Payment Card Industry Data Security Standard (PCI DSS) v4.0

pci_4.0_aws

PCIv4.0

OfficialVerified

The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard. It's administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS applies to entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). This includes, but isn't limited to, merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.

1679requirements208checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance pci_4.0_aws

Requirements (1679)

1.2.5: Network security controls (NSCs) are configured and maintained. 1716

1.2.5.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: elb

1.2.5.2Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.5.3Checks if Amazon CloudFront distributions are using a minimum security policy and cipher suite of TLSv11

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.5.4Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.5.5Checks if Amazon CloudFront distributions are encrypting traffic to custom origins1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.5.6Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.5.7Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: opensearch

1.2.5.8Checks whether your Classic Load Balancer SSL listeners are using a custom policy1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: elb

1.2.5.9Checks if your Classic Load Balancer SSL listeners use a predefined policy1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: elb

1.2.5.10Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: elb

1.2.5.11Checks if Amazon EMR clusters have Kerberos enabled0

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: emr

1.2.5.12Checks whether connections to OpenSearch domains are using HTTPS1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: opensearch

1.2.5.13Check if Amazon OpenSearch Service nodes are encrypted end to end1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: opensearch

1.2.5.14Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: redshift

1.2.5.15Checks if S3 buckets have policies that require requests to use SSL/TLS1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.5.16Checks if a server created with AWS Transfer Family uses FTP for endpoint connection1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: transfer

1.2.5.17Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 1.2.5: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8: Network security controls (NSCs) are configured and maintained. 4742

1.2.8.1Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: apigateway

1.2.8.2Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: apigateway

1.2.8.3Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: apigateway

1.2.8.4Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.8.5Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: cloudfront

1.2.8.6Checks if the Bitbucket source repository URL contains sign-in credentials or not1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: codebuild

1.2.8.7Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: dms

1.2.8.8Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: documentdb

1.2.8.9Checks if the AWS Client VPN authorization rules authorizes connection access for all clients1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.10Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance0

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.11Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.12Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: eks

1.2.8.13Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)0

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: opensearch

1.2.8.14Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: elb

1.2.8.15Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: elb

1.2.8.16Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: emr

1.2.8.17For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.18Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: vpc

1.2.8.19Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: awslambda

1.2.8.20Checks if a Lambda function is allowed access to a virtual private cloud (VPC)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: awslambda

1.2.8.21Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.22Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: networkfirewall

1.2.8.23Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: networkfirewall

1.2.8.24Checks if a Stateless Network Firewall Rule Group contains rules1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: networkfirewall

1.2.8.25Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: vpc

1.2.8.26Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: opensearch

1.2.8.27Checks if there are any Amazon Relational Database Service (Amazon RDS) DB security groups that are not the default DB security group1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: rds

1.2.8.28Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: rds

1.2.8.29Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: redshift

1.2.8.30Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.8.31Checks if the required public access block settings are configured from account level1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.8.32Checks if the required public access block settings are configured at the account level1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.8.33Checks if S3 buckets are publicly accessible1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.8.34Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.8.35Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: s3

1.2.8.36Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: sagemaker

1.2.8.37Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: sagemaker

1.2.8.38Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)2

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: vpc

1.2.8.39Checks if there are unused network access control lists (network ACLs)1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.40Checks if DNS resolution from accepter/requester VPC to private IP is enabled0

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: vpc

1.2.8.41Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: ec2

1.2.8.42Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: waf

1.2.8.43Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: waf

1.2.8.44Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: waf

1.2.8.45Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: waf

1.2.8.46Checks whether WAF regional rule contains conditions1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: waf

1.2.8.47Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.2.8: Network security controls (NSCs) are configured and maintained.
Service: waf

1.3.1: Network access to and from the cardholder data environment is restricted. 5347

1.3.1.1Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.1.2Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.1.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.1.4Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.1.5Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: cloudfront

1.3.1.6Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: cloudfront

1.3.1.7Checks if the Bitbucket source repository URL contains sign-in credentials or not1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: codebuild

1.3.1.8Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: dms

1.3.1.9Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: documentdb

1.3.1.10Checks if the AWS Client VPN authorization rules authorizes connection access for all clients1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.11Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.12Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.13Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: eks

1.3.1.14Checks if Amazon ElastiCache clusters are configured with a custom subnet group1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: elasticache

1.3.1.15Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: opensearch

1.3.1.16Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: elb

1.3.1.17Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: elb

1.3.1.18Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: emr

1.3.1.19For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.20For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.21Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.1.22Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: awslambda

1.3.1.23Checks if a Lambda function is allowed access to a virtual private cloud (VPC)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: awslambda

1.3.1.24Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.25Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: networkfirewall

1.3.1.26Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: networkfirewall

1.3.1.27Checks if a Stateless Network Firewall Rule Group contains rules1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: networkfirewall

1.3.1.28Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.1.29Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: opensearch

1.3.1.30Checks if there are any Amazon Relational Database Service (Amazon RDS) DB security groups that are not the default DB security group1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: rds

1.3.1.31Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: rds

1.3.1.32Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: redshift

1.3.1.33Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: redshift

1.3.1.34Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.1.35Checks if the required public access block settings are configured from account level1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.1.36Checks if the required public access block settings are configured at the account level1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.1.37Checks if S3 buckets are publicly accessible1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.1.38Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.1.39Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.1.40Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: sagemaker

1.3.1.41Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: sagemaker

1.3.1.42Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)2

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.1.43Checks if there are unused network access control lists (network ACLs)1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.44Checks if DNS resolution from accepter/requester VPC to private IP is enabled0

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.1.45Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.1.46Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.1.47Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.1.48Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.1.49Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.1.50Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.1.51Checks whether WAF regional rule contains conditions1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.1.52Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.1.53Checks if Nitro Enclave parent instances have a public IP address or reside in a subnet routed to an internet gateway1

Attributes

Section: 1.3.1: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2: Network access to and from the cardholder data environment is restricted. 5347

1.3.2.1Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.2.2Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.2.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.2.4Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: apigateway

1.3.2.5Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: cloudfront

1.3.2.6Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: cloudfront

1.3.2.7Checks if the Bitbucket source repository URL contains sign-in credentials or not1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: codebuild

1.3.2.8Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: dms

1.3.2.9Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: documentdb

1.3.2.10Checks if the AWS Client VPN authorization rules authorizes connection access for all clients1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.11Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.12Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.13Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: eks

1.3.2.14Checks if Amazon ElastiCache clusters are configured with a custom subnet group1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: elasticache

1.3.2.15Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: opensearch

1.3.2.16Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: elb

1.3.2.17Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: elb

1.3.2.18Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: emr

1.3.2.19For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.20For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.21Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.2.22Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: awslambda

1.3.2.23Checks if a Lambda function is allowed access to a virtual private cloud (VPC)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: awslambda

1.3.2.24Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.25Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: networkfirewall

1.3.2.26Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: networkfirewall

1.3.2.27Checks if a Stateless Network Firewall Rule Group contains rules1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: networkfirewall

1.3.2.28Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.2.29Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: opensearch

1.3.2.30Checks if there are any Amazon Relational Database Service (Amazon RDS) DB security groups that are not the default DB security group1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: rds

1.3.2.31Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: rds

1.3.2.32Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: redshift

1.3.2.33Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: redshift

1.3.2.34Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.2.35Checks if the required public access block settings are configured from account level1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.2.36Checks if the required public access block settings are configured at the account level1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.2.37Checks if S3 buckets are publicly accessible1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.2.38Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.2.39Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: s3

1.3.2.40Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: sagemaker

1.3.2.41Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: sagemaker

1.3.2.42Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)2

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.2.43Checks if there are unused network access control lists (network ACLs)1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.44Checks if DNS resolution from accepter/requester VPC to private IP is enabled0

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.2.45Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.3.2.46Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: vpc

1.3.2.47Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.2.48Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.2.49Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.2.50Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.2.51Checks whether WAF regional rule contains conditions1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.2.52Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: waf

1.3.2.53Checks if security groups attached to Nitro Enclave parent instances allow unrestricted ingress from 0.0.0.0/0 or ::/01

Attributes

Section: 1.3.2: Network access to and from the cardholder data environment is restricted.
Service: ec2

1.4.1: Network connections between trusted and untrusted networks are controlled. 106

1.4.1.1Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.1.2Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.1.3Checks if Amazon ElastiCache clusters are configured with a custom subnet group1

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: elasticache

1.4.1.4For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different0

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.1.5Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.1.6Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.1.7Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled1

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: redshift

1.4.1.8Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: sagemaker

1.4.1.9Checks if DNS resolution from accepter/requester VPC to private IP is enabled0

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.1.10Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status1

Attributes

Section: 1.4.1: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.2: Network connections between trusted and untrusted networks are controlled. 5146

1.4.2.1Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.2.2Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.2.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.2.4Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.2.5Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: cloudfront

1.4.2.6Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: cloudfront

1.4.2.7Checks if the Bitbucket source repository URL contains sign-in credentials or not1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: codebuild

1.4.2.8Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: dms

1.4.2.9Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: documentdb

1.4.2.10Checks if the AWS Client VPN authorization rules authorizes connection access for all clients1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.11Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance0

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.12Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.13Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: eks

1.4.2.14Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)0

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: opensearch

1.4.2.15Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: elb

1.4.2.16Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: elb

1.4.2.17Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: emr

1.4.2.18For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.19Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.2.20Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: awslambda

1.4.2.21Checks if a Lambda function is allowed access to a virtual private cloud (VPC)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: awslambda

1.4.2.22Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.23Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: networkfirewall

1.4.2.24Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: networkfirewall

1.4.2.25Checks if a Stateless Network Firewall Rule Group contains rules1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: networkfirewall

1.4.2.26Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.2.27Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: opensearch

1.4.2.28Checks if there are any Amazon Relational Database Service (Amazon RDS) DB security groups that are not the default DB security group1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: rds

1.4.2.29Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: rds

1.4.2.30Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: redshift

1.4.2.31Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: redshift

1.4.2.32Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: s3

1.4.2.33Checks if the required public access block settings are configured from account level1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: s3

1.4.2.34Checks if the required public access block settings are configured at the account level1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: s3

1.4.2.35Checks if S3 buckets are publicly accessible1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: s3

