: high
Section Description: This section contains recommendations for configuring RDS resources.

RDS.14This control checks whether Amazon Aurora clusters have backtracking enabled. Backups help you to recover more quickly from a security incident. They also strengthens the resilience of your systems. Aurora backtracking reduces the time to recover a database to a point in time. It does not require a database restore to so.1

Attributes

Item Id: RDS.14
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.15This control checks whether high availability is enabled for your RDS DB clusters. RDS DB clusters should be configured for multiple Availability Zones to ensure availability of the data that is stored.1

Attributes

Item Id: RDS.15
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.16This control checks whether RDS DB clusters are configured to copy all tags to snapshots when the snapshots are created.1

Attributes

Item Id: RDS.16
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.17This control checks whether RDS DB instances are configured to copy all tags to snapshots when the snapshots are created.1

Attributes

Item Id: RDS.17
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.18This control checks whether an RDS instance is deployed in a VPC (EC2-VPC).1

Attributes

Item Id: RDS.18
Section: RDS
Service: RDS
Severity: high
Section Description: This section contains recommendations for configuring RDS resources.

RDS.19This control checks whether an Amazon RDS event subscription exists that has notifications enabled for the following source type, event category key-value pairs.1

Attributes

Item Id: RDS.19
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.20This control checks whether an Amazon RDS event subscription exists with notifications enabled for the following source type, event category key-value pairs.1

Attributes

Item Id: RDS.20
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.21This control checks whether an Amazon RDS event subscription exists with notifications enabled for the following source type, event category key-value pairs.1

Attributes

Item Id: RDS.21
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.22This control checks whether an Amazon RDS event subscription exists with notifications enabled for the following source type, event category key-value pairs.1

Attributes

Item Id: RDS.22
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.23This control checks whether the RDS cluster or instance uses a port other than the default port of the database engine.1

Attributes

Item Id: RDS.23
Section: RDS
Service: RDS
Severity: low
Section Description: This section contains recommendations for configuring RDS resources.

RDS.24This control checks whether an Amazon RDS database cluster has changed the admin username from its default value. This rule will fail if the admin username is set to the default value.1

Attributes

Item Id: RDS.24
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.25This control checks whether you've changed the administrative username for Amazon Relational Database Service (Amazon RDS) database instances from the default value. The control fails if the administrative username is set to the default value.1

Attributes

Item Id: RDS.25
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.26This control evaluates if Amazon RDS DB instances are covered by a backup plan. This control fails if the RDS DB instance isn't covered by a backup plan. If you set the backupVaultLockCheck parameter equal to true, the control passes only if the instance is backed up in an AWS Backup locked vault.0

Attributes

Item Id: RDS.26
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.27This control checks if an RDS DB cluster is encrypted at rest. The control fails if an RDS DB cluster isn't encrypted at rest.1

Attributes

Item Id: RDS.27
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.34This control checks whether an Amazon Aurora MySQL DB cluster is configured to publish audit logs to Amazon CloudWatch Logs. The control fails if the cluster isn't configured to publish audit logs to CloudWatch Logs.0

Attributes

Item Id: RDS.34
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.35This control checks if automatic minor version upgrade is enabled for an Amazon RDS database cluster. The control fails if automatic minor version upgrade isn't enabled for an RDS cluster.1

Attributes

Item Id: RDS.35
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.36This control checks whether an Amazon RDS for PostgreSQL DB instance is configured to publish logs to Amazon CloudWatch Logs. The control fails if the PostgreSQL DB instance isn't configured to publish the log types mentioned in the logTypes parameter to CloudWatch Logs.0

Attributes

Item Id: RDS.36
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.37This control checks whether an Amazon Aurora PostgreSQL DB cluster is configured to publish logs to Amazon CloudWatch Logs. The control fails if the Aurora PostgreSQL DB cluster isn't configured to publish PostgreSQL logs to CloudWatch Logs.1

Attributes

Item Id: RDS.37
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.38This control checks whether a connection to an Amazon RDS for PostgreSQL database (DB) instance is encrypted in transit. The control fails if the rds.force_ssl parameter for the parameter group associated with the instance is set to 0 (off). This control doesn't evaluate RDS DB instances that are part of a DB cluster.1

Attributes

Item Id: RDS.38
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

RDS.39This control checks whether a connection to an Amazon RDS for MySQL database (DB) instance is encrypted in transit. The control fails if the rds.require_secure_transport parameter for the parameter group associated with the instance is set to 0 (off). This control doesn't evaluate RDS DB instances that are part of a DB cluster.1

Attributes

Item Id: RDS.39
Section: RDS
Service: RDS
Severity: medium
Section Description: This section contains recommendations for configuring RDS resources.

