Operational Best Practices for NIST 800-53 rev 5

Conformance packs provide a general-purpose compliance framework designed to enable you to create security, operational or cost-optimization governance checks using managed or custom AWS Config rules and AWS Config remediation actions. Conformance Packs, as sample templates, are not designed to fully ensure compliance with a specific governance or compliance standard. You are responsible for making your own assessment of whether your use of the Services meets applicable legal and regulatory requirements.

The following provides a sample mapping between the NIST 800-53 and AWS managed Config rules. Each Config rule applies to a specific AWS resource, and relates to one or more NIST 800-53 controls. A NIST 800-53 control can be related to multiple Config rules. Refer to the table below for more detail and guidance related to these mappings.

Control ID	Control Description	AWS Config Rule	Guidance
AC-2(1)	Account Management | Automated System Account Management	ecs-containers-readonly-access	Enabling read only access to Amazon Elastic Container Service (ECS) containers can assist in adhering to the principal of least privilege. This option can reduces attack vectors as the container instance’s filesystem cannot be modified unless it has explicit read-write permissions.
AC-2(1)	Account Management | Automated System Account Management	ecs-task-definition-user-for-host-mode-check	If a task definition has elevated privileges it is because the customer has specifically opted-in to those configurations. This control checks for unexpected privilege escalation when a task definition has host networking enabled but the customer has not opted-in to elevated privileges.
AC-2(1)	Account Management | Automated System Account Management	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-2(1)	Account Management | Automated System Account Management	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-2(1)	Account Management | Automated System Account Management	access-keys-rotated	The credentials are audited for authorized devices, users, and processes by ensuring IAM access keys are rotated as specified by the organizational policy. Changing the access keys on a regular schedule is a security best practice. It shortens the period an access key is active and reduces the business impact if the keys are compromised. This rule requires an access key rotation value (Config Default: 90). The actual value should reflect your organization's policies.
AC-2(1)	Account Management | Automated System Account Management	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-2(1)	Account Management | Automated System Account Management	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-2(1)	Account Management | Automated System Account Management	iam-password-policy	The identities and the credentials are issued, managed, and verified based on an organizational IAM password policy. They meet or exceed requirements as stated by NIST SP 800-63 and the AWS Foundational Security Best Practices standard for password strength. This rule allows you to optionally set RequireUppercaseCharacters (AWS Foundational Security Best Practices value: true), RequireLowercaseCharacters (AWS Foundational Security Best Practices value: true), RequireSymbols (AWS Foundational Security Best Practices value: true), RequireNumbers (AWS Foundational Security Best Practices value: true), MinimumPasswordLength (AWS Foundational Security Best Practices value: 14), PasswordReusePrevention (AWS Foundational Security Best Practices value: 24), and MaxPasswordAge (AWS Foundational Security Best Practices value: 90) for your IAM Password Policy. The actual values should reflect your organization's policies.
AC-2(1)	Account Management | Automated System Account Management	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-2(1)	Account Management | Automated System Account Management	iam-root-access-key-check	Access to systems and assets can be controlled by checking that the root user does not have access keys attached to their AWS Identity and Access Management (IAM) role. Ensure that the root access keys are deleted. Instead, create and use role-based AWS accounts to help to incorporate the principle of least functionality.
AC-2(1)	Account Management | Automated System Account Management	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-2(1)	Account Management | Automated System Account Management	iam-user-mfa-enabled	Enable this rule to restrict access to resources in the AWS Cloud. This rule ensures multi-factor authentication (MFA) is enabled for all users. MFA adds an extra layer of protection on top of sign-in credentials. Reduce the incidents of compromised accounts by requiring MFA for users.
AC-2(1)	Account Management | Automated System Account Management	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-2(1)	Account Management | Automated System Account Management	mfa-enabled-for-iam-console-access	Manage access to resources in the AWS Cloud by ensuring that MFA is enabled for all AWS Identity and Access Management (IAM) users that have a console password. MFA adds an extra layer of protection on top of sign-in credentials. By requiring MFA for users, you can reduce incidents of compromised accounts and keep sensitive data from being accessed by unauthorized users.
AC-2(1)	Account Management | Automated System Account Management	root-account-hardware-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring hardware MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
AC-2(1)	Account Management | Automated System Account Management	root-account-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
AC-2(1)	Account Management | Automated System Account Management	secretsmanager-rotation-enabled-check	This rule ensures AWS Secrets Manager secrets have rotation enabled. Rotating secrets on a regular schedule can shorten the period a secret is active, and potentially reduce the business impact if the secret is compromised.
AC-2(3)	Account Management | Disable Accounts	access-keys-rotated	The credentials are audited for authorized devices, users, and processes by ensuring IAM access keys are rotated as specified by the organizational policy. Changing the access keys on a regular schedule is a security best practice. It shortens the period an access key is active and reduces the business impact if the keys are compromised. This rule requires an access key rotation value (Config Default: 90). The actual value should reflect your organization's policies.
AC-2(3)	Account Management | Disable Accounts	iam-password-policy	The identities and the credentials are issued, managed, and verified based on an organizational IAM password policy. They meet or exceed requirements as stated by NIST SP 800-63 and the AWS Foundational Security Best Practices standard for password strength. This rule allows you to optionally set RequireUppercaseCharacters (AWS Foundational Security Best Practices value: true), RequireLowercaseCharacters (AWS Foundational Security Best Practices value: true), RequireSymbols (AWS Foundational Security Best Practices value: true), RequireNumbers (AWS Foundational Security Best Practices value: true), MinimumPasswordLength (AWS Foundational Security Best Practices value: 14), PasswordReusePrevention (AWS Foundational Security Best Practices value: 24), and MaxPasswordAge (AWS Foundational Security Best Practices value: 90) for your IAM Password Policy. The actual values should reflect your organization's policies.
AC-2(3)	Account Management | Disable Accounts	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-2(4)	Account Management | Automated Audit Actions	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AC-2(4)	Account Management | Automated Audit Actions	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AC-2(4)	Account Management | Automated Audit Actions	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AC-2(4)	Account Management | Automated Audit Actions	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AC-2(4)	Account Management | Automated Audit Actions	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AC-2(4)	Account Management | Automated Audit Actions	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AC-2(4)	Account Management | Automated Audit Actions	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AC-2(4)	Account Management | Automated Audit Actions	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AC-2(4)	Account Management | Automated Audit Actions	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AC-2(12)	Account Management | Account Monitoring for Atypical Usage	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
AC-2	Account Management	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-2	Account Management	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-2	Account Management	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-2	Account Management	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-2	Account Management	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-2	Account Management	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-2	Account Management	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-3(7)	Access Enforcement | Role-based Access Control	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
AC-3(7)	Access Enforcement | Role-based Access Control	ec2-imdsv2-check	Ensure the Instance Metadata Service Version 2 (IMDSv2) method is enabled to help protect access and control of Amazon Elastic Compute Cloud (Amazon EC2) instance metadata. The IMDSv2 method uses session-based controls. With IMDSv2, controls can be implemented to restrict changes to instance metadata.
AC-3(7)	Access Enforcement | Role-based Access Control	ec2-instance-profile-attached	EC2 instance profiles pass an IAM role to an EC2 instance. Attaching an instance profile to your instances can assist with least privilege and permissions management.