1.4.2.36Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: s3

1.4.2.37Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: s3

1.4.2.38Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: sagemaker

1.4.2.39Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: sagemaker

1.4.2.40Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)2

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.2.41Checks if there are unused network access control lists (network ACLs)1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.42Checks if DNS resolution from accepter/requester VPC to private IP is enabled0

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.2.43Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.2.44Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.2.45Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: waf

1.4.2.46Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: waf

1.4.2.47Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: waf

1.4.2.48Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: waf

1.4.2.49Checks whether WAF regional rule contains conditions1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: waf

1.4.2.50Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: waf

1.4.2.51Checks if security groups attached to Nitro Enclave parent instances expose vsock-proxy TCP ports to sources outside the VPC1

Attributes

Section: 1.4.2: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.3: Network connections between trusted and untrusted networks are controlled. 33

1.4.3.1Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: 1.4.3: Network connections between trusted and untrusted networks are controlled.
Service: networkfirewall

1.4.3.2Checks if an AWS Network Firewall policy is configured with a user defined default stateless action for full packets1

Attributes

Section: 1.4.3: Network connections between trusted and untrusted networks are controlled.
Service: networkfirewall

1.4.3.3Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: 1.4.3: Network connections between trusted and untrusted networks are controlled.
Service: networkfirewall

1.4.4: Network connections between trusted and untrusted networks are controlled. 106

1.4.4.1Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.4.2Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: apigateway

1.4.4.3Checks if Amazon ElastiCache clusters are configured with a custom subnet group1

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: elasticache

1.4.4.4For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different0

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.4.5Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.4.6Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.4.7Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled1

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: redshift

1.4.4.8Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: sagemaker

1.4.4.9Checks if DNS resolution from accepter/requester VPC to private IP is enabled0

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.4.10Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status1

Attributes

Section: 1.4.4: Network connections between trusted and untrusted networks are controlled.
Service: vpc

1.4.5: Network connections between trusted and untrusted networks are controlled. 22

1.4.5.1Checks if Amazon EC2 Launch Templates are set to assign public IP addresses to Network Interfaces1

Attributes

Section: 1.4.5: Network connections between trusted and untrusted networks are controlled.
Service: ec2

1.4.5.2Checks if ECSTaskDefinitions are configured to share a host’s process namespace with its Amazon Elastic Container Service (Amazon ECS) containers1

Attributes

Section: 1.4.5: Network connections between trusted and untrusted networks are controlled.
Service: ecs

1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. 4642

1.5.1.1Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: apigateway

1.5.1.2Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: apigateway

1.5.1.3Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: apigateway

1.5.1.4Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: cloudfront

1.5.1.5Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: cloudfront

1.5.1.6Checks if the Bitbucket source repository URL contains sign-in credentials or not1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: codebuild

1.5.1.7Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: dms

1.5.1.8Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: documentdb

1.5.1.9Checks if the AWS Client VPN authorization rules authorizes connection access for all clients1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.10Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance0

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.11Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.12Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: eks

1.5.1.13Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)0

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: opensearch

1.5.1.14Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: elb

1.5.1.15Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: elb

1.5.1.16Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: emr

1.5.1.17For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.18Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: vpc

1.5.1.19Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: awslambda

1.5.1.20Checks if a Lambda function is allowed access to a virtual private cloud (VPC)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: awslambda

1.5.1.21Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.22Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: networkfirewall

1.5.1.23Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: networkfirewall

1.5.1.24Checks if a Stateless Network Firewall Rule Group contains rules1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: networkfirewall

1.5.1.25Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: vpc

1.5.1.26Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: opensearch

1.5.1.27Checks if there are any Amazon Relational Database Service (Amazon RDS) DB security groups that are not the default DB security group1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: rds

1.5.1.28Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: rds

1.5.1.29Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: redshift

1.5.1.30Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: s3

1.5.1.31Checks if the required public access block settings are configured from account level1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: s3

1.5.1.32Checks if the required public access block settings are configured at the account level1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: s3

1.5.1.33Checks if S3 buckets are publicly accessible1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: s3

1.5.1.34Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: s3

1.5.1.35Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: s3

1.5.1.36Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: sagemaker

1.5.1.37Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: sagemaker

1.5.1.38Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)2

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: vpc

1.5.1.39Checks if there are unused network access control lists (network ACLs)1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.40Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: ec2

1.5.1.41Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: waf

1.5.1.42Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: waf

1.5.1.43Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: waf

1.5.1.44Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: waf

1.5.1.45Checks whether WAF regional rule contains conditions1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: waf

1.5.1.46Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
Service: waf

2.2.5: System components are configured and managed securely. 1817

2.2.5.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: elb

2.2.5.2Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: cloudfront

2.2.5.3Checks if Amazon CloudFront distributions are using a minimum security policy and cipher suite of TLSv11

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: cloudfront

2.2.5.4Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: cloudfront

2.2.5.5Checks if Amazon CloudFront distributions are encrypting traffic to custom origins1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: cloudfront

2.2.5.6Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: cloudfront

2.2.5.7Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: opensearch

2.2.5.8Checks whether your Classic Load Balancer SSL listeners are using a custom policy1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: elb

2.2.5.9Checks if your Classic Load Balancer SSL listeners use a predefined policy1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: elb

2.2.5.10Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: elb

2.2.5.11Checks if Amazon EMR clusters have Kerberos enabled0

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: emr

2.2.5.12Checks whether connections to OpenSearch domains are using HTTPS1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: opensearch

2.2.5.13Check if Amazon OpenSearch Service nodes are encrypted end to end1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: opensearch

2.2.5.14Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: redshift

2.2.5.15Checks if S3 buckets have policies that require requests to use SSL/TLS1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: s3

2.2.5.16Checks if a server created with AWS Transfer Family uses FTP for endpoint connection1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: transfer

2.2.5.17Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: ec2

2.2.5.18Checks if Nitro Enclave parent instances enforce IMDSv2 by requiring session tokens for instance metadata requests1

Attributes

Section: 2.2.5: System components are configured and managed securely.
Service: ec2

2.2.7: System components are configured and managed securely. 1918

2.2.7.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: elb

2.2.7.2Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: cloudfront

2.2.7.3Checks if Amazon CloudFront distributions are encrypting traffic to custom origins1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: cloudfront

2.2.7.4Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: cloudfront

2.2.7.5Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: dynamodb

2.2.7.6Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: dms

2.2.7.7Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: dms

2.2.7.8Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: elasticache

2.2.7.9Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: opensearch

2.2.7.10Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: elb

2.2.7.11Checks whether your Classic Load Balancer SSL listeners are using a custom policy1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: elb

2.2.7.12Checks if your Classic Load Balancer SSL listeners use a predefined policy1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: elb

2.2.7.13Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: elb

2.2.7.14Checks if Amazon EMR clusters have Kerberos enabled0

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: emr

2.2.7.15Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: kafka

2.2.7.16Checks whether connections to OpenSearch domains are using HTTPS1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: opensearch

2.2.7.17Check if Amazon OpenSearch Service nodes are encrypted end to end1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: opensearch

2.2.7.18Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: redshift

2.2.7.19Checks if S3 buckets have policies that require requests to use SSL/TLS1

Attributes

Section: 2.2.7: System components are configured and managed securely.
Service: s3

3.2.1: Storage of account data is kept to a minimum. 97

3.2.1.1Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: backup

3.2.1.2Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: backup

3.2.1.3Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: cloudwatch

3.2.1.4Checks if an Amazon Document DB cluster retention period is set to specific number of days1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: documentdb

3.2.1.5Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: dynamodb

3.2.1.6Checks if EBS volumes are attached to EC2 instances1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: ec2

3.2.1.7Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: ecr

3.2.1.8Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: s3

3.2.1.9Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured1

Attributes

Section: 3.2.1: Storage of account data is kept to a minimum.
Service: s3

3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. 97

3.3.1.1.1Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.1.1.2Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.1.1.3Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: cloudwatch

3.3.1.1.4Checks if an Amazon Document DB cluster retention period is set to specific number of days1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: documentdb

3.3.1.1.5Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: dynamodb

3.3.1.1.6Checks if EBS volumes are attached to EC2 instances1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: ec2

3.3.1.1.7Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: ecr

3.3.1.1.8Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.1.1.9Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured1

Attributes

Section: 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. 97

3.3.1.3.1Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.1.3.2Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.1.3.3Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: cloudwatch

3.3.1.3.4Checks if an Amazon Document DB cluster retention period is set to specific number of days1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: documentdb

3.3.1.3.5Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: dynamodb

3.3.1.3.6Checks if EBS volumes are attached to EC2 instances1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: ec2

3.3.1.3.7Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: ecr

3.3.1.3.8Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.1.3.9Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured1

Attributes

Section: 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.2: Sensitive authentication data (SAD) is not stored after authorization. 97

3.3.2.1Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.2.2Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.2.3Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: cloudwatch

3.3.2.4Checks if an Amazon Document DB cluster retention period is set to specific number of days1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: documentdb

3.3.2.5Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: dynamodb

3.3.2.6Checks if EBS volumes are attached to EC2 instances1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: ec2

3.3.2.7Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: ecr

3.3.2.8Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.2.9Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured1

Attributes

Section: 3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.3: Sensitive authentication data (SAD) is not stored after authorization. 97

3.3.3.1Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.3.2Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: backup

3.3.3.3Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: cloudwatch

3.3.3.4Checks if an Amazon Document DB cluster retention period is set to specific number of days1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: documentdb

3.3.3.5Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: dynamodb

3.3.3.6Checks if EBS volumes are attached to EC2 instances1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: ec2

3.3.3.7Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: ecr

3.3.3.8Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.3.3.9Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured1

Attributes

Section: 3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
Service: s3

3.5.1: Primary account number (PAN) is secured wherever it is stored. 3636

3.5.1.1Checks if all methods in Amazon API Gateway stages have cache enabled and cache encrypted1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: apigateway

3.5.1.2Checks if an Amazon Athena workgroup is encrypted at rest1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: athena

3.5.1.3Checks if a recovery point is encrypted1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: backup

3.5.1.4Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: cloudwatch

3.5.1.5Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: cloudtrail

3.5.1.6Checks if an AWS CodeBuild project has encryption enabled for all of its artifacts1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: codebuild

3.5.1.7Checks if the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: codebuild

3.5.1.8Checks if a AWS CodeBuild project configured with Amazon S3 Logs has encryption enabled for its logs1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: codebuild