Redshift94

Redshift.1This control checks whether Amazon Redshift clusters are publicly accessible. It evaluates the PubliclyAccessible field in the cluster configuration item. The PubliclyAccessible attribute of the Amazon Redshift cluster configuration indicates whether the cluster is publicly accessible. When the cluster is configured with PubliclyAccessible set to true, it is an Internet-facing instance that has a publicly resolvable DNS name, which resolves to a public IP address. When the cluster is not publicly accessible, it is an internal instance with a DNS name that resolves to a private IP address. Unless you intend for your cluster to be publicly accessible, the cluster should not be configured with PubliclyAccessible set to true.1

Attributes

Item Id: Redshift.1
Section: Redshift
Service: Redshift
Severity: critical
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.2This control checks whether connections to Amazon Redshift clusters are required to use encryption in transit. The check fails if the Amazon Redshift cluster parameter require_SSL is not set to 1. TLS can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic. Only encrypted connections over TLS should be allowed. Encrypting data in transit can affect performance. You should test your application with this feature to understand the performance profile and the impact of TLS.0

Attributes

Item Id: Redshift.2
Section: Redshift
Service: Redshift
Severity: medium
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.3This control checks whether Amazon Redshift clusters have automated snapshots enabled. It also checks whether the snapshot retention period is greater than or equal to seven.1

Attributes

Item Id: Redshift.3
Section: Redshift
Service: Redshift
Severity: medium
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.4This control checks whether an Amazon Redshift cluster has audit logging enabled.1

Attributes

Item Id: Redshift.4
Section: Redshift
Service: Redshift
Severity: medium
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.6This control checks whether automatic major version upgrades are enabled for the Amazon Redshift cluster.1

Attributes

Item Id: Redshift.6
Section: Redshift
Service: Redshift
Severity: medium
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.7This control checks whether an Amazon Redshift cluster has EnhancedVpcRouting enabled.0

Attributes

Item Id: Redshift.7
Section: Redshift
Service: Redshift
Severity: high
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.8This control checks whether a Amazon Redshift cluster has changed the admin username from its default value. This control will fail if the admin username for a Redshift cluster is set to awsuser.0

Attributes

Item Id: Redshift.8
Section: Redshift
Service: Redshift
Severity: high
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.9This control checks whether an Amazon Redshift cluster has changed the database name from its default value. The control will fail if the database name for a Redshift cluster is set to dev.0

Attributes

Item Id: Redshift.9
Section: Redshift
Service: Redshift
Severity: medium
Section Description: This section contains recommendations for configuring Redshift resources.

Redshift.10This control checks if Amazon Redshift clusters are encrypted at rest. The control fails if a Redshift cluster isn't encrypted at rest or if the encryption key is different from the provided key in the rule parameter.0

Attributes

Item Id: Redshift.10
Section: Redshift
Service: Redshift
Severity: medium
Section Description: This section contains recommendations for configuring Redshift resources.

Route5310

Route53.2This control checks if DNS query logging is enabled for an Amazon Route 53 public hosted zone. The control fails if DNS query logging isn't enabled for a Route 53 public hosted zone.0

Attributes

Item Id: Route53.2
Section: Route53
Service: Route53
Severity: medium
Section Description: This section contains recommendations for configuring Route53 resources.

S31715

S3.1This control checks whether the following Amazon S3 public access block settings are configured at the account level1

Attributes

Item Id: S3.1
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.2This control checks whether your S3 buckets allow public read access. It evaluates the Block Public Access settings, the bucket policy, and the bucket access control list (ACL).0

Attributes

Item Id: S3.2
Section: S3
Service: S3
Severity: critical
Section Description: This section contains recommendations for configuring S3 resources.

S3.3This control checks whether your S3 buckets allow public write access. It evaluates the block public access settings, the bucket policy, and the bucket access control list (ACL).2

Attributes

Item Id: S3.3
Section: S3
Service: S3
Severity: critical
Section Description: This section contains recommendations for configuring S3 resources.