AC-3(7)	Access Enforcement | Role-based Access Control	ecs-containers-readonly-access	Enabling read only access to Amazon Elastic Container Service (ECS) containers can assist in adhering to the principal of least privilege. This option can reduces attack vectors as the container instance’s filesystem cannot be modified unless it has explicit read-write permissions.
AC-3(7)	Access Enforcement | Role-based Access Control	ecs-task-definition-user-for-host-mode-check	If a task definition has elevated privileges it is because the customer has specifically opted-in to those configurations. This control checks for unexpected privilege escalation when a task definition has host networking enabled but the customer has not opted-in to elevated privileges.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3(7)	Access Enforcement | Role-based Access Control	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
AC-3(7)	Access Enforcement | Role-based Access Control	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
AC-3(7)	Access Enforcement | Role-based Access Control	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-3(7)	Access Enforcement | Role-based Access Control	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-3(7)	Access Enforcement | Role-based Access Control	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-root-access-key-check	Access to systems and assets can be controlled by checking that the root user does not have access keys attached to their AWS Identity and Access Management (IAM) role. Ensure that the root access keys are deleted. Instead, create and use role-based AWS accounts to help to incorporate the principle of least functionality.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3(7)	Access Enforcement | Role-based Access Control	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-3(7)	Access Enforcement | Role-based Access Control	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
AC-3(7)	Access Enforcement | Role-based Access Control	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
AC-3(7)	Access Enforcement | Role-based Access Control	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-3(7)	Access Enforcement | Role-based Access Control	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
AC-3(7)	Access Enforcement | Role-based Access Control	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
AC-3(7)	Access Enforcement | Role-based Access Control	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
AC-3(7)	Access Enforcement | Role-based Access Control	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-3(7)	Access Enforcement | Role-based Access Control	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-3(7)	Access Enforcement | Role-based Access Control	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
AC-3(7)	Access Enforcement | Role-based Access Control	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	ec2-imdsv2-check	Ensure the Instance Metadata Service Version 2 (IMDSv2) method is enabled to help protect access and control of Amazon Elastic Compute Cloud (Amazon EC2) instance metadata. The IMDSv2 method uses session-based controls. With IMDSv2, controls can be implemented to restrict changes to instance metadata.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	ec2-instance-profile-attached	EC2 instance profiles pass an IAM role to an EC2 instance. Attaching an instance profile to your instances can assist with least privilege and permissions management.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	ecs-containers-readonly-access	Enabling read only access to Amazon Elastic Container Service (ECS) containers can assist in adhering to the principal of least privilege. This option can reduces attack vectors as the container instance’s filesystem cannot be modified unless it has explicit read-write permissions.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	ecs-task-definition-user-for-host-mode-check	If a task definition has elevated privileges it is because the customer has specifically opted-in to those configurations. This control checks for unexpected privilege escalation when a task definition has host networking enabled but the customer has not opted-in to elevated privileges.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	access-keys-rotated	The credentials are audited for authorized devices, users, and processes by ensuring IAM access keys are rotated as specified by the organizational policy. Changing the access keys on a regular schedule is a security best practice. It shortens the period an access key is active and reduces the business impact if the keys are compromised. This rule requires an access key rotation value (Config Default: 90). The actual value should reflect your organization's policies.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-password-policy	The identities and the credentials are issued, managed, and verified based on an organizational IAM password policy. They meet or exceed requirements as stated by NIST SP 800-63 and the AWS Foundational Security Best Practices standard for password strength. This rule allows you to optionally set RequireUppercaseCharacters (AWS Foundational Security Best Practices value: true), RequireLowercaseCharacters (AWS Foundational Security Best Practices value: true), RequireSymbols (AWS Foundational Security Best Practices value: true), RequireNumbers (AWS Foundational Security Best Practices value: true), MinimumPasswordLength (AWS Foundational Security Best Practices value: 14), PasswordReusePrevention (AWS Foundational Security Best Practices value: 24), and MaxPasswordAge (AWS Foundational Security Best Practices value: 90) for your IAM Password Policy. The actual values should reflect your organization's policies.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-root-access-key-check	Access to systems and assets can be controlled by checking that the root user does not have access keys attached to their AWS Identity and Access Management (IAM) role. Ensure that the root access keys are deleted. Instead, create and use role-based AWS accounts to help to incorporate the principle of least functionality.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-user-mfa-enabled	Enable this rule to restrict access to resources in the AWS Cloud. This rule ensures multi-factor authentication (MFA) is enabled for all users. MFA adds an extra layer of protection on top of sign-in credentials. Reduce the incidents of compromised accounts by requiring MFA for users.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	mfa-enabled-for-iam-console-access	Manage access to resources in the AWS Cloud by ensuring that MFA is enabled for all AWS Identity and Access Management (IAM) users that have a console password. MFA adds an extra layer of protection on top of sign-in credentials. By requiring MFA for users, you can reduce incidents of compromised accounts and keep sensitive data from being accessed by unauthorized users.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	root-account-hardware-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring hardware MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	root-account-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
AC-3(15)	Access Enforcement | Discretionary and Mandatory Access Control	secretsmanager-rotation-enabled-check	This rule ensures AWS Secrets Manager secrets have rotation enabled. Rotating secrets on a regular schedule can shorten the period a secret is active, and potentially reduce the business impact if the secret is compromised.
AC-3	Access Enforcement	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
AC-3	Access Enforcement	ec2-imdsv2-check	Ensure the Instance Metadata Service Version 2 (IMDSv2) method is enabled to help protect access and control of Amazon Elastic Compute Cloud (Amazon EC2) instance metadata. The IMDSv2 method uses session-based controls. With IMDSv2, controls can be implemented to restrict changes to instance metadata.
AC-3	Access Enforcement	ec2-instance-profile-attached	EC2 instance profiles pass an IAM role to an EC2 instance. Attaching an instance profile to your instances can assist with least privilege and permissions management.
AC-3	Access Enforcement	ecs-containers-readonly-access	Enabling read only access to Amazon Elastic Container Service (ECS) containers can assist in adhering to the principal of least privilege. This option can reduces attack vectors as the container instance’s filesystem cannot be modified unless it has explicit read-write permissions.
AC-3	Access Enforcement	ecs-task-definition-user-for-host-mode-check	If a task definition has elevated privileges it is because the customer has specifically opted-in to those configurations. This control checks for unexpected privilege escalation when a task definition has host networking enabled but the customer has not opted-in to elevated privileges.