3.5.1.9Checks if Amazon DynamoDB Accelerator (DAX) clusters are encrypted1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: dynamodb

3.5.1.10Checks if storage encryption is enabled for your Amazon DocumentDB (with MongoDB compatibility) clusters1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: documentdb

3.5.1.11Checks if Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS)1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: dynamodb

3.5.1.12Checks if the Amazon DynamoDB tables are encrypted and checks their status1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: dynamodb

3.5.1.13Checks if Amazon Elastic Block Store (EBS) encryption is enabled by default1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: ec2

3.5.1.14Checks if secrets are passed as container environment variables1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: ecs

3.5.1.15Checks if Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS)1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: efs

3.5.1.16Checks if Amazon EKS clusters are configured to have Kubernetes secrets encrypted using AWS KMS1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: eks

3.5.1.17Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: eks

3.5.1.18Checks if Amazon ElastiCache replication groups have encryption-at-rest enabled1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: elasticache

3.5.1.19Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains have encryption at rest configuration enabled1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: opensearch

3.5.1.20Checks if attached Amazon EBS volumes are encrypted and optionally are encrypted with a specified KMS key1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: ec2

3.5.1.21Checks if Amazon Kinesis streams are encrypted at rest with server-side encryption1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: kinesis

3.5.1.22Checks if storage encryption is enabled for your Amazon Neptune DB clusters1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: neptune

3.5.1.23Checks if an Amazon Neptune DB cluster has snapshots encrypted1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: neptune

3.5.1.24Checks if Amazon OpenSearch Service domains have encryption at rest configuration enabled1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: opensearch

3.5.1.25Checks if an Amazon Relational Database Service (Amazon RDS) cluster is encrypted at rest1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: rds

3.5.1.26Checks if Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: rds

3.5.1.27Checks if storage encryption is enabled for your Amazon Relational Database Service (Amazon RDS) DB instances1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: rds

3.5.1.28Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: redshift

3.5.1.29Checks if Amazon Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: redshift

3.5.1.30Checks if your Amazon S3 bucket either has the Amazon S3 default encryption enabled or that the Amazon S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.31Checks if the S3 buckets are encrypted with AWS Key Management Service (AWS KMS)1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.32Checks if AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker endpoint configuration1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: sagemaker

3.5.1.33Checks if an AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker notebook instance1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: sagemaker

3.5.1.34Checks if all secrets in AWS Secrets Manager are encrypted using the AWS managed key (aws/secretsmanager) or a customer managed key that was created in AWS Key Management Service (AWS KMS)1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: secretsmanager

3.5.1.35Checks if SNS topics are encrypted with AWS Key Management Service (AWS KMS)1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: sns

3.5.1.36Checks if KMS attestation events record enclaves running in debug mode, identified by all-zero PCR values1

Attributes

Section: 3.5.1: Primary account number (PAN) is secured wherever it is stored.
Service: kms

3.5.1.1: Primary account number (PAN) is secured wherever it is stored. 97

3.5.1.1.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: acm

3.5.1.1.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: acm

3.5.1.1.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: apigateway

3.5.1.1.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: cloudfront

3.5.1.1.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: elb

3.5.1.1.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: elb

3.5.1.1.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: iam

3.5.1.1.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: iam

3.5.1.1.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
Service: kms

3.5.1.3: Primary account number (PAN) is secured wherever it is stored. 3128

3.5.1.3.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: acm

3.5.1.3.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: acm

3.5.1.3.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: apigateway

3.5.1.3.4Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: backup

3.5.1.3.5Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: cloudfront

3.5.1.3.6Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: dms

3.5.1.3.7Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: documentdb

3.5.1.3.8Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: ec2

3.5.1.3.9Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: ecs

3.5.1.3.10Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: efs

3.5.1.3.11Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: efs

3.5.1.3.12Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: elb

3.5.1.3.13Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: elb

3.5.1.3.14Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: emr

3.5.1.3.15Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: iam

3.5.1.3.16Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: iam

3.5.1.3.17Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: kms

3.5.1.3.18Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: awslambda

3.5.1.3.19Checks if an Amazon Neptune manual DB cluster snapshot is public1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: neptune

3.5.1.3.20Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: rds

3.5.1.3.21Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: rds

3.5.1.3.22Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: redshift

3.5.1.3.23Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.24Checks if the required public access block settings are configured from account level1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.25Checks if the required public access block settings are configured at the account level1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.26Checks if S3 buckets are publicly accessible1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.27Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.28Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.29Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: s3

3.5.1.3.30Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: sagemaker

3.5.1.3.31Checks if AWS Systems Manager documents owned by the account are public1

Attributes

Section: 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
Service: ssm

3.6.1: Cryptographic keys used to protect stored account data are secured. 108

3.6.1.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: apigateway

3.6.1.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: cloudfront

3.6.1.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: kms

3.6.1.10Checks if KMS key policies used by Nitro Enclave workloads require enclave attestation condition keys1

Attributes

Section: 3.6.1: Cryptographic keys used to protect stored account data are secured.
Service: kms

3.6.1.2: Cryptographic keys used to protect stored account data are secured. 97

3.6.1.2.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.2.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.2.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: apigateway

3.6.1.2.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: cloudfront

3.6.1.2.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.2.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.2.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.2.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.2.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
Service: kms

3.6.1.3: Cryptographic keys used to protect stored account data are secured. 97

3.6.1.3.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.3.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.3.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: apigateway

3.6.1.3.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: cloudfront

3.6.1.3.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.3.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.3.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.3.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.3.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
Service: kms

3.6.1.4: Cryptographic keys used to protect stored account data are secured. 97

3.6.1.4.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.4.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: acm

3.6.1.4.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: apigateway

3.6.1.4.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: cloudfront

3.6.1.4.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.4.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: elb

3.6.1.4.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.4.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: iam

3.6.1.4.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
Service: kms

3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 119

3.7.1.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.1.2Checks if RSA certificates managed by AWS Certificate Manager (ACM) have a key length of at least '2048' bits1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.1.3Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.1.4Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: apigateway

3.7.1.5Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: cloudfront

3.7.1.6Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.1.7Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.1.8Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.1.9Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.1.10Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.1.11Checks if the PCR values authorized in KMS key policies match the customer-maintained golden values for expected enclave images1

Attributes

Section: 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 97

3.7.2.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.2.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.2.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: apigateway

3.7.2.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: cloudfront

3.7.2.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.2.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.2.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.2.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.2.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 108

3.7.4.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.4.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.4.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: apigateway

3.7.4.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: cloudfront

3.7.4.5Checks if automatic key rotation is enabled for each key and matches to the key ID of the customer created AWS KMS key1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.4.6Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.4.7Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.4.8Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.4.9Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.4.10Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 22

3.7.5.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.5.2Checks if automatic key rotation is enabled for each key and matches to the key ID of the customer created AWS KMS key1

Attributes

Section: 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 97

3.7.6.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.6.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.6.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: apigateway

3.7.6.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: cloudfront

3.7.6.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.6.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.6.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.6.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.6.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 97

3.7.7.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.7.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: acm

3.7.7.3Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: apigateway

3.7.7.4Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: cloudfront

3.7.7.5Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.7.6Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: elb

3.7.7.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.7.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: iam

3.7.7.9Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
Service: kms

4.2.1: PAN is protected with strong cryptography during transmission. 1918

4.2.1.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.2Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.3Checks if Amazon CloudFront distributions are encrypting traffic to custom origins1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.4Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.5Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: dynamodb

4.2.1.6Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: dms

4.2.1.7Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: dms

4.2.1.8Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: elasticache

4.2.1.9Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: opensearch

4.2.1.10Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.11Checks whether your Classic Load Balancer SSL listeners are using a custom policy1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.12Checks if your Classic Load Balancer SSL listeners use a predefined policy1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.13Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.14Checks if Amazon EMR clusters have Kerberos enabled0

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: emr

4.2.1.15Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: kafka

4.2.1.16Checks whether connections to OpenSearch domains are using HTTPS1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: opensearch

4.2.1.17Check if Amazon OpenSearch Service nodes are encrypted end to end1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: opensearch

4.2.1.18Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: redshift

4.2.1.19Checks if S3 buckets have policies that require requests to use SSL/TLS1

Attributes

Section: 4.2.1: PAN is protected with strong cryptography during transmission.
Service: s3

4.2.1.1: PAN is protected with strong cryptography during transmission. 2724

4.2.1.1.1Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: acm

4.2.1.1.2Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled0

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: acm

4.2.1.1.3Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.1.4Checks if a REST API stage uses an SSL certificate0

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: apigateway

4.2.1.1.5Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.1.6Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.1.7Checks if Amazon CloudFront distributions are encrypting traffic to custom origins1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.1.8Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: cloudfront

4.2.1.1.9Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: dynamodb

4.2.1.1.10Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: dms

4.2.1.1.11Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: dms

4.2.1.1.12Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elasticache

4.2.1.1.13Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: opensearch

4.2.1.1.14Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.1.15Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.1.16Checks whether your Classic Load Balancer SSL listeners are using a custom policy1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.1.17Checks if your Classic Load Balancer SSL listeners use a predefined policy1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.1.18Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: elb

4.2.1.1.19Checks if Amazon EMR clusters have Kerberos enabled0

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: emr

4.2.1.1.20Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: iam

4.2.1.1.21Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: iam

4.2.1.1.22Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: kms

4.2.1.1.23Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: kafka

4.2.1.1.24Checks whether connections to OpenSearch domains are using HTTPS1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: opensearch

4.2.1.1.25Check if Amazon OpenSearch Service nodes are encrypted end to end1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: opensearch

4.2.1.1.26Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: redshift

4.2.1.1.27Checks if S3 buckets have policies that require requests to use SSL/TLS1

Attributes

Section: 4.2.1.1: PAN is protected with strong cryptography during transmission.
Service: s3

5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. 3636

5.3.4.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: apigatewayv2

5.3.4.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: apigateway

5.3.4.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: apigateway

5.3.4.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: appsync

5.3.4.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: elb

5.3.4.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: cloudfront

5.3.4.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: cloudtrail

5.3.4.8Checks that there is at least one AWS CloudTrail trail defined with security best practices1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: cloudtrail