S3.5This control checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL). S3 buckets should have policies that require all requests (Action: S3:*)to only accept transmission of data over HTTPS in the S3 resource policy, indicated by the condition key aws:SecureTransport.1

Attributes

Item Id: S3.5
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.6This control checks whether the S3 bucket policy prevents principals from other AWS accounts from performing denied actions on resources in the S3 bucket.1

Attributes

Item Id: S3.6
Section: S3
Service: S3
Severity: high
Section Description: This section contains recommendations for configuring S3 resources.

S3.7This control checks whether an Amazon S3 general purpose bucket has cross-Region replication enabled. The control fails if the bucket doesn't have cross-Region replication enabled.1

Attributes

Item Id: S3.7
Section: S3
Service: S3
Severity: low
Section Description: This section contains recommendations for configuring S3 resources.

S3.8This control checks whether S3 buckets have bucket-level public access blocks applied.1

Attributes

Item Id: S3.8
Section: S3
Service: S3
Severity: high
Section Description: This section contains recommendations for configuring S3 resources.

S3.9When logging is enabled, Amazon S3 delivers access logs for a source bucket to a chosen target bucket. The target bucket must be in the same AWS Region as the source bucket and must not have a default retention period configuration.1

Attributes

Item Id: S3.9
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.10This control checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured. This rule fails if Amazon S3 lifecycle policy is not enabled.0

Attributes

Item Id: S3.10
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.11This control checks whether S3 Event Notifications are enabled on an Amazon S3 bucket. This control fails if S3 Event Notifications are not enabled on a bucket.0

Attributes

Query: s3_bucket_event_notifications_enabled
Item Id: S3.11
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.12This control checks whether Amazon S3 buckets provide user permissions via ACLs. The control fails if ACLs are configured for managing user access on S3 buckets.1

Attributes

Item Id: S3.12
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.13This control checks if a lifecycle policy is configured for an Amazon S3 bucket. This control fails if a lifecycle policy is not configured for an S3 bucket.1

Attributes

Item Id: S3.13
Section: S3
Service: S3
Severity: low
Section Description: This section contains recommendations for configuring S3 resources.

S3.14This control checks whether an Amazon S3 general purpose bucket has versioning enabled. The control fails if versioning is suspended for the bucket.1

Attributes

Item Id: S3.14
Section: S3
Service: S3
Severity: low
Section Description: This section contains recommendations for configuring S3 resources.

S3.15This control checks whether an Amazon S3 general purpose bucket has Object Lock enabled. The control fails if Object Lock isn't enabled for the bucket. If you provide a custom value for the mode parameter, the control passes only if S3 Object Lock uses the specified retention mode.1

Attributes

Item Id: S3.15
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.17This control checks whether an Amazon S3 general purpose bucket is encrypted with an AWS KMS key (SSE-KMS or DSSE-KMS). The control fails if the bucket is encrypted with default encryption (SSE-S3).1

Attributes

Item Id: S3.17
Section: S3
Service: S3
Severity: medium
Section Description: This section contains recommendations for configuring S3 resources.

S3.19This control checks whether an Amazon S3 access point has block public access settings enabled. The control fails if block public access settings aren't enabled for the access point.1

Attributes

Item Id: S3.19
Section: S3
Service: S3
Severity: critical
Section Description: This section contains recommendations for configuring S3 resources.

S3.20This control checks whether multi-factor authentication (MFA) delete is enabled on an Amazon S3 general purpose versioned bucket. The control fails if MFA delete is not enabled on the bucket. The control doesn't produce findings for buckets that have a Lifecycle configuration.1

Attributes

Item Id: S3.20
Section: S3
Service: S3
Severity: low
Section Description: This section contains recommendations for configuring S3 resources.

SNS31

SNS.1This control checks whether an SNS topic is encrypted at rest using AWS KMS.1

Attributes

Item Id: SNS.1
Section: SNS
Service: SNS
Severity: medium
Section Description: This section contains recommendations for configuring SNS resources.

SNS.2This control checks whether logging is enabled for the delivery status of notification messages sent to an Amazon SNS topic for the endpoints. This control fails if the delivery status notification for messages is not enabled.0

Attributes

Item Id: SNS.2
Section: SNS
Service: SNS
Severity: medium
Section Description: This section contains recommendations for configuring SNS resources.