AC-3	Access Enforcement	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-3	Access Enforcement	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3	Access Enforcement	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
AC-3	Access Enforcement	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
AC-3	Access Enforcement	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
AC-3	Access Enforcement	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
AC-3	Access Enforcement	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-3	Access Enforcement	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
AC-3	Access Enforcement	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-3	Access Enforcement	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-3	Access Enforcement	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3	Access Enforcement	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-3	Access Enforcement	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-3	Access Enforcement	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
AC-3	Access Enforcement	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
AC-3	Access Enforcement	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-3	Access Enforcement	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
AC-3	Access Enforcement	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
AC-3	Access Enforcement	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
AC-3	Access Enforcement	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
AC-3	Access Enforcement	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
AC-3	Access Enforcement	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-3	Access Enforcement	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-3	Access Enforcement	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
AC-3	Access Enforcement	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	alb-waf-enabled	Ensure AWS WAF is enabled on Elastic Load Balancers (ELB) to help protect web applications. A WAF helps to protect your web applications or APIs against common web exploits. These web exploits may affect availability, compromise security, or consume excessive resources within your environment.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	api-gw-associated-with-waf	AWS WAF enables you to configure a set of rules (called a web access control list (web ACL)) that allow, block, or count web requests based on customizable web security rules and conditions that you define. Ensure your Amazon API Gateway stage is associated with a WAF Web ACL to protect it from malicious attacks
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
AC-4(21)	Information Flow Enforcement | Physical or Logical Separation of Information Flows	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AC-4(26)	Information Flow Enforcement | Audit Filtering Actions	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
AC-4	Information Flow Enforcement	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
AC-4	Information Flow Enforcement	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-4	Information Flow Enforcement	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-4	Information Flow Enforcement	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
AC-4	Information Flow Enforcement	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
AC-4	Information Flow Enforcement	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
AC-4	Information Flow Enforcement	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
AC-4	Information Flow Enforcement	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-4	Information Flow Enforcement	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
AC-4	Information Flow Enforcement	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
AC-4	Information Flow Enforcement	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-4	Information Flow Enforcement	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
AC-4	Information Flow Enforcement	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
AC-4	Information Flow Enforcement	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
AC-4	Information Flow Enforcement	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
AC-4	Information Flow Enforcement	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-4	Information Flow Enforcement	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
AC-4	Information Flow Enforcement	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
AC-4	Information Flow Enforcement	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
AC-4	Information Flow Enforcement	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
AC-4	Information Flow Enforcement	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
AC-4	Information Flow Enforcement	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-4	Information Flow Enforcement	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
AC-4	Information Flow Enforcement	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
AC-4	Information Flow Enforcement	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
AC-4	Information Flow Enforcement	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-4	Information Flow Enforcement	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
AC-4	Information Flow Enforcement	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
AC-4	Information Flow Enforcement	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
AC-4	Information Flow Enforcement	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-4	Information Flow Enforcement	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-4	Information Flow Enforcement	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-4	Information Flow Enforcement	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
AC-4	Information Flow Enforcement	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
AC-4	Information Flow Enforcement	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
AC-4	Information Flow Enforcement	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
AC-5	Separation of Duties	ecs-containers-readonly-access	Enabling read only access to Amazon Elastic Container Service (ECS) containers can assist in adhering to the principal of least privilege. This option can reduces attack vectors as the container instance’s filesystem cannot be modified unless it has explicit read-write permissions.
AC-5	Separation of Duties	ecs-task-definition-user-for-host-mode-check	If a task definition has elevated privileges it is because the customer has specifically opted-in to those configurations. This control checks for unexpected privilege escalation when a task definition has host networking enabled but the customer has not opted-in to elevated privileges.
AC-5	Separation of Duties	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-5	Separation of Duties	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-5	Separation of Duties	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-5	Separation of Duties	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(2)	Least Privilege | Non-privileged Access for Nonsecurity Functions	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(2)	Least Privilege | Non-privileged Access for Nonsecurity Functions	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(2)	Least Privilege | Non-privileged Access for Nonsecurity Functions	iam-root-access-key-check	Access to systems and assets can be controlled by checking that the root user does not have access keys attached to their AWS Identity and Access Management (IAM) role. Ensure that the root access keys are deleted. Instead, create and use role-based AWS accounts to help to incorporate the principle of least functionality.
AC-6(3)	Least Privilege | Network Access to Privileged Commands	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-6(3)	Least Privilege | Network Access to Privileged Commands	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(3)	Least Privilege | Network Access to Privileged Commands	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-6(3)	Least Privilege | Network Access to Privileged Commands	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-6(3)	Least Privilege | Network Access to Privileged Commands	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(3)	Least Privilege | Network Access to Privileged Commands	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AC-6(9)	Least Privilege | Log Use of Privileged Functions	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AC-6(10)	Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(10)	Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6(10)	Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions	iam-root-access-key-check	Access to systems and assets can be controlled by checking that the root user does not have access keys attached to their AWS Identity and Access Management (IAM) role. Ensure that the root access keys are deleted. Instead, create and use role-based AWS accounts to help to incorporate the principle of least functionality.
AC-6	Least Privilege	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
AC-6	Least Privilege	ec2-imdsv2-check	Ensure the Instance Metadata Service Version 2 (IMDSv2) method is enabled to help protect access and control of Amazon Elastic Compute Cloud (Amazon EC2) instance metadata. The IMDSv2 method uses session-based controls. With IMDSv2, controls can be implemented to restrict changes to instance metadata.
AC-6	Least Privilege	ec2-instance-profile-attached	EC2 instance profiles pass an IAM role to an EC2 instance. Attaching an instance profile to your instances can assist with least privilege and permissions management.
AC-6	Least Privilege	ecs-containers-readonly-access	Enabling read only access to Amazon Elastic Container Service (ECS) containers can assist in adhering to the principal of least privilege. This option can reduces attack vectors as the container instance’s filesystem cannot be modified unless it has explicit read-write permissions.
AC-6	Least Privilege	ecs-task-definition-user-for-host-mode-check	If a task definition has elevated privileges it is because the customer has specifically opted-in to those configurations. This control checks for unexpected privilege escalation when a task definition has host networking enabled but the customer has not opted-in to elevated privileges.
AC-6	Least Privilege	iam-no-inline-policy-check	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to control access to systems and assets. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management.
AC-6	Least Privilege	iam-policy-no-statements-with-full-access	Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6	Least Privilege	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
AC-6	Least Privilege	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
AC-6	Least Privilege	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
AC-6	Least Privilege	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
AC-6	Least Privilege	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
AC-6	Least Privilege	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-6	Least Privilege	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
AC-6	Least Privilege	iam-customer-policy-blocked-kms-actions	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing blocked actions on all AWS Key Management Service keys. Having more privileges than needed to complete a task may violate the principle of least privilege and separation of duties. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies
AC-6	Least Privilege	iam-inline-policy-blocked-kms-actions	Ensure an AWS Identity and Access Management (IAM) user, IAM role or IAM group does not have an inline policy to allow blocked actions on all AWS Key Management Service keys. AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning, rolling back, and delegating permissions management. This rule allows you to set the blockedActionsPatterns parameter. (AWS Foundational Security Best Practices value: kms:Decrypt, kms:ReEncryptFrom). The actual values should reflect your organization's policies.
AC-6	Least Privilege	iam-policy-no-statements-with-admin-access	AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, restricting policies from containing "Effect": "Allow" with "Action": "*" over "Resource": "*". Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6	Least Privilege	iam-root-access-key-check	Access to systems and assets can be controlled by checking that the root user does not have access keys attached to their AWS Identity and Access Management (IAM) role. Ensure that the root access keys are deleted. Instead, create and use role-based AWS accounts to help to incorporate the principle of least functionality.
AC-6	Least Privilege	iam-user-group-membership-check	AWS Identity and Access Management (IAM) can help you restrict access permissions and authorizations, by ensuring users are members of at least one group. Allowing users more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.
AC-6	Least Privilege	iam-user-unused-credentials-check	AWS Identity and Access Management (IAM) can help you with access permissions and authorizations by checking for IAM passwords and access keys that are not used for a specified time period. If these unused credentials are identified, you should disable and/or remove the credentials, as this may violate the principle of least privilege. This rule requires you to set a value to the maxCredentialUsageAge (Config Default: 90). The actual value should reflect your organization's policies.