5.3.4.9For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: cloudtrail

5.3.4.10Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: codebuild

5.3.4.11Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: cloudwatch

5.3.4.12Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: dms

5.3.4.13Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: documentdb

5.3.4.14Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: ec2

5.3.4.15Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: ecs

5.3.4.16Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: eks

5.3.4.17Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: opensearch

5.3.4.18Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: elasticbeanstalk

5.3.4.19Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: elb

5.3.4.20Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: mq

5.3.4.21Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: mq

5.3.4.22For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: cloudtrail

5.3.4.23Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: neptune

5.3.4.24Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: networkfirewall

5.3.4.25Checks if Amazon OpenSearch Service domains have audit logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: opensearch

5.3.4.26Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: opensearch

5.3.4.27Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: rds

5.3.4.28Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: rds

5.3.4.29Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: redshift

5.3.4.30Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: redshift

5.3.4.31Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: route53

5.3.4.32Checks if logging is enabled for your S3 buckets1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: s3

5.3.4.33Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: stepfunctions

5.3.4.34Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: vpc

5.3.4.35Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: wafv2

5.3.4.36Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
Service: waf

6.3.3: Security vulnerabilities are identified and addressed. 119

6.3.3.1Checks if all of the specified applications are installed on the instance0

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: ec2

6.3.3.2Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: ssm

6.3.3.3Checks if ECS Fargate services is set to the latest platform version1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: ecs

6.3.3.4Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running the oldest supported version1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: eks

6.3.3.5Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running a supported Kubernetes version1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: eks

6.3.3.6Checks if Amazon ElastiCache for Redis clusters have auto minor version upgrades enabled1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: elasticache

6.3.3.7Checks if managed platform updates in an AWS Elastic Beanstalk environment is enabled1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: elasticbeanstalk

6.3.3.8Checks if the AWS Lambda function settings for runtime, role, timeout, and memory size match the expected values0

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: awslambda

6.3.3.9Checks if Amazon OpenSearch Service version updates are available but not installed1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: opensearch

6.3.3.10Checks if Amazon Relational Database Service (Amazon RDS) database instances are configured for automatic minor version upgrades1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: rds

6.3.3.11Checks if Amazon Redshift clusters have the specified maintenance settings1

Attributes

Section: 6.3.3: Security vulnerabilities are identified and addressed.
Service: redshift

6.4.1: Public-facing web applications are protected against attacks. 1413

6.4.1.1Checks if AWS WAF is enabled on Application Load Balancers (ALBs)1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: elbv2

6.4.1.2Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: apigateway

6.4.1.3Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: apigateway

6.4.1.4Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: cloudfront

6.4.1.5Checks if the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: apigateway

6.4.1.6Checks if the rule groups associate with the web ACL at the correct priority0

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: fms

6.4.1.7Checks if WAFv2 Rule Groups contain rules1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.1.8Checks if a WAFv2 Web ACL contains any WAF rules or WAF rule groups1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: wafv2

6.4.1.9Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.1.10Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.1.11Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.1.12Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.1.13Checks whether WAF regional rule contains conditions1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.1.14Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 6.4.1: Public-facing web applications are protected against attacks.
Service: waf

6.4.2: Public-facing web applications are protected against attacks. 1413

6.4.2.1Checks if AWS WAF is enabled on Application Load Balancers (ALBs)1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: elbv2

6.4.2.2Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: apigateway

6.4.2.3Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: apigateway

6.4.2.4Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: cloudfront

6.4.2.5Checks if the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: apigateway

6.4.2.6Checks if the rule groups associate with the web ACL at the correct priority0

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: fms

6.4.2.7Checks if WAFv2 Rule Groups contain rules1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.4.2.8Checks if a WAFv2 Web ACL contains any WAF rules or WAF rule groups1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: wafv2

6.4.2.9Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.4.2.10Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.4.2.11Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.4.2.12Checks if WAF Regional rule groups contain any rules1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.4.2.13Checks whether WAF regional rule contains conditions1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.4.2.14Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: 6.4.2: Public-facing web applications are protected against attacks.
Service: waf

6.5.5: Changes to all system components are managed securely. 20

6.5.5.1Checks if the deployment group for Lambda Compute Platform is not using the default deployment configuration0

Attributes

Section: 6.5.5: Changes to all system components are managed securely.
Service: codebuild

6.5.5.2Checks if the first deployment stage of AWS CodePipeline performs more than one deployment0

Attributes

Section: 6.5.5: Changes to all system components are managed securely.
Service: codepipeline

6.5.6: Changes to all system components are managed securely. 20

6.5.6.1Checks if the deployment group for Lambda Compute Platform is not using the default deployment configuration0

Attributes

Section: 6.5.6: Changes to all system components are managed securely.
Service: codebuild

6.5.6.2Checks if the first deployment stage of AWS CodePipeline performs more than one deployment0

Attributes

Section: 6.5.6: Changes to all system components are managed securely.
Service: codepipeline

7.2.1: Access to system components and data is appropriately defined and assigned. 3026

7.2.1.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: organizations

7.2.1.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: backup

7.2.1.3Checks if an AWS CodeBuild project environment has privileged mode enabled1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: codebuild

7.2.1.4Checks if custom Amazon EventBridge schema registries have a resource policy attached1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: eventbridge

7.2.1.5Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: ec2

7.2.1.6Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.1.7Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.1.8Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.1.9Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.10Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.11Checks if the inline policy feature is not in use0

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.12Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.13Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.14Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.15Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.16Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.17Checks if the root user access key is available1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.18Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.19Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.1.20Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: neptune

7.2.1.21Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: opensearch

7.2.1.22Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: rds

7.2.1.23Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: rds

7.2.1.24Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.1.25Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.1.26Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.1.27Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.1.28Checks if the Amazon SageMaker RootAccess setting is enabled for Amazon SageMaker notebook instances1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: sagemaker

7.2.1.29Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: shield

7.2.1.30Checks if KMS key policies contain an alternative authorization path granting the same operations without requiring enclave attestation1

Attributes

Section: 7.2.1: Access to system components and data is appropriately defined and assigned.
Service: kms

7.2.2: Access to system components and data is appropriately defined and assigned. 2925

7.2.2.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: organizations

7.2.2.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: backup

7.2.2.3Checks if an AWS CodeBuild project environment has privileged mode enabled1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: codebuild

7.2.2.4Checks if custom Amazon EventBridge schema registries have a resource policy attached1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: eventbridge

7.2.2.5Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: ec2

7.2.2.6Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.2.7Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.2.8Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.2.9Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.10Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.11Checks if the inline policy feature is not in use0

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.12Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.13Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.14Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.15Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.16Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.17Checks if the root user access key is available1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.18Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.19Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.2.20Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: neptune

7.2.2.21Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: opensearch

7.2.2.22Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: rds

7.2.2.23Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: rds

7.2.2.24Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.2.25Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.2.26Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.2.27Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.2.28Checks if the Amazon SageMaker RootAccess setting is enabled for Amazon SageMaker notebook instances1

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: sagemaker

7.2.2.29Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 7.2.2: Access to system components and data is appropriately defined and assigned.
Service: shield

7.2.3: Access to system components and data is appropriately defined and assigned. 99

7.2.3.1Checks if an AWS CodeBuild project environment has privileged mode enabled1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: codebuild

7.2.3.2Checks if custom Amazon EventBridge schema registries have a resource policy attached1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: eventbridge

7.2.3.3Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.3.4Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.3.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.3.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.3.7Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.3.8Checks if the root user access key is available1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.3.9Checks if the Amazon SageMaker RootAccess setting is enabled for Amazon SageMaker notebook instances1

Attributes

Section: 7.2.3: Access to system components and data is appropriately defined and assigned.
Service: sagemaker

7.2.4: Access to system components and data is appropriately defined and assigned. 32

7.2.4.1Checks whether IAM groups have at least one IAM user0

Attributes

Section: 7.2.4: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.4.2Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided1

Attributes

Section: 7.2.4: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.4.3Checks if AWS Secrets Manager secrets have been accessed within a specified number of days1

Attributes

Section: 7.2.4: Access to system components and data is appropriately defined and assigned.
Service: secretsmanager

7.2.5: Access to system components and data is appropriately defined and assigned. 2219

7.2.5.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: organizations

7.2.5.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: backup

7.2.5.3Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: ec2

7.2.5.4Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.5.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.7Checks if the inline policy feature is not in use0

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.8Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.9Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.10Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.11Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.12Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.13Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.14Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: neptune

7.2.5.15Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: opensearch

7.2.5.16Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: rds

7.2.5.17Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: rds

7.2.5.18Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.5.19Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.5.20Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.5.21Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.5.22Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 7.2.5: Access to system components and data is appropriately defined and assigned.
Service: shield

7.2.5.1: Access to system components and data is appropriately defined and assigned. 32

7.2.5.1.1Checks whether IAM groups have at least one IAM user0

Attributes

Section: 7.2.5.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.1.2Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided1

Attributes

Section: 7.2.5.1: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.5.1.3Checks if AWS Secrets Manager secrets have been accessed within a specified number of days1

Attributes

Section: 7.2.5.1: Access to system components and data is appropriately defined and assigned.
Service: secretsmanager

7.2.6: Access to system components and data is appropriately defined and assigned. 54

7.2.6.1Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.2.6: Access to system components and data is appropriately defined and assigned.
Service: ecs

7.2.6.2Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 7.2.6: Access to system components and data is appropriately defined and assigned.
Service: iam

7.2.6.3Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.2.6: Access to system components and data is appropriately defined and assigned.
Service: opensearch

7.2.6.4Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.2.6: Access to system components and data is appropriately defined and assigned.
Service: s3

7.2.6.5Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.2.6: Access to system components and data is appropriately defined and assigned.
Service: s3

7.3.1: Access to system components and data is managed via an access control system(s). 2219

7.3.1.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: organizations

7.3.1.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: backup

7.3.1.3Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: ec2

7.3.1.4Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: ecs

7.3.1.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.7Checks if the inline policy feature is not in use0

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.8Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.9Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.10Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.11Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.12Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.13Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.1.14Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: neptune

7.3.1.15Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: opensearch

7.3.1.16Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: rds

7.3.1.17Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: rds

7.3.1.18Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.1.19Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.1.20Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.1.21Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.1.22Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 7.3.1: Access to system components and data is managed via an access control system(s).
Service: shield