SNS.4This control checks if the Amazon SNS topic access policy allows public access. This control fails if the SNS topic access policy allows public access.0

Attributes

Item Id: SNS.4
Section: SNS
Service: SNS
Severity: high
Section Description: This section contains recommendations for configuring SNS resources.

SQS11

SQS.1This control checks whether Amazon SQS queues are encrypted at rest.1

Attributes

Item Id: SQS.1
Section: SQS
Service: SQS
Severity: medium
Section Description: This section contains recommendations for configuring SQS resources.

SSM44

SSM.1This control checks whether the EC2 instances in your account are managed by AWS Systems Manager. Systems Manager is an AWS service that you can use to view and control your AWS infrastructure. To help you to maintain security and compliance, Systems Manager scans your managed instances. A managed instance is a machine that is configured for use with Systems Manager. Systems Manager then reports or takes corrective action on any policy violations that it detects. Systems Manager also helps you to configure and maintain your managed instances.1

Attributes

Item Id: SSM.1
Section: SSM
Service: SSM
Severity: medium
Section Description: This section contains recommendations for configuring SSM resources.

SSM.2This control checks whether the compliance status of the Amazon EC2 Systems Manager patch compliance is COMPLIANT or non compliant after the patch installation on the instance. It only checks instances that are managed by Systems Manager Patch Manager.1

Attributes

Item Id: SSM.2
Section: SSM
Service: SSM
Severity: high
Section Description: This section contains recommendations for configuring SSM resources.

SSM.3This control checks whether the status of the AWS Systems Manager association compliance is COMPLIANT or non compliant after the association is run on an instance. The control passes if the association compliance status is COMPLIANT.1

Attributes

Item Id: SSM.3
Section: SSM
Service: SSM
Severity: low
Section Description: This section contains recommendations for configuring SSM resources.

SSM.4This control checks whether AWS Systems Manager documents that are owned by the account are public. This control fails if SSM documents with the owner Self are public.1

Attributes

Item Id: SSM.4
Section: SSM
Service: SSM
Severity: critical
Section Description: This section contains recommendations for configuring SSM resources.

SageMaker55

SageMaker.1This control checks whether direct internet access is disabled for an SageMaker notebook instance. To do this, it checks whether the DirectInternetAccess field is disabled for the notebook instance. If you configure your SageMaker instance without a VPC, then by default direct internet access is enabled on your instance. You should configure your instance with a VPC and change the default setting to Disable â Access the internet through a VPC.1

Attributes

Item Id: SageMaker.1
Section: SageMaker
Service: SageMaker
Severity: high
Section Description: This section contains recommendations for configuring SageMaker resources.

SageMaker.2This control checks if an Amazon SageMaker notebook instance is launched within a custom virtual private cloud (VPC). This control fails if a SageMaker notebook instance is not launched within a custom VPC or if it is launched in the SageMaker service VPC.1

Attributes

Item Id: SageMaker.2
Section: SageMaker
Service: SageMaker
Severity: high
Section Description: This section contains recommendations for configuring SageMaker resources.

SageMaker.3This control checks whether root access is turned on for an Amazon SageMaker notebook instance. The control fails if root access is turned on for a SageMaker notebook instance.1

Attributes

Item Id: SageMaker.3
Section: SageMaker
Service: SageMaker
Severity: high
Section Description: This section contains recommendations for configuring SageMaker resources.

SageMaker.4This control checks whether production variants of an Amazon SageMaker AI endpoint have an initial instance count greater than 1. The control fails if the endpoint's production variants have only 1 initial instance.1

Attributes

Item Id: SageMaker.4
Section: SageMaker
Service: SageMaker
Severity: medium
Section Description: This section contains recommendations for configuring SageMaker resources.

SageMaker.5This control checks whether an Amazon SageMaker AI hosted model blocks inbound network traffic. The control fails if the EnableNetworkIsolation parameter for the hosted model is set to False.1

Attributes

Item Id: SageMaker.5
Section: SageMaker
Service: SageMaker
Severity: medium
Section Description: This section contains recommendations for configuring SageMaker resources.