AC-6	Least Privilege	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
AC-6	Least Privilege	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
AC-6	Least Privilege	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-6	Least Privilege	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
AC-6	Least Privilege	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
AC-6	Least Privilege	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
AC-6	Least Privilege	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
AC-6	Least Privilege	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
AC-6	Least Privilege	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-6	Least Privilege	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-6	Least Privilege	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
AC-6	Least Privilege	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
AC-17(2)	Remote Access | Protection of Confidentiality and Integrity Using Encryption	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
AC-21	Information Sharing	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
AC-21	Information Sharing	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
AC-21	Information Sharing	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
AC-21	Information Sharing	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
AC-21	Information Sharing	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
AC-21	Information Sharing	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
AC-21	Information Sharing	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-21	Information Sharing	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
AC-21	Information Sharing	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
AC-21	Information Sharing	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
AC-21	Information Sharing	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
AC-21	Information Sharing	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
AC-21	Information Sharing	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
AC-21	Information Sharing	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
AC-21	Information Sharing	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
AC-21	Information Sharing	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
AC-21	Information Sharing	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-21	Information Sharing	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
AC-21	Information Sharing	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
AC-21	Information Sharing	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
AU-2	Event Logging	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-2	Event Logging	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AU-2	Event Logging	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-2	Event Logging	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AU-2	Event Logging	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AU-2	Event Logging	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AU-2	Event Logging	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-2	Event Logging	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-2	Event Logging	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AU-2	Event Logging	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AU-2	Event Logging	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AU-2	Event Logging	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AU-2	Event Logging	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
AU-3	Content of Audit Records	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-3	Content of Audit Records	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AU-3	Content of Audit Records	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-3	Content of Audit Records	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AU-3	Content of Audit Records	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AU-3	Content of Audit Records	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-3	Content of Audit Records	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-3	Content of Audit Records	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AU-3	Content of Audit Records	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AU-3	Content of Audit Records	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AU-3	Content of Audit Records	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AU-3	Content of Audit Records	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AU-3	Content of Audit Records	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
AU-6(1)	Audit Record Review, Analysis, and Reporting | Automated Process Integration	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-6(1)	Audit Record Review, Analysis, and Reporting | Automated Process Integration	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
AU-6(1)	Audit Record Review, Analysis, and Reporting | Automated Process Integration	securityhub-enabled	AWS Security Hub helps to monitor unauthorized personnel, connections, devices, and software. AWS Security Hub aggregates, organizes, and prioritizes the security alerts, or findings, from multiple AWS services. Some such services are Amazon Security Hub, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, and AWS Partner solutions.
AU-6(1)	Audit Record Review, Analysis, and Reporting | Automated Process Integration	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AU-6(3)	Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AU-6(4)	Audit Record Review, Analysis, and Reporting | Central Review and Analysis	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
AU-6(5)	Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-6(5)	Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
AU-6(5)	Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records	securityhub-enabled	AWS Security Hub helps to monitor unauthorized personnel, connections, devices, and software. AWS Security Hub aggregates, organizes, and prioritizes the security alerts, or findings, from multiple AWS services. Some such services are Amazon Security Hub, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, and AWS Partner solutions.
AU-6(5)	Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
AU-7(1)	Audit Record Reduction and Report Generation | Automatic Processing	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-9(2)	Protection of Audit Information | Store on Separate Physical Systems or Components	s3-version-lifecycle-policy-check	Ensure Amazon S3 lifecycle policies are configured to help define actions that you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
AU-9(2)	Protection of Audit Information | Store on Separate Physical Systems or Components	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
AU-9(2)	Protection of Audit Information | Store on Separate Physical Systems or Components	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
AU-9(7)	Protection of Audit Information | Store on Component with Different Operating System	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-9	Protection of Audit Information	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
AU-9	Protection of Audit Information	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-9	Protection of Audit Information	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
AU-9	Protection of Audit Information	cloud-trail-log-file-validation-enabled	Utilize AWS CloudTrail log file validation to check the integrity of CloudTrail logs. Log file validation helps determine if a log file was modified or deleted or unchanged after CloudTrail delivered it. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
AU-9	Protection of Audit Information	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
AU-10	Non-repudiation	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-10	Non-repudiation	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AU-10	Non-repudiation	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-10	Non-repudiation	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AU-10	Non-repudiation	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AU-10	Non-repudiation	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AU-10	Non-repudiation	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-10	Non-repudiation	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-10	Non-repudiation	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AU-10	Non-repudiation	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AU-10	Non-repudiation	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AU-10	Non-repudiation	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AU-12	Audit Record Generation	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-12	Audit Record Generation	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
AU-12	Audit Record Generation	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
AU-12	Audit Record Generation	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
AU-12	Audit Record Generation	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
AU-12	Audit Record Generation	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
AU-12	Audit Record Generation	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
AU-12	Audit Record Generation	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
AU-12	Audit Record Generation	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
AU-12	Audit Record Generation	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
AU-12	Audit Record Generation	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
AU-12	Audit Record Generation	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
AU-12	Audit Record Generation	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
AU-14(1)	Session Audit | System Start-up	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
CA-7	Continuous Monitoring	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
CA-7	Continuous Monitoring	lambda-dlq-check	Enable this rule to help notify the appropriate personnel through Amazon Simple Queue Service (Amazon SQS) or Amazon Simple Notification Service (Amazon SNS) when a function has failed.
CA-7	Continuous Monitoring	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
CA-7	Continuous Monitoring	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
CA-7	Continuous Monitoring	rds-enhanced-monitoring-enabled	Enable Amazon Relational Database Service (Amazon RDS) to help monitor Amazon RDS availability. This provides detailed visibility into the health of your Amazon RDS database instances. When the Amazon RDS storage is using more than one underlying physical device, Enhanced Monitoring collects the data for each device. Also, when the Amazon RDS database instance is running in a Multi-AZ deployment, the data for each device on the secondary host is collected, and the secondary host metrics.
CA-7	Continuous Monitoring	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
CA-7	Continuous Monitoring	s3-event-notifications-enabled	Amazon S3 event notifications can alert relevant personnel of any accidental or intentional modifications on your bucket objects. Example alerts include: new object is creation, object removal, object restoration, lost and replicated objects.
CA-7	Continuous Monitoring	securityhub-enabled	AWS Security Hub helps to monitor unauthorized personnel, connections, devices, and software. AWS Security Hub aggregates, organizes, and prioritizes the security alerts, or findings, from multiple AWS services. Some such services are Amazon Security Hub, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, and AWS Partner solutions.
CA-7	Continuous Monitoring	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
CA-7	Continuous Monitoring	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
CA-7	Continuous Monitoring	autoscaling-group-elb-healthcheck-required	The Elastic Load Balancer (ELB) health checks for Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling groups support maintenance of adequate capacity and availability. The load balancer periodically sends pings, attempts connections, or sends requests to test Amazon EC2 instances health in an auto-scaling group. If an instance is not reporting back, traffic is sent to a new Amazon EC2 instance.
CA-7	Continuous Monitoring	beanstalk-enhanced-health-reporting-enabled	AWS Elastic Beanstalk enhanced health reporting enables a more rapid response to changes in the health of the underlying infrastructure. These changes could result in a lack of availability of the application. Elastic Beanstalk enhanced health reporting provides a status descriptor to gauge the severity of the identified issues and identify possible causes to investigate.