7.3.2: Access to system components and data is managed via an access control system(s). 2219

7.3.2.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: organizations

7.3.2.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: backup

7.3.2.3Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: ec2

7.3.2.4Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: ecs

7.3.2.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.7Checks if the inline policy feature is not in use0

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.8Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.9Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.10Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.11Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.12Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.13Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.2.14Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: neptune

7.3.2.15Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: opensearch

7.3.2.16Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: rds

7.3.2.17Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: rds

7.3.2.18Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.2.19Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.2.20Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.2.21Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.2.22Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 7.3.2: Access to system components and data is managed via an access control system(s).
Service: shield

7.3.3: Access to system components and data is managed via an access control system(s). 2219

7.3.3.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: organizations

7.3.3.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: backup

7.3.3.3Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: ec2

7.3.3.4Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: ecs

7.3.3.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.7Checks if the inline policy feature is not in use0

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.8Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.9Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.10Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.11Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.12Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.13Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: iam

7.3.3.14Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: neptune

7.3.3.15Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: opensearch

7.3.3.16Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: rds

7.3.3.17Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: rds

7.3.3.18Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.3.19Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.3.20Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.3.21Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: s3

7.3.3.22Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 7.3.3: Access to system components and data is managed via an access control system(s).
Service: shield

8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 52

8.2.1.1Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs0

Attributes

Section: 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.1.2Checks whether IAM groups have at least one IAM user0

Attributes

Section: 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.1.3Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.1.4Checks if the root user access key is available1

Attributes

Section: 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.1.5Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 118

8.2.2.1Checks if the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: codebuild

8.2.2.2Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs0

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.2.3Checks if secrets are passed as container environment variables1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ecs

8.2.2.4Checks whether IAM groups have at least one IAM user0

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.2.5Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.2.6Checks if the root user access key is available1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.2.7Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.2.8Checks if AWS Secrets Manager secret has rotation enabled1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: secretsmanager

8.2.2.9Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: secretsmanager

8.2.2.10Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: secretsmanager

8.2.2.11Checks if AWS Secrets Manager secrets have been accessed within a specified number of days1

Attributes

Section: 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: secretsmanager

8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 52

8.2.4.1Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs0

Attributes

Section: 8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.4.2Checks whether IAM groups have at least one IAM user0

Attributes

Section: 8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.4.3Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.4.4Checks if the root user access key is available1

Attributes

Section: 8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.4.5Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 52

8.2.5.1Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs0

Attributes

Section: 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.5.2Checks whether IAM groups have at least one IAM user0

Attributes

Section: 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.5.3Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.5.4Checks if the root user access key is available1

Attributes

Section: 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.5.5Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 32

8.2.6.1Checks whether IAM groups have at least one IAM user0

Attributes

Section: 8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.6.2Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided1

Attributes

Section: 8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.6.3Checks if AWS Secrets Manager secrets have been accessed within a specified number of days1

Attributes

Section: 8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: secretsmanager

8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 2219

8.2.7.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: organizations

8.2.7.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: backup

8.2.7.3Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.7.4Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ecs

8.2.7.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.7Checks if the inline policy feature is not in use0

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.8Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.9Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.10Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.11Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.12Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.13Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.7.14Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: neptune

8.2.7.15Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: opensearch

8.2.7.16Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: rds

8.2.7.17Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: rds

8.2.7.18Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.7.19Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.7.20Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.7.21Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.7.22Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: shield

8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 2522

8.2.8.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: organizations

8.2.8.2Checks whether only IMDSv2 is enabled1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: autoscaling

8.2.8.3Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: backup

8.2.8.4Checks if your Amazon Elastic Compute Cloud (Amazon EC2) instance metadata version is configured with Instance Metadata Service Version 2 (IMDSv2)1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.8.5Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.2.8.6Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ecs

8.2.8.7Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.8Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.9Checks if the inline policy feature is not in use0

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.10Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.11Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.12Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.13Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.14Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.15Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: iam

8.2.8.16Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: neptune

8.2.8.17Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: opensearch

8.2.8.18Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: rds

8.2.8.19Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: rds

8.2.8.20Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.8.21Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.8.22Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.8.23Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: s3

8.2.8.24Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: shield

8.2.8.25Checks if Nitro Enclave parent instances enforce IMDSv2, preventing unauthenticated retrieval of the credentials used to call KMS1

Attributes

Section: 8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
Service: ec2

8.3.2: Strong authentication for users and administrators is established and managed. 5453

8.3.2.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elb

8.3.2.2Checks if all methods in Amazon API Gateway stages have cache enabled and cache encrypted1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: apigateway

8.3.2.3Checks if an Amazon Athena workgroup is encrypted at rest1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: athena

8.3.2.4Checks if a recovery point is encrypted1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: backup

8.3.2.5Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: cloudfront

8.3.2.6Checks if Amazon CloudFront distributions are encrypting traffic to custom origins1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: cloudfront

8.3.2.7Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: cloudfront

8.3.2.8Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: cloudwatch

8.3.2.9Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: cloudtrail

8.3.2.10Checks if an AWS CodeBuild project has encryption enabled for all of its artifacts1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: codebuild

8.3.2.11Checks if the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: codebuild

8.3.2.12Checks if a AWS CodeBuild project configured with Amazon S3 Logs has encryption enabled for its logs1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: codebuild

8.3.2.13Checks if Amazon DynamoDB Accelerator (DAX) clusters are encrypted1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: dynamodb

8.3.2.14Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: dynamodb

8.3.2.15Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: dms

8.3.2.16Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: dms

8.3.2.17Checks if storage encryption is enabled for your Amazon DocumentDB (with MongoDB compatibility) clusters1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: documentdb

8.3.2.18Checks if Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS)1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: dynamodb

8.3.2.19Checks if the Amazon DynamoDB tables are encrypted and checks their status1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: dynamodb

8.3.2.20Checks if Amazon Elastic Block Store (EBS) encryption is enabled by default1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: ec2

8.3.2.21Checks if secrets are passed as container environment variables1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: ecs

8.3.2.22Checks if Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS)1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: efs

8.3.2.23Checks if Amazon EKS clusters are configured to have Kubernetes secrets encrypted using AWS KMS1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: eks

8.3.2.24Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: eks

8.3.2.25Checks if Amazon ElastiCache replication groups have encryption-at-rest enabled1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elasticache

8.3.2.26Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elasticache

8.3.2.27Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains have encryption at rest configuration enabled1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: opensearch

8.3.2.28Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: opensearch

8.3.2.29Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elb

8.3.2.30Checks whether your Classic Load Balancer SSL listeners are using a custom policy1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elb

8.3.2.31Checks if your Classic Load Balancer SSL listeners use a predefined policy1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elb

8.3.2.32Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: elb

8.3.2.33Checks if Amazon EMR clusters have Kerberos enabled0

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: emr

8.3.2.34Checks if attached Amazon EBS volumes are encrypted and optionally are encrypted with a specified KMS key1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: ec2

8.3.2.35Checks if Amazon Kinesis streams are encrypted at rest with server-side encryption1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: kinesis

8.3.2.36Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: kafka

8.3.2.37Checks if storage encryption is enabled for your Amazon Neptune DB clusters1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: neptune

8.3.2.38Checks if an Amazon Neptune DB cluster has snapshots encrypted1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: neptune

8.3.2.39Checks if Amazon OpenSearch Service domains have encryption at rest configuration enabled1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: opensearch

8.3.2.40Checks whether connections to OpenSearch domains are using HTTPS1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: opensearch

8.3.2.41Check if Amazon OpenSearch Service nodes are encrypted end to end1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: opensearch

8.3.2.42Checks if an Amazon Relational Database Service (Amazon RDS) cluster is encrypted at rest1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: rds

8.3.2.43Checks if Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: rds

8.3.2.44Checks if storage encryption is enabled for your Amazon Relational Database Service (Amazon RDS) DB instances1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: rds

8.3.2.45Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: redshift

8.3.2.46Checks if Amazon Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: redshift

8.3.2.47Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: redshift

8.3.2.48Checks if your Amazon S3 bucket either has the Amazon S3 default encryption enabled or that the Amazon S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.2.49Checks if S3 buckets have policies that require requests to use SSL/TLS1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.2.50Checks if the S3 buckets are encrypted with AWS Key Management Service (AWS KMS)1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.2.51Checks if AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker endpoint configuration1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: sagemaker

8.3.2.52Checks if an AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker notebook instance1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: sagemaker

8.3.2.53Checks if all secrets in AWS Secrets Manager are encrypted using the AWS managed key (aws/secretsmanager) or a customer managed key that was created in AWS Key Management Service (AWS KMS)1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.2.54Checks if SNS topics are encrypted with AWS Key Management Service (AWS KMS)1

Attributes

Section: 8.3.2: Strong authentication for users and administrators is established and managed.
Service: sns

8.3.4: Strong authentication for users and administrators is established and managed. 2219

8.3.4.1Checks if an AWS account is part of AWS Organizations1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: organizations

8.3.4.2Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: backup

8.3.4.3Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: ec2

8.3.4.4Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: ecs

8.3.4.5Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.6Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.7Checks if the inline policy feature is not in use0

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.8Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.9Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.10Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.11Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.12Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.13Checks if none of your AWS Identity and Access Management (IAM) users have policies attached1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.4.14Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: neptune

8.3.4.15Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: opensearch

8.3.4.16Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: rds

8.3.4.17Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: rds

8.3.4.18Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.4.19Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.4.20Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.4.21Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: s3

8.3.4.22Checks if the Shield Response Team (SRT) can access your AWS account0

Attributes

Section: 8.3.4: Strong authentication for users and administrators is established and managed.
Service: shield

8.3.5: Strong authentication for users and administrators is established and managed. 44

8.3.5.1Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge1

Attributes

Section: 8.3.5: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.5.2Checks if AWS Secrets Manager secret has rotation enabled1

Attributes

Section: 8.3.5: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.5.3Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule1

Attributes

Section: 8.3.5: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.5.4Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days1

Attributes

Section: 8.3.5: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.6: Strong authentication for users and administrators is established and managed. 11

8.3.6.1Checks if the account password policy for AWS Identity and Access Management (IAM) users meets the specified requirements indicated in the parameters1

Attributes

Section: 8.3.6: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.7: Strong authentication for users and administrators is established and managed. 44