Secrets Manager41

SecretsManager.1This control checks whether a secret stored in AWS Secrets Manager is configured with automatic rotation. Secrets Manager helps you improve the security posture of your organization. Secrets include database credentials, passwords, and third-party API keys. You can use Secrets Manager to store secrets centrally, encrypt secrets automatically, control access to secrets, and rotate secrets safely and automatically.1

Attributes

Item Id: SecretsManager.1
Section: Secrets Manager
Service: Secrets Manager
Severity: medium
Section Description: This section contains recommendations for configuring Secrets Manager resources.

SecretsManager.2This control checks whether an AWS Secrets Manager secret rotated successfully based on the rotation schedule. The control fails if RotationOccurringAsScheduled is false. The control does not evaluate secrets that do not have rotation configured.0

Attributes

Item Id: SecretsManager.2
Section: Secrets Manager
Service: Secrets Manager
Severity: medium
Section Description: This section contains recommendations for configuring Secrets Manager resources.

SecretsManager.3This control checks whether an AWS Secrets Manager secret has been accessed within the specified time frame. The control fails if a secret is unused beyond the specified time frame. Unless you provide a custom parameter value for the access period, Security Hub uses a default value of 90 days0

Attributes

Item Id: SecretsManager.3
Section: Secrets Manager
Service: Secrets Manager
Severity: medium
Section Description: This section contains recommendations for configuring Secrets Manager resources.

SecretsManager.4This control checks whether your secrets have been rotated at least once within 90 days. Rotating secrets can help you to reduce the risk of an unauthorized use of your secrets in your AWS account. Examples include database credentials, passwords, third-party API keys, and even arbitrary text. If you do not change your secrets for a long period of time, the secrets are more likely to be compromised.0

Attributes

Item Id: SecretsManager.4
Section: Secrets Manager
Service: Secrets Manager
Severity: medium
Section Description: This section contains recommendations for configuring Secrets Manager resources.

Step Functions10

StepFunctions.1This controls checks whether an AWS Step Functions state machine has logging turned on. The control fails if a state machine doesn't have logging turned on. If you provide a custom value for the logLevel parameter, the control passes only if the state machine has the specified logging level turned on.0

Attributes

Item Id: StepFunctions.1
Section: Step Functions
Service: Step Functions
Severity: medium
Section Description: This section contains recommendations for configuring Step Functions resources.

WAF101

WAF.1This control checks whether logging is enabled for an AWS WAF global web ACL. This control fails if logging is not enabled for the web ACL.0

Attributes

Query: waf_web_acl_logging_enabled
Item Id: WAF.1
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.2This control checks whether an AWS WAF Regional rule has at least one condition. The control fails if no conditions are present within a rule.0

Attributes

Item Id: WAF.2
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.3This control checks whether an AWS WAF Regional rule group has at least one rule. The control fails if no rules are present within a rule group.0

Attributes

Item Id: WAF.3
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.4This control checks whether an AWS WAF Classic Regional web ACL contains any WAF rules or WAF rule groups. This control fails if a web ACL does not contain any WAF rules or rule groups.0

Attributes

Item Id: WAF.4
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.6This control checks whether an AWS WAF global rule contains any conditions. The control fails if no conditions are present within a rule.0

Attributes

Item Id: WAF.6
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.7This control checks whether an AWS WAF global rule group has at least one rule. The control fails if no rules are present within a rule group.0

Attributes

Item Id: WAF.7
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.8This control checks whether an AWS WAF global web ACL contains at least one WAF rule or WAF rule group. The control fails if a web ACL does not contain any WAF rules or rule groups.0

Attributes

Item Id: WAF.8
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.10This control checks whether a WAFV2 web access control list (web ACL) contains at least one WAF rule or WAF rule group. The control fails if a web ACL does not contain any WAF rules or rule groups.0

Attributes

Item Id: WAF.10
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.

WAF.11This control checks whether logging is activated for an AWS WAFV2 web access control list (web ACL). This control fails if logging is deactivated for the web ACL.1

Attributes

Item Id: WAF.11
Section: WAF
Service: WAF
Severity: low
Section Description: This section contains recommendations for configuring WAF resources.

WAF.12This control checks whether an AWS WAF rule or rule group has Amazon CloudWatch metrics enabled. The control fails if the rule or rule group doesn't have CloudWatch metrics enabled.0

Attributes

Item Id: WAF.12
Section: WAF
Service: WAF
Severity: medium
Section Description: This section contains recommendations for configuring WAF resources.