CA-7	Continuous Monitoring	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
CA-7	Continuous Monitoring	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
CA-7	Continuous Monitoring	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
CA-7	Continuous Monitoring	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
CA-7	Continuous Monitoring	dynamodb-throughput-limit-check	Enable this rule to ensure that provisioned throughput capacity is checked on your Amazon DynamoDB tables. This is the amount of read/write activity that each table can support. DynamoDB uses this information to reserve sufficient system resources to meet your throughput requirements. This rule generates an alert when the throughput approaches the maximum limit for a customer's account. This rule allows you to optionally set accountRCUThresholdPercentage (Config Default: 80) and accountWCUThresholdPercentage (Config Default: 80) parameters. The actual values should reflect your organization's policies.
CA-7	Continuous Monitoring	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
CA-7	Continuous Monitoring	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
CA-7	Continuous Monitoring	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
CA-7	Continuous Monitoring	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
CA-7	Continuous Monitoring	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
CA-9(1)	Internal System Connections | Compliance Checks	account-part-of-organizations	Centralized management of AWS accounts within AWS Organizations helps to ensure that accounts are compliant. The lack of centralized account governance may lead to inconsistent account configurations, which may expose resources and sensitive data.
CA-9(1)	Internal System Connections | Compliance Checks	codebuild-project-artifact-encryption	To help protect sensitive data at rest, ensure encryption is enabled for your AWS CodeBuild artifacts.
CA-9(1)	Internal System Connections | Compliance Checks	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
CA-9(1)	Internal System Connections | Compliance Checks	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
CA-9(1)	Internal System Connections | Compliance Checks	rds-instance-default-admin-check	As default usernames are public knowledge, changing default usernames can assist in reducing the attack surface for your Amazon Relational Database Service (Amazon RDS) database instance(s).
CA-9(1)	Internal System Connections | Compliance Checks	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	api-gw-cache-enabled-and-encrypted	To help protect data at rest, ensure encryption is enabled for your API Gateway stage's cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
CA-9(1)	Internal System Connections | Compliance Checks	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CA-9(1)	Internal System Connections | Compliance Checks	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
CA-9(1)	Internal System Connections | Compliance Checks	ec2-stopped-instance	Enable this rule to help with the baseline configuration of Amazon Elastic Compute Cloud (Amazon EC2) instances by checking whether Amazon EC2 instances have been stopped for more than the allowed number of days, according to your organization's standards.
CA-9(1)	Internal System Connections | Compliance Checks	ec2-volume-inuse-check	This rule ensures that Amazon Elastic Block Store volumes that are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances are marked for deletion when an instance is terminated. If an Amazon EBS volume isn't deleted when the instance that it's attached to is terminated, it may violate the concept of least functionality.
CA-9(1)	Internal System Connections | Compliance Checks	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
CA-9(1)	Internal System Connections | Compliance Checks	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
CA-9(1)	Internal System Connections | Compliance Checks	elb-deletion-protection-enabled	This rule ensures that Elastic Load Balancing has deletion protection enabled. Use this feature to prevent your load balancer from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
CA-9(1)	Internal System Connections | Compliance Checks	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
CA-9(1)	Internal System Connections | Compliance Checks	opensearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service domains.
CA-9(1)	Internal System Connections | Compliance Checks	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
CA-9(1)	Internal System Connections | Compliance Checks	redshift-cluster-kms-enabled	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your Amazon Redshift cluster. Because sensitive data can exist at rest in Redshift clusters, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
CA-9(1)	Internal System Connections | Compliance Checks	redshift-default-admin-check	As default usernames are public knowledge, changing default usernames can assist in reducing the attack surface for your Amazon Redshift cluster(s).
CA-9(1)	Internal System Connections | Compliance Checks	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
CA-9(1)	Internal System Connections | Compliance Checks	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
CA-9(1)	Internal System Connections | Compliance Checks	secretsmanager-using-cmk	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for AWS Secrets Manager secrets. Because sensitive data can exist at rest in Secrets Manager secrets, enable encryption at rest to help protect that data.
CM-2(2)	Baseline Configuration | Automation Support for Accuracy and Currency	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CM-2(2)	Baseline Configuration | Automation Support for Accuracy and Currency	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
CM-2(2)	Baseline Configuration | Automation Support for Accuracy and Currency	ec2-stopped-instance	Enable this rule to help with the baseline configuration of Amazon Elastic Compute Cloud (Amazon EC2) instances by checking whether Amazon EC2 instances have been stopped for more than the allowed number of days, according to your organization's standards.
CM-2(2)	Baseline Configuration | Automation Support for Accuracy and Currency	ec2-volume-inuse-check	This rule ensures that Amazon Elastic Block Store volumes that are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances are marked for deletion when an instance is terminated. If an Amazon EBS volume isn't deleted when the instance that it's attached to is terminated, it may violate the concept of least functionality.
CM-2(2)	Baseline Configuration | Automation Support for Accuracy and Currency	elb-deletion-protection-enabled	This rule ensures that Elastic Load Balancing has deletion protection enabled. Use this feature to prevent your load balancer from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
CM-2(2)	Baseline Configuration | Automation Support for Accuracy and Currency	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
CM-2	Baseline Configuration	account-part-of-organizations	Centralized management of AWS accounts within AWS Organizations helps to ensure that accounts are compliant. The lack of centralized account governance may lead to inconsistent account configurations, which may expose resources and sensitive data.
CM-2	Baseline Configuration	rds-instance-default-admin-check	As default usernames are public knowledge, changing default usernames can assist in reducing the attack surface for your Amazon Relational Database Service (Amazon RDS) database instance(s).
CM-2	Baseline Configuration	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CM-2	Baseline Configuration	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
CM-2	Baseline Configuration	ec2-stopped-instance	Enable this rule to help with the baseline configuration of Amazon Elastic Compute Cloud (Amazon EC2) instances by checking whether Amazon EC2 instances have been stopped for more than the allowed number of days, according to your organization's standards.
CM-2	Baseline Configuration	ec2-volume-inuse-check	This rule ensures that Amazon Elastic Block Store volumes that are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances are marked for deletion when an instance is terminated. If an Amazon EBS volume isn't deleted when the instance that it's attached to is terminated, it may violate the concept of least functionality.
CM-2	Baseline Configuration	elb-deletion-protection-enabled	This rule ensures that Elastic Load Balancing has deletion protection enabled. Use this feature to prevent your load balancer from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
CM-2	Baseline Configuration	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
CM-2	Baseline Configuration	redshift-default-admin-check	As default usernames are public knowledge, changing default usernames can assist in reducing the attack surface for your Amazon Redshift cluster(s).
CM-2	Baseline Configuration	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
CM-3(6)	Configuration Change Control | Cryptography Management	codebuild-project-artifact-encryption	To help protect sensitive data at rest, ensure encryption is enabled for your AWS CodeBuild artifacts.
CM-3(6)	Configuration Change Control | Cryptography Management	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
CM-3(6)	Configuration Change Control | Cryptography Management	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
CM-3(6)	Configuration Change Control | Cryptography Management	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	api-gw-cache-enabled-and-encrypted	To help protect data at rest, ensure encryption is enabled for your API Gateway stage's cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
CM-3(6)	Configuration Change Control | Cryptography Management	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
CM-3(6)	Configuration Change Control | Cryptography Management	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
CM-3(6)	Configuration Change Control | Cryptography Management	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
CM-3(6)	Configuration Change Control | Cryptography Management	opensearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service domains.