8.3.7.1Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge1

Attributes

Section: 8.3.7: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.7.2Checks if AWS Secrets Manager secret has rotation enabled1

Attributes

Section: 8.3.7: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.7.3Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule1

Attributes

Section: 8.3.7: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.7.4Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days1

Attributes

Section: 8.3.7: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.9: Strong authentication for users and administrators is established and managed. 44

8.3.9.1Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge1

Attributes

Section: 8.3.9: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.9.2Checks if AWS Secrets Manager secret has rotation enabled1

Attributes

Section: 8.3.9: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.9.3Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule1

Attributes

Section: 8.3.9: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.9.4Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days1

Attributes

Section: 8.3.9: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.10.1: Strong authentication for users and administrators is established and managed. 44

8.3.10.1.1Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge1

Attributes

Section: 8.3.10.1: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.10.1.2Checks if AWS Secrets Manager secret has rotation enabled1

Attributes

Section: 8.3.10.1: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.10.1.3Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule1

Attributes

Section: 8.3.10.1: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.10.1.4Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days1

Attributes

Section: 8.3.10.1: Strong authentication for users and administrators is established and managed.
Service: secretsmanager

8.3.11: Strong authentication for users and administrators is established and managed. 52

8.3.11.1Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs0

Attributes

Section: 8.3.11: Strong authentication for users and administrators is established and managed.
Service: ec2

8.3.11.2Checks whether IAM groups have at least one IAM user0

Attributes

Section: 8.3.11: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.11.3Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity1

Attributes

Section: 8.3.11: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.11.4Checks if the root user access key is available1

Attributes

Section: 8.3.11: Strong authentication for users and administrators is established and managed.
Service: iam

8.3.11.5Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 8.3.11: Strong authentication for users and administrators is established and managed.
Service: iam

8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. 55

8.4.1.1Checks if the AWS Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled1

Attributes

Section: 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.1.2Checks if AWS multi-factor authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password1

Attributes

Section: 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.1.3Checks if your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials1

Attributes

Section: 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.1.4Checks if the root user of your AWS account requires multi-factor authentication for console sign-in1

Attributes

Section: 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.1.5Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: s3

8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. 55

8.4.2.1Checks if the AWS Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled1

Attributes

Section: 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.2.2Checks if AWS multi-factor authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password1

Attributes

Section: 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.2.3Checks if your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials1

Attributes

Section: 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.2.4Checks if the root user of your AWS account requires multi-factor authentication for console sign-in1

Attributes

Section: 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.2.5Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: s3

8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. 55

8.4.3.1Checks if the AWS Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled1

Attributes

Section: 8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.3.2Checks if AWS multi-factor authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password1

Attributes

Section: 8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.3.3Checks if your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials1

Attributes

Section: 8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.3.4Checks if the root user of your AWS account requires multi-factor authentication for console sign-in1

Attributes

Section: 8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: iam

8.4.3.5Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: 8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
Service: s3

8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. 55

8.6.3.1Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge1

Attributes

Section: 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
Service: iam

8.6.3.2Checks if the account password policy for AWS Identity and Access Management (IAM) users meets the specified requirements indicated in the parameters1

Attributes

Section: 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
Service: iam

8.6.3.3Checks if AWS Secrets Manager secret has rotation enabled1

Attributes

Section: 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
Service: secretsmanager

8.6.3.4Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule1

Attributes

Section: 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
Service: secretsmanager

8.6.3.5Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days1

Attributes

Section: 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
Service: secretsmanager

10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3736

10.2.1.1.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.1.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.1.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.1.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.1.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.1.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.1.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.1.8Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudwatch

10.2.1.1.9Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudwatch

10.2.1.1.10For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.1.11Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.1.12Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.1.13Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.1.14Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.1.15Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.1.16Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.1.17Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.1.18Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.1.19Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.1.20Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.1.21Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.1.22For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.1.23Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.1.24Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.1.25Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.1.26Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.1.27Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.1.28Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.1.29Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.1.30Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.1.31Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: securityhub

10.2.1.1.32Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: sns

10.2.1.1.33Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.1.34Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.1.35Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.1.36Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.1.37Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.2.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.2.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.2.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.2.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.2.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.2.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.2.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.2.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.2.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.2.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.2.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.2.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.2.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.2.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.2.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.2.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.2.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.2.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.2.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.2.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.2.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.2.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.2.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.2.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.2.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.2.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.2.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.2.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.2.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.2.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.2.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.3.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.3.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.3.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.3.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.3.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.3.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.3.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.3.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.3.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.3.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.3.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.3.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.3.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.3.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.3.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.3.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.3.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.3.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.3.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.3.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.3.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.3.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.3.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.3.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.3.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.3.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.3.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.3.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.3.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.3.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.3.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.4.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.4.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.4.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.4.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.4.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.4.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.4.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.4.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.4.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.4.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.4.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.4.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.4.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.4.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.4.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.4.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.4.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.4.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.4.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.4.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.4.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.4.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.4.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.4.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.4.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.4.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.4.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.4.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.4.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.4.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.4.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.5.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.5.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.5.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.5.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.5.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.5.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.5.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.5.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.5.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.5.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.5.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.5.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.5.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.5.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.5.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.5.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.5.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.5.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.5.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.5.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.5.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.5.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.5.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.5.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.5.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.5.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.5.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.5.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.5.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.5.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.5.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.6.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.6.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.6.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.6.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.6.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.6.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.6.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.6.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.6.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.6.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.6.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.6.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.6.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.6.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.6.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.6.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.6.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.6.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.6.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.6.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.6.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.6.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.6.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.6.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.6.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.6.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.6.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.6.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.6.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.6.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.6.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.1.7.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.1.7.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.7.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.1.7.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.1.7.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.7.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.1.7.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.7.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.7.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.1.7.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.1.7.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.1.7.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.1.7.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.1.7.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.1.7.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.1.7.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.1.7.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.7.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.1.7.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.1.7.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.1.7.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.1.7.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.7.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.1.7.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.7.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.1.7.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.1.7.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.1.7.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.1.7.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.1.7.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.1.7.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3131

10.2.2.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigatewayv2

10.2.2.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.2.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: apigateway

10.2.2.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: appsync

10.2.2.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.2.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudfront

10.2.2.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.2.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.2.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: codebuild

10.2.2.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: dms

10.2.2.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: documentdb

10.2.2.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ec2

10.2.2.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: ecs

10.2.2.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: eks

10.2.2.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elasticbeanstalk

10.2.2.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: elb

10.2.2.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.2.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: mq

10.2.2.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: cloudtrail

10.2.2.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: neptune

10.2.2.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: networkfirewall

10.2.2.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.2.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: rds

10.2.2.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.2.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: redshift

10.2.2.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: route53

10.2.2.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: s3

10.2.2.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: stepfunctions

10.2.2.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: vpc

10.2.2.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: wafv2

10.2.2.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
Service: waf

10.3.1: Audit logs are protected from destruction and unauthorized modifications. 3131

10.3.1.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: apigatewayv2

10.3.1.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: apigateway

10.3.1.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: apigateway

10.3.1.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: appsync

10.3.1.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: elb

10.3.1.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudfront

10.3.1.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.1.8For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.1.9Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: codebuild

10.3.1.10Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: dms

10.3.1.11Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: documentdb

10.3.1.12Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: ec2

10.3.1.13Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: ecs

10.3.1.14Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: eks

10.3.1.15Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: elasticbeanstalk

10.3.1.16Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: elb

10.3.1.17Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: mq

10.3.1.18Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: mq

10.3.1.19For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.1.20Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: neptune

10.3.1.21Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: networkfirewall

10.3.1.22Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.1.23Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.1.24Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: redshift

10.3.1.25Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: redshift

10.3.1.26Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: route53

10.3.1.27Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.1.28Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: stepfunctions

10.3.1.29Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: vpc

10.3.1.30Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: wafv2

10.3.1.31Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
Service: waf

10.3.2: Audit logs are protected from destruction and unauthorized modifications. 2625

10.3.2.1Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: backup

10.3.2.2Checks that there is at least one AWS CloudTrail trail defined with security best practices1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.2.3Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudwatch

10.3.2.4Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.2.5Checks if AWS CloudTrail creates a signed digest file with logs1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.2.6Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: dms

10.3.2.7Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: documentdb

10.3.2.8Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: ec2

10.3.2.9Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: ecs

10.3.2.10Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: efs

10.3.2.11Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: efs

10.3.2.12Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: emr

10.3.2.13Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: awslambda

10.3.2.14Checks if an Amazon Neptune manual DB cluster snapshot is public1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: neptune

10.3.2.15Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.2.16Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.2.17Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: redshift

10.3.2.18Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.19Checks if the required public access block settings are configured from account level1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.20Checks if the required public access block settings are configured at the account level1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.21Checks if S3 buckets are publicly accessible1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.22Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.23Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.24Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.2.25Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: sagemaker

10.3.2.26Checks if AWS Systems Manager documents owned by the account are public1

Attributes

Section: 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
Service: ssm

10.3.3: Audit logs are protected from destruction and unauthorized modifications. 2422

10.3.3.1Checks if Amazon Aurora DB clusters are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.3.2Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: backup

10.3.3.3Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: backup

10.3.3.4Checks that there is at least one AWS CloudTrail trail defined with security best practices1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.3.5Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudwatch

10.3.3.6Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.3.7Checks if AWS CloudTrail creates a signed digest file with logs1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.3.8Checks if RDS DB instances have backups enabled1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.3.9Checks whether Amazon DynamoDB table is present in AWS Backup Plans1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: dynamodb

10.3.3.10Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: dynamodb

10.3.3.11Checks if Amazon DynamoDB tables are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: dynamodb

10.3.3.12Check if Amazon Elastic Block Store (Amazon EBS) volumes are added in backup plans of AWS Backup1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: ec2

10.3.3.13Checks if Amazon Elastic Block Store (Amazon EBS) volumes are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: ec2

10.3.3.14Checks if Amazon Elastic Compute Cloud (Amazon EC2) instances are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: ec2

10.3.3.15Checks if Amazon Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: efs

10.3.3.16Checks if Amazon Elastic File System (Amazon EFS) File Systems are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: efs

10.3.3.17Check if the Amazon ElastiCache Redis clusters have automatic backup turned on1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: elasticache

10.3.3.18Checks if Amazon FSx File Systems are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: fsx

10.3.3.19Checks if an Amazon Neptune DB cluster retention period is set to specific number of days1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: neptune

10.3.3.20Checks if Amazon Relational Database Service (Amazon RDS) databases are present in AWS Backup plans1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.3.21Checks if Amazon Relational Database Service (Amazon RDS) instances are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: rds

10.3.3.22Checks that Amazon Redshift automated snapshots are enabled for clusters1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: redshift

10.3.3.23Checks if S3 buckets are publicly accessible1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.3.24Checks if Amazon Simple Storage Service (Amazon S3) buckets are protected by a backup plan1

Attributes

Section: 10.3.3: Audit logs are protected from destruction and unauthorized modifications.
Service: ec2

10.3.4: Audit logs are protected from destruction and unauthorized modifications. 99

10.3.4.1Checks if CloudFront distribution with Amazon S3 Origin type has origin access identity configured1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudfront

10.3.4.2Checks if an Amazon CloudFront distribution with an Amazon Simple Storage Service (Amazon S3) Origin type has origin access control (OAC) enabled1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudfront

10.3.4.3Checks that there is at least one AWS CloudTrail trail defined with security best practices1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.4.4Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudwatch

10.3.4.5Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.4.6Checks if AWS CloudTrail creates a signed digest file with logs1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: cloudtrail

10.3.4.7Checks if the S3 bucket has lock enabled, by default1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.4.8Checks if S3 buckets are publicly accessible1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.3.4.9Checks if versioning is enabled for your S3 buckets1

Attributes

Section: 10.3.4: Audit logs are protected from destruction and unauthorized modifications.
Service: s3

10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. 76

10.4.1.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: apigateway

10.4.1.2Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: cloudwatch

10.4.1.3Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: ec2

10.4.1.4Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: securityhub

10.4.1.5Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: sns

10.4.1.6Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: wafv2

10.4.1.7Checks if KMS attestation activity originates from enclave images whose PCR values do not match any known record1

Attributes

Section: 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: kms

10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. 76

10.4.1.1.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: apigateway

10.4.1.1.2Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: cloudwatch

10.4.1.1.3Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs1

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: cloudtrail

10.4.1.1.4Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: ec2

10.4.1.1.5Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: securityhub

10.4.1.1.6Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: sns

10.4.1.1.7Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: wafv2

10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. 76

10.4.2.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: apigateway

10.4.2.2Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: cloudwatch

10.4.2.3Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: cloudwatch

10.4.2.4Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: ec2

10.4.2.5Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: securityhub

10.4.2.6Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: sns

10.4.2.7Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: wafv2

10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity. 11

10.4.3.1Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.
Service: cloudwatch

10.5.1: Audit log history is retained and available for analysis. 1311

10.5.1.1Checks if a backup plan has a backup rule that satisfies the required frequency and retention period0

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: backup

10.5.1.2Checks if a recovery point expires no earlier than after the specified period0

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: backup

10.5.1.3Checks that there is at least one AWS CloudTrail trail defined with security best practices1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: cloudtrail

10.5.1.4Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: cloudwatch

10.5.1.5Checks if an Amazon Document DB cluster retention period is set to specific number of days1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: documentdb

10.5.1.6Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: dynamodb

10.5.1.7Checks if EBS volumes are attached to EC2 instances1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: ec2

10.5.1.8Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: ecr

10.5.1.9Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: opensearch

10.5.1.10Checks if Amazon OpenSearch Service domains have audit logging enabled1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: opensearch

10.5.1.11Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: opensearch

10.5.1.12Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: s3

10.5.1.13Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured1

Attributes

Section: 10.5.1: Audit log history is retained and available for analysis.
Service: s3

10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. 4240

10.6.3.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: apigatewayv2

10.6.3.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: apigateway

10.6.3.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: apigateway

10.6.3.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: appsync

10.6.3.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: elb

10.6.3.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: cloudfront

10.6.3.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: cloudtrail

10.6.3.8Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: cloudwatch

10.6.3.9Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: cloudwatch

10.6.3.10For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: cloudtrail

10.6.3.11Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: codebuild

10.6.3.12Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: dms

10.6.3.13Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: documentdb

10.6.3.14Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: ec2

10.6.3.15Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: ec2

10.6.3.16Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: ecs

10.6.3.17Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: ecs

10.6.3.18Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: eks

10.6.3.19Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: elasticbeanstalk

10.6.3.20Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: elb

10.6.3.21Checks whether IAM users are members of at least one IAM group0

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: iam

10.6.3.22Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: mq

10.6.3.23Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: mq

10.6.3.24For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: cloudtrail

10.6.3.25Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: neptune

10.6.3.26Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: networkfirewall

10.6.3.27Checks if Amazon OpenSearch Service domains have fine-grained access control enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: opensearch

10.6.3.28Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: rds

10.6.3.29Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: rds

10.6.3.30Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: redshift

10.6.3.31Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: redshift

10.6.3.32Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: route53

10.6.3.33Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: s3

10.6.3.34Checks if logging is enabled for your S3 buckets1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: s3

10.6.3.35Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: s3

10.6.3.36Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: securityhub

10.6.3.37Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: sns

10.6.3.38Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: stepfunctions

10.6.3.39Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: vpc

10.6.3.40Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: wafv2

10.6.3.41Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: wafv2

10.6.3.42Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
Service: waf

10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. 86

10.7.1.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: apigateway

10.7.1.2Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: cloudformation

10.7.1.3Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: cloudwatch

10.7.1.4Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: cloudwatch

10.7.1.5Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: ec2

10.7.1.6Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: securityhub

10.7.1.7Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: sns

10.7.1.8Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: wafv2

10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. 86

10.7.2.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: apigateway

10.7.2.2Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: cloudformation

10.7.2.3Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: cloudwatch

10.7.2.4Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: cloudwatch

10.7.2.5Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: ec2

10.7.2.6Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: securityhub

10.7.2.7Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: sns

10.7.2.8Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
Service: wafv2

11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 32

11.3.1.1Checks if all of the specified applications are installed on the instance0

Attributes

Section: 11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ec2

11.3.1.2Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance1

Attributes

Section: 11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ssm

11.3.1.3Checks if a private Amazon Elastic Container Registry (Amazon ECR) repository has image scanning enabled1

Attributes

Section: 11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ecr

11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 21

11.3.1.1.1Checks if all of the specified applications are installed on the instance0

Attributes

Section: 11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ec2

11.3.1.1.2Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance1

Attributes

Section: 11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ssm

11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 11

11.3.1.2.1Checks if a private Amazon Elastic Container Registry (Amazon ECR) repository has image scanning enabled1

Attributes

Section: 11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ecr

11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 32

11.3.1.3.1Checks if all of the specified applications are installed on the instance0

Attributes

Section: 11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ec2

11.3.1.3.2Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance1

Attributes

Section: 11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ssm

11.3.1.3.3Checks if a private Amazon Elastic Container Registry (Amazon ECR) repository has image scanning enabled1

Attributes

Section: 11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
Service: ecr

11.5.1: Network intrusions and unexpected file changes are detected and responded to. 22

11.5.1.1Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection1

Attributes

Section: 11.5.1: Network intrusions and unexpected file changes are detected and responded to.
Service: shield

11.5.1.2Checks if Amazon GuardDuty is enabled in your AWS account and AWS Region1

Attributes

Section: 11.5.1: Network intrusions and unexpected file changes are detected and responded to.
Service: guardduty

11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. 22

11.5.1.1.1Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection1

Attributes

Section: 11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
Service: shield

11.5.1.1.2Checks if Amazon GuardDuty is enabled in your AWS account and AWS Region1

Attributes

Section: 11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
Service: guardduty

11.5.2: Network intrusions and unexpected file changes are detected and responded to. 64

11.5.2.1Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: 11.5.2: Network intrusions and unexpected file changes are detected and responded to.
Service: cloudformation

11.5.2.2Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 11.5.2: Network intrusions and unexpected file changes are detected and responded to.
Service: cloudwatch

11.5.2.3Checks whether CloudWatch alarms with the given metric name have the specified settings1

Attributes

Section: 11.5.2: Network intrusions and unexpected file changes are detected and responded to.
Service: cloudwatch

11.5.2.4Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs1

Attributes

Section: 11.5.2: Network intrusions and unexpected file changes are detected and responded to.
Service: cloudtrail

11.5.2.5Checks if Amazon S3 Events Notifications are enabled on an S3 bucket1

Attributes

Section: 11.5.2: Network intrusions and unexpected file changes are detected and responded to.
Service: s3

11.5.2.6Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 11.5.2: Network intrusions and unexpected file changes are detected and responded to.
Service: sns

11.6.1: Unauthorized changes on payment pages are detected and responded to. 64

11.6.1.1Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: 11.6.1: Unauthorized changes on payment pages are detected and responded to.
Service: cloudformation

11.6.1.2Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 11.6.1: Unauthorized changes on payment pages are detected and responded to.
Service: cloudwatch

11.6.1.3Checks whether CloudWatch alarms with the given metric name have the specified settings1

Attributes

Section: 11.6.1: Unauthorized changes on payment pages are detected and responded to.
Service: cloudwatch

11.6.1.4Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs1

Attributes

Section: 11.6.1: Unauthorized changes on payment pages are detected and responded to.
Service: cloudtrail

11.6.1.5Checks if Amazon S3 Events Notifications are enabled on an S3 bucket1

Attributes

Section: 11.6.1: Unauthorized changes on payment pages are detected and responded to.
Service: s3

11.6.1.6Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 11.6.1: Unauthorized changes on payment pages are detected and responded to.
Service: sns

12.4.2.1: PCI DSS compliance is managed. 11

12.4.2.1.1Checks if AWS Service Catalog shares portfolios to an organization (a collection of AWS accounts treated as a single unit) when integration is enabled with AWS Organizations1

Attributes

Section: 12.4.2.1: PCI DSS compliance is managed.
Service: servicecatalog

12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. 64

12.10.5.1Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: 12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Service: cloudformation

12.10.5.2Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: 12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Service: cloudwatch

12.10.5.3Checks whether CloudWatch alarms with the given metric name have the specified settings1

Attributes

Section: 12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Service: cloudwatch