CM-3(6)	Configuration Change Control | Cryptography Management	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
CM-3(6)	Configuration Change Control | Cryptography Management	redshift-cluster-kms-enabled	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your Amazon Redshift cluster. Because sensitive data can exist at rest in Redshift clusters, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
CM-3(6)	Configuration Change Control | Cryptography Management	secretsmanager-using-cmk	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for AWS Secrets Manager secrets. Because sensitive data can exist at rest in Secrets Manager secrets, enable encryption at rest to help protect that data.
CM-3	Configuration Change Control	elb-deletion-protection-enabled	This rule ensures that Elastic Load Balancing has deletion protection enabled. Use this feature to prevent your load balancer from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
CM-3	Configuration Change Control	rds-instance-deletion-protection-enabled	Ensure Amazon Relational Database Service (Amazon RDS) instances have deletion protection enabled. Use deletion protection to prevent your Amazon RDS instances from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
CM-7	Least Functionality	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
CM-7	Least Functionality	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
CM-7	Least Functionality	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
CM-8(1)	System Component Inventory | Updates During Installation and Removal	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CM-8(1)	System Component Inventory | Updates During Installation and Removal	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
CM-8(2)	System Component Inventory | Automated Maintenance	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CM-8(3)	System Component Inventory | Automated Unauthorized Component Detection	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CM-8(3)	System Component Inventory | Automated Unauthorized Component Detection	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
CM-8(3)	System Component Inventory | Automated Unauthorized Component Detection	ec2-managedinstance-patch-compliance-status-check	Enable this rule to help with identification and documentation of Amazon Elastic Compute Cloud (Amazon EC2) vulnerabilities. The rule checks if Amazon EC2 instance patch compliance in AWS Systems Manager as required by your organization's policies and procedures.
CM-8(3)	System Component Inventory | Automated Unauthorized Component Detection	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
CM-8	System Component Inventory	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
CM-8	System Component Inventory	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
CP-2(2)	Contingency Plan | Capacity Planning	autoscaling-group-elb-healthcheck-required	The Elastic Load Balancer (ELB) health checks for Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling groups support maintenance of adequate capacity and availability. The load balancer periodically sends pings, attempts connections, or sends requests to test Amazon EC2 instances health in an auto-scaling group. If an instance is not reporting back, traffic is sent to a new Amazon EC2 instance.
CP-2(2)	Contingency Plan | Capacity Planning	dynamodb-autoscaling-enabled	Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to adjust provisioned throughput capacity that automatically responds to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read/write capacity to handle sudden increases in traffic, without throttling.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
CP-6(1)	Alternate Storage Site | Separation from Primary Site	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	elb-cross-zone-load-balancing-enabled	Enable cross-zone load balancing for your Elastic Load Balancers (ELBs) to help maintain adequate capacity and availability. The cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled availability zone. It also improves your application's ability to handle the loss of one or more instances.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	s3-version-lifecycle-policy-check	Ensure Amazon S3 lifecycle policies are configured to help define actions that you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	dynamodb-autoscaling-enabled	Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to adjust provisioned throughput capacity that automatically responds to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read/write capacity to handle sudden increases in traffic, without throttling.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	dynamodb-pitr-enabled	Enable this rule to check that information has been backed up. It also maintains the backups by ensuring that point-in-time recovery is enabled in Amazon DynamoDB. The recovery maintains continuous backups of your table for the last 35 days.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	rds-multi-az-support	Multi-AZ support in Amazon Relational Database Service (Amazon RDS) provides enhanced availability and durability for database instances. When you provision a Multi-AZ database instance, Amazon RDS automatically creates a primary database instance, and synchronously replicates the data to a standby instance in a different Availability Zone. Each Availability Zone runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable. In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby so that you can resume database operations as soon as the failover is complete.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
CP-6(2)	Alternate Storage Site | Recovery Time and Recovery Point Objectives	vpc-vpn-2-tunnels-up	Redundant Site-to-Site VPN tunnels can be implemented to achieve resilience requirements. It uses two tunnels to help ensure connectivity in case one of the Site-to-Site VPN connections becomes unavailable. To protect against a loss of connectivity, in case your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your Amazon Virtual Private Cloud (Amazon VPC) and virtual private gateway by using a second customer gateway.
CP-6	Alternate Storage Site	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6	Alternate Storage Site	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6	Alternate Storage Site	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-6	Alternate Storage Site	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
CP-6	Alternate Storage Site	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
CP-6	Alternate Storage Site	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
CP-6	Alternate Storage Site	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
CP-6	Alternate Storage Site	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
CP-9	System Backup	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-9	System Backup	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-9	System Backup	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-9	System Backup	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
CP-9	System Backup	s3-version-lifecycle-policy-check	Ensure Amazon S3 lifecycle policies are configured to help define actions that you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
CP-9	System Backup	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
CP-9	System Backup	dynamodb-pitr-enabled	Enable this rule to check that information has been backed up. It also maintains the backups by ensuring that point-in-time recovery is enabled in Amazon DynamoDB. The recovery maintains continuous backups of your table for the last 35 days.
CP-9	System Backup	ebs-optimized-instance	An optimized instance in Amazon Elastic Block Store (Amazon EBS) provides additional, dedicated capacity for Amazon EBS I/O operations. This optimization provides the most efficient performance for your EBS volumes by minimizing contention between Amazon EBS I/O operations and other traffic from your instance.
CP-9	System Backup	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
CP-9	System Backup	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
CP-9	System Backup	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
CP-9	System Backup	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
CP-10	System Recovery and Reconstitution	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-10	System Recovery and Reconstitution	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-10	System Recovery and Reconstitution	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
CP-10	System Recovery and Reconstitution	elb-cross-zone-load-balancing-enabled	Enable cross-zone load balancing for your Elastic Load Balancers (ELBs) to help maintain adequate capacity and availability. The cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled availability zone. It also improves your application's ability to handle the loss of one or more instances.
CP-10	System Recovery and Reconstitution	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
CP-10	System Recovery and Reconstitution	s3-version-lifecycle-policy-check	Ensure Amazon S3 lifecycle policies are configured to help define actions that you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
CP-10	System Recovery and Reconstitution	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
CP-10	System Recovery and Reconstitution	dynamodb-autoscaling-enabled	Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to adjust provisioned throughput capacity that automatically responds to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read/write capacity to handle sudden increases in traffic, without throttling.
CP-10	System Recovery and Reconstitution	dynamodb-pitr-enabled	Enable this rule to check that information has been backed up. It also maintains the backups by ensuring that point-in-time recovery is enabled in Amazon DynamoDB. The recovery maintains continuous backups of your table for the last 35 days.
CP-10	System Recovery and Reconstitution	ebs-optimized-instance	An optimized instance in Amazon Elastic Block Store (Amazon EBS) provides additional, dedicated capacity for Amazon EBS I/O operations. This optimization provides the most efficient performance for your EBS volumes by minimizing contention between Amazon EBS I/O operations and other traffic from your instance.
CP-10	System Recovery and Reconstitution	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
CP-10	System Recovery and Reconstitution	rds-multi-az-support	Multi-AZ support in Amazon Relational Database Service (Amazon RDS) provides enhanced availability and durability for database instances. When you provision a Multi-AZ database instance, Amazon RDS automatically creates a primary database instance, and synchronously replicates the data to a standby instance in a different Availability Zone. Each Availability Zone runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable. In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby so that you can resume database operations as soon as the failover is complete.
CP-10	System Recovery and Reconstitution	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
CP-10	System Recovery and Reconstitution	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
CP-10	System Recovery and Reconstitution	vpc-vpn-2-tunnels-up	Redundant Site-to-Site VPN tunnels can be implemented to achieve resilience requirements. It uses two tunnels to help ensure connectivity in case one of the Site-to-Site VPN connections becomes unavailable. To protect against a loss of connectivity, in case your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your Amazon Virtual Private Cloud (Amazon VPC) and virtual private gateway by using a second customer gateway.
IA-2(1)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts	iam-user-mfa-enabled	Enable this rule to restrict access to resources in the AWS Cloud. This rule ensures multi-factor authentication (MFA) is enabled for all users. MFA adds an extra layer of protection on top of sign-in credentials. Reduce the incidents of compromised accounts by requiring MFA for users.
IA-2(1)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts	mfa-enabled-for-iam-console-access	Manage access to resources in the AWS Cloud by ensuring that MFA is enabled for all AWS Identity and Access Management (IAM) users that have a console password. MFA adds an extra layer of protection on top of sign-in credentials. By requiring MFA for users, you can reduce incidents of compromised accounts and keep sensitive data from being accessed by unauthorized users.
IA-2(1)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts	root-account-hardware-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring hardware MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(1)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts	root-account-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(2)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts	iam-user-mfa-enabled	Enable this rule to restrict access to resources in the AWS Cloud. This rule ensures multi-factor authentication (MFA) is enabled for all users. MFA adds an extra layer of protection on top of sign-in credentials. Reduce the incidents of compromised accounts by requiring MFA for users.
IA-2(2)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts	mfa-enabled-for-iam-console-access	Manage access to resources in the AWS Cloud by ensuring that MFA is enabled for all AWS Identity and Access Management (IAM) users that have a console password. MFA adds an extra layer of protection on top of sign-in credentials. By requiring MFA for users, you can reduce incidents of compromised accounts and keep sensitive data from being accessed by unauthorized users.
IA-2(2)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts	root-account-hardware-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring hardware MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(2)	Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts	root-account-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(6)	Identification and Authentication (organizational Users) | Access to Accounts —separate Device	iam-user-mfa-enabled	Enable this rule to restrict access to resources in the AWS Cloud. This rule ensures multi-factor authentication (MFA) is enabled for all users. MFA adds an extra layer of protection on top of sign-in credentials. Reduce the incidents of compromised accounts by requiring MFA for users.
IA-2(6)	Identification and Authentication (organizational Users) | Access to Accounts —separate Device	mfa-enabled-for-iam-console-access	Manage access to resources in the AWS Cloud by ensuring that MFA is enabled for all AWS Identity and Access Management (IAM) users that have a console password. MFA adds an extra layer of protection on top of sign-in credentials. By requiring MFA for users, you can reduce incidents of compromised accounts and keep sensitive data from being accessed by unauthorized users.
IA-2(6)	Identification and Authentication (organizational Users) | Access to Accounts —separate Device	root-account-hardware-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring hardware MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(6)	Identification and Authentication (organizational Users) | Access to Accounts —separate Device	root-account-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(8)	Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant	iam-user-mfa-enabled	Enable this rule to restrict access to resources in the AWS Cloud. This rule ensures multi-factor authentication (MFA) is enabled for all users. MFA adds an extra layer of protection on top of sign-in credentials. Reduce the incidents of compromised accounts by requiring MFA for users.
IA-2(8)	Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant	mfa-enabled-for-iam-console-access	Manage access to resources in the AWS Cloud by ensuring that MFA is enabled for all AWS Identity and Access Management (IAM) users that have a console password. MFA adds an extra layer of protection on top of sign-in credentials. By requiring MFA for users, you can reduce incidents of compromised accounts and keep sensitive data from being accessed by unauthorized users.
IA-2(8)	Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant	root-account-hardware-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring hardware MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-2(8)	Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant	root-account-mfa-enabled	Manage access to resources in the AWS Cloud by ensuring MFA is enabled for the root user. The root user is the most privileged user in an AWS account. The MFA adds an extra layer of protection for sign-in credentials. By requiring MFA for the root user, you can reduce the incidents of compromised AWS accounts.
IA-5(1)	Authenticator Management | Password-based Authentication	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
IA-5(1)	Authenticator Management | Password-based Authentication	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
IA-5(1)	Authenticator Management | Password-based Authentication	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
IA-5(1)	Authenticator Management | Password-based Authentication	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
IA-5(1)	Authenticator Management | Password-based Authentication	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
IA-5(1)	Authenticator Management | Password-based Authentication	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
IA-5(1)	Authenticator Management | Password-based Authentication	iam-password-policy	The identities and the credentials are issued, managed, and verified based on an organizational IAM password policy. They meet or exceed requirements as stated by NIST SP 800-63 and the AWS Foundational Security Best Practices standard for password strength. This rule allows you to optionally set RequireUppercaseCharacters (AWS Foundational Security Best Practices value: true), RequireLowercaseCharacters (AWS Foundational Security Best Practices value: true), RequireSymbols (AWS Foundational Security Best Practices value: true), RequireNumbers (AWS Foundational Security Best Practices value: true), MinimumPasswordLength (AWS Foundational Security Best Practices value: 14), PasswordReusePrevention (AWS Foundational Security Best Practices value: 24), and MaxPasswordAge (AWS Foundational Security Best Practices value: 90) for your IAM Password Policy. The actual values should reflect your organization's policies.
IA-5(1)	Authenticator Management | Password-based Authentication	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
IA-5(7)	Authenticator Management | No Embedded Unencrypted Static Authenticators	codebuild-project-envvar-awscred-check	Ensure authentication credentials AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY do not exist within AWS Codebuild project environments. Do not store these variables in clear text. Storing these variables in clear text leads to unintended data exposure and unauthorized access.
IR-4(1)	Incident Handling | Automated Incident Handling Processes	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
IR-4(5)	Incident Handling | Automatic Disabling of System	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
RA-3(4)	Risk Assessment | Predictive Cyber Analytics	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-3	System Development Life Cycle	codebuild-project-envvar-awscred-check	Ensure authentication credentials AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY do not exist within AWS Codebuild project environments. Do not store these variables in clear text. Storing these variables in clear text leads to unintended data exposure and unauthorized access.