12.10.5.4Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs1

Attributes

Section: 12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Service: cloudtrail

12.10.5.5Checks if Amazon S3 Events Notifications are enabled on an S3 bucket1

Attributes

Section: 12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Service: s3

12.10.5.6Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: 12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Service: sns

A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. 2221

A1.1.2.1Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: backup

A1.1.2.2Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: dms

A1.1.2.3Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: documentdb

A1.1.2.4Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.2.5Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: ecs

A1.1.2.6Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: efs

A1.1.2.7Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: efs

A1.1.2.8Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: emr

A1.1.2.9Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: awslambda

A1.1.2.10Checks if an Amazon Neptune manual DB cluster snapshot is public1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: neptune

A1.1.2.11Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: rds

A1.1.2.12Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: rds

A1.1.2.13Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: redshift

A1.1.2.14Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.15Checks if the required public access block settings are configured from account level1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.16Checks if the required public access block settings are configured at the account level1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.17Checks if S3 buckets are publicly accessible1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.18Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.19Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.20Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.2.21Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: sagemaker

A1.1.2.22Checks if AWS Systems Manager documents owned by the account are public1

Attributes

Section: A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
Service: ssm

A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. 4642

A1.1.3.1Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType0

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: apigateway

A1.1.3.2Checks if a REST API stage uses an SSL certificate0

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: apigateway

A1.1.3.3Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: apigateway

A1.1.3.4Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: cloudfront

A1.1.3.5Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: cloudfront

A1.1.3.6Checks if the Bitbucket source repository URL contains sign-in credentials or not1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: codebuild

A1.1.3.7Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: dms

A1.1.3.8Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: documentdb

A1.1.3.9Checks if the AWS Client VPN authorization rules authorizes connection access for all clients1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.10Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance0

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.11Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.12Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: eks

A1.1.3.13Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)0

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: opensearch

A1.1.3.14Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: elb

A1.1.3.15Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: elb

A1.1.3.16Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: emr

A1.1.3.17For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.18Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: vpc

A1.1.3.19Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: awslambda

A1.1.3.20Checks if a Lambda function is allowed access to a virtual private cloud (VPC)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: awslambda

A1.1.3.21Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.22Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: networkfirewall

A1.1.3.23Check AWS Network Firewall policy is associated with stateful OR stateless rule groups1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: networkfirewall

A1.1.3.24Checks if a Stateless Network Firewall Rule Group contains rules1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: networkfirewall

A1.1.3.25Checks if there are public routes in the route table to an Internet gateway (IGW)0

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: vpc

A1.1.3.26Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: opensearch

A1.1.3.27Checks if there are any Amazon Relational Database Service (Amazon RDS) DB security groups that are not the default DB security group1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: rds

A1.1.3.28Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: rds

A1.1.3.29Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: redshift

A1.1.3.30Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.3.31Checks if the required public access block settings are configured from account level1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.3.32Checks if the required public access block settings are configured at the account level1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.3.33Checks if S3 buckets are publicly accessible1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.3.34Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.3.35Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: s3

A1.1.3.36Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: sagemaker

A1.1.3.37Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: sagemaker

A1.1.3.38Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)2

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: vpc

A1.1.3.39Checks if there are unused network access control lists (network ACLs)1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.40Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: ec2

A1.1.3.41Checks if an AWS WAF Classic rule group contains any rules1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: waf

A1.1.3.42Checks if an AWS WAF global rule contains any conditions1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: waf

A1.1.3.43Checks whether a WAF Global Web ACL contains any WAF rules or rule groups1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: waf

A1.1.3.44Checks if WAF Regional rule groups contain any rules1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: waf

A1.1.3.45Checks whether WAF regional rule contains conditions1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: waf

A1.1.3.46Checks if a WAF regional Web ACL contains any WAF rules or rule groups1

Attributes

Section: A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
Service: waf

A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. 3636

A1.2.1.1Checks if Amazon API Gateway V2 stages have access logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: apigatewayv2

A1.2.1.2Checks if all methods in Amazon API Gateway stages have logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: apigateway

A1.2.1.3Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: apigateway

A1.2.1.4Checks if an AWS AppSync API has logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: appsync

A1.2.1.5Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: elb

A1.2.1.6Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudfront

A1.2.1.7Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudtrail

A1.2.1.8Checks that there is at least one AWS CloudTrail trail defined with security best practices1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudtrail

A1.2.1.9Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudwatch

A1.2.1.10For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudtrail

A1.2.1.11Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudtrail

A1.2.1.12Checks if AWS CloudTrail creates a signed digest file with logs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudtrail

A1.2.1.13Checks if an AWS CodeBuild project environment has at least one log option enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: codebuild

A1.2.1.14Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: dms

A1.2.1.15Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: documentdb

A1.2.1.16Checks if AWS Client VPN endpoint has client connection logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: ec2

A1.2.1.17Checks if logConfiguration is set on active ECS Task Definitions1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: ecs

A1.2.1.18Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: eks

A1.2.1.19Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: elasticbeanstalk

A1.2.1.20Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: elb

A1.2.1.21Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: mq

A1.2.1.22Checks if an Amazon MQ broker has CloudWatch audit logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: mq

A1.2.1.23For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: cloudtrail

A1.2.1.24Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: neptune

A1.2.1.25Checks if AWS Network Firewall firewalls have logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: networkfirewall

A1.2.1.26Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: rds

A1.2.1.27Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: rds

A1.2.1.28Checks if Amazon Redshift clusters are logging audits to a specific bucket1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: redshift

A1.2.1.29Checks if Amazon Redshift clusters have the specified settings1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: redshift

A1.2.1.30Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: route53

A1.2.1.31Checks if S3 buckets are publicly accessible1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: s3

A1.2.1.32Checks if logging is enabled for your S3 buckets1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: s3

A1.2.1.33Checks if AWS Step Functions machine has logging enabled1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: stepfunctions

A1.2.1.34Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: vpc

A1.2.1.35Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: wafv2

A1.2.1.36Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)1

Attributes

Section: A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: waf

A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers. 11

A1.2.3.1Checks if you have provided security contact information for your AWS account contacts1

Attributes

Section: A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.
Service: account

A3.2.5.1: PCI DSS scope is documented and validated. 22

A3.2.5.1.1Checks if automated sensitive data discovery is enabled for Amazon Macie1

Attributes

Section: A3.2.5.1: PCI DSS scope is documented and validated.
Service: macie

A3.2.5.1.2Checks if Amazon Macie is enabled in your account per region1

Attributes

Section: A3.2.5.1: PCI DSS scope is documented and validated.
Service: macie

A3.2.5.2: PCI DSS scope is documented and validated. 22

A3.2.5.1.3Checks if automated sensitive data discovery is enabled for Amazon Macie1

Attributes

Section: A3.2.5.2: PCI DSS scope is documented and validated.
Service: macie

A3.2.5.1.4Checks if Amazon Macie is enabled in your account per region1

Attributes

Section: A3.2.5.2: PCI DSS scope is documented and validated.
Service: macie

A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. 119

A3.3.1.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: apigateway

A3.3.1.2Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: cloudformation

A3.3.1.3Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: cloudwatch

A3.3.1.4Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: cloudwatch

A3.3.1.5Checks whether CloudWatch alarms with the given metric name have the specified settings1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: cloudwatch

A3.3.1.6Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: cloudtrail

A3.3.1.7Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: ec2

A3.3.1.8Checks if Amazon S3 Events Notifications are enabled on an S3 bucket1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: s3

A3.3.1.9Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: securityhub

A3.3.1.10Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: sns

A3.3.1.11Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
Service: wafv2

A3.4.1: Logical access to the cardholder data environment is controlled and managed. 2523

A3.4.1.1Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points0

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: backup

A3.4.1.2Checks if AWS Database Migration Service (AWS DMS) replication instances are public1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: dms

A3.4.1.3Checks if Amazon DocumentDB manual cluster snapshots are public1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: documentdb

A3.4.1.4Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: ec2

A3.4.1.5Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: ecs

A3.4.1.6Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: efs

A3.4.1.7Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: efs

A3.4.1.8Checks if an account with Amazon EMR has block public access settings enabled1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: emr

A3.4.1.9Checks whether IAM groups have at least one IAM user0

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: iam

A3.4.1.10Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: iam

A3.4.1.11Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: awslambda

A3.4.1.12Checks if an Amazon Neptune manual DB cluster snapshot is public1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: neptune

A3.4.1.13Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: rds

A3.4.1.14Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: rds

A3.4.1.15Checks if Amazon Redshift clusters are not publicly accessible1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: redshift

A3.4.1.16Checks if Amazon S3 access points have block public access settings enabled1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.17Checks if the required public access block settings are configured from account level1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.18Checks if the required public access block settings are configured at the account level1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.19Checks if S3 buckets are publicly accessible1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.20Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.21Checks if your Amazon S3 buckets do not allow public read access1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.22Checks if your Amazon S3 buckets do not allow public write access1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: s3

A3.4.1.23Checks if direct internet access is disabled for an Amazon SageMaker notebook instance1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: sagemaker

A3.4.1.24Checks if AWS Secrets Manager secrets have been accessed within a specified number of days1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: secretsmanager

A3.4.1.25Checks if AWS Systems Manager documents owned by the account are public1

Attributes

Section: A3.4.1: Logical access to the cardholder data environment is controlled and managed.
Service: ssm

A3.5.1: Suspicious events are identified and responded to. 119

A3.5.1.1Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: apigateway

A3.5.1.2Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic0

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: cloudformation

A3.5.1.3Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: cloudwatch

A3.5.1.4Checks if a resource type has a CloudWatch alarm for the named metric1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: cloudwatch

A3.5.1.5Checks whether CloudWatch alarms with the given metric name have the specified settings1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: cloudwatch

A3.5.1.6Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: cloudtrail

A3.5.1.7Checks if detailed monitoring is enabled for EC2 instances1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: ec2

A3.5.1.8Checks if Amazon S3 Events Notifications are enabled on an S3 bucket1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: s3

A3.5.1.9Checks if AWS Security Hub is enabled for an AWS Account1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: securityhub

A3.5.1.10Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints0

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: sns

A3.5.1.11Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled1

Attributes

Section: A3.5.1: Suspicious events are identified and responded to.
Service: wafv2