SA-3	System Development Life Cycle	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
SA-8(19)	Security and Privacy Engineering Principles | Continuous Protection	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-8(21)	Security and Privacy Engineering Principles | Self-analysis	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-8(22)	Security and Privacy Engineering Principles | Accountability and Traceability	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
SA-8(25)	Security and Privacy Engineering Principles | Economic Security	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-11(1)	Developer Testing and Evaluation | Static Code Analysis	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-11(6)	Developer Testing and Evaluation | Attack Surface Reviews	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-15(2)	Development Process, Standards, and Tools | Security and Privacy Tracking Tools	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
SA-15(2)	Development Process, Standards, and Tools | Security and Privacy Tracking Tools	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SA-15(8)	Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
SA-15(8)	Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SC-5(1)	Denial-of-service Protection | Restrict Ability to Attack Other Systems	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	elb-cross-zone-load-balancing-enabled	Enable cross-zone load balancing for your Elastic Load Balancers (ELBs) to help maintain adequate capacity and availability. The cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled availability zone. It also improves your application's ability to handle the loss of one or more instances.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	rds-instance-deletion-protection-enabled	Ensure Amazon Relational Database Service (Amazon RDS) instances have deletion protection enabled. Use deletion protection to prevent your Amazon RDS instances from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	s3-version-lifecycle-policy-check	Ensure Amazon S3 lifecycle policies are configured to help define actions that you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	dynamodb-autoscaling-enabled	Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to adjust provisioned throughput capacity that automatically responds to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read/write capacity to handle sudden increases in traffic, without throttling.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	dynamodb-pitr-enabled	Enable this rule to check that information has been backed up. It also maintains the backups by ensuring that point-in-time recovery is enabled in Amazon DynamoDB. The recovery maintains continuous backups of your table for the last 35 days.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	ebs-optimized-instance	An optimized instance in Amazon Elastic Block Store (Amazon EBS) provides additional, dedicated capacity for Amazon EBS I/O operations. This optimization provides the most efficient performance for your EBS volumes by minimizing contention between Amazon EBS I/O operations and other traffic from your instance.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	elb-deletion-protection-enabled	This rule ensures that Elastic Load Balancing has deletion protection enabled. Use this feature to prevent your load balancer from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	rds-multi-az-support	Multi-AZ support in Amazon Relational Database Service (Amazon RDS) provides enhanced availability and durability for database instances. When you provision a Multi-AZ database instance, Amazon RDS automatically creates a primary database instance, and synchronously replicates the data to a standby instance in a different Availability Zone. Each Availability Zone runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable. In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby so that you can resume database operations as soon as the failover is complete.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
SC-5(2)	Denial-of-service Protection | Capacity, Bandwidth, and Redundancy	vpc-vpn-2-tunnels-up	Redundant Site-to-Site VPN tunnels can be implemented to achieve resilience requirements. It uses two tunnels to help ensure connectivity in case one of the Site-to-Site VPN connections becomes unavailable. To protect against a loss of connectivity, in case your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your Amazon Virtual Private Cloud (Amazon VPC) and virtual private gateway by using a second customer gateway.
SC-5(3)	Denial-of-service Protection | Detection and Monitoring	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SC-5	Denial-of-service Protection	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SC-7(3)	Boundary Protection | Access Points	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(3)	Boundary Protection | Access Points	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(3)	Boundary Protection | Access Points	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(3)	Boundary Protection | Access Points	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(3)	Boundary Protection | Access Points	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(3)	Boundary Protection | Access Points	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(3)	Boundary Protection | Access Points	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(3)	Boundary Protection | Access Points	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(3)	Boundary Protection | Access Points	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(3)	Boundary Protection | Access Points	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(3)	Boundary Protection | Access Points	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(3)	Boundary Protection | Access Points	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(3)	Boundary Protection | Access Points	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(3)	Boundary Protection | Access Points	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(4)	Boundary Protection | External Telecommunications Services	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(4)	Boundary Protection | External Telecommunications Services	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-7(4)	Boundary Protection | External Telecommunications Services	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-7(4)	Boundary Protection | External Telecommunications Services	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
SC-7(4)	Boundary Protection | External Telecommunications Services	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(4)	Boundary Protection | External Telecommunications Services	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
SC-7(4)	Boundary Protection | External Telecommunications Services	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-7(4)	Boundary Protection | External Telecommunications Services	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-7(4)	Boundary Protection | External Telecommunications Services	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
SC-7(4)	Boundary Protection | External Telecommunications Services	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(4)	Boundary Protection | External Telecommunications Services	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-7(4)	Boundary Protection | External Telecommunications Services	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-7(4)	Boundary Protection | External Telecommunications Services	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(4)	Boundary Protection | External Telecommunications Services	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-7(4)	Boundary Protection | External Telecommunications Services	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-7(4)	Boundary Protection | External Telecommunications Services	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(4)	Boundary Protection | External Telecommunications Services	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(4)	Boundary Protection | External Telecommunications Services	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(4)	Boundary Protection | External Telecommunications Services	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(4)	Boundary Protection | External Telecommunications Services	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-7(4)	Boundary Protection | External Telecommunications Services	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
SC-7(4)	Boundary Protection | External Telecommunications Services	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(4)	Boundary Protection | External Telecommunications Services	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(4)	Boundary Protection | External Telecommunications Services	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(4)	Boundary Protection | External Telecommunications Services	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(4)	Boundary Protection | External Telecommunications Services	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-7(4)	Boundary Protection | External Telecommunications Services	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(4)	Boundary Protection | External Telecommunications Services	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(4)	Boundary Protection | External Telecommunications Services	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
SC-7(4)	Boundary Protection | External Telecommunications Services	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
SC-7(5)	Boundary Protection | Deny by Default — Allow by Exception	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
SC-7(5)	Boundary Protection | Deny by Default — Allow by Exception	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
SC-7(5)	Boundary Protection | Deny by Default — Allow by Exception	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
SC-7(5)	Boundary Protection | Deny by Default — Allow by Exception	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(9)	Boundary Protection | Restrict Threatening Outgoing Communications Traffic	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(10)	Boundary Protection | Prevent Exfiltration	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
SC-7(10)	Boundary Protection | Prevent Exfiltration	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
SC-7(10)	Boundary Protection | Prevent Exfiltration	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
SC-7(10)	Boundary Protection | Prevent Exfiltration	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
SC-7(10)	Boundary Protection | Prevent Exfiltration	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
SC-7(10)	Boundary Protection | Prevent Exfiltration	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
SC-7(10)	Boundary Protection | Prevent Exfiltration	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
SC-7(10)	Boundary Protection | Prevent Exfiltration	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SC-7(10)	Boundary Protection | Prevent Exfiltration	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
SC-7(10)	Boundary Protection | Prevent Exfiltration	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
SC-7(10)	Boundary Protection | Prevent Exfiltration	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
SC-7(11)	Boundary Protection | Restrict Incoming Communications Traffic	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	acm-certificate-expiration-check	Ensure network integrity is protected by ensuring X509 certificates are issued by AWS ACM. These certificates must be valid and unexpired. This rule requires a value for daysToExpiration (AWS Foundational Security Best Practices value: 90). The actual value should reflect your organization's policies.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
SC-7(16)	Boundary Protection | Prevent Discovery of System Components	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(20)	Boundary Protection | Dynamic Isolation and Segregation	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(21)	Boundary Protection | Isolation of System Components	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7(21)	Boundary Protection | Isolation of System Components	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
SC-7(21)	Boundary Protection | Isolation of System Components	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7(21)	Boundary Protection | Isolation of System Components	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
SC-7(21)	Boundary Protection | Isolation of System Components	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
SC-7(21)	Boundary Protection | Isolation of System Components	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7(21)	Boundary Protection | Isolation of System Components	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(21)	Boundary Protection | Isolation of System Components	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7(21)	Boundary Protection | Isolation of System Components	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7(21)	Boundary Protection | Isolation of System Components	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7(21)	Boundary Protection | Isolation of System Components	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7(21)	Boundary Protection | Isolation of System Components	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
SC-7(21)	Boundary Protection | Isolation of System Components	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7(21)	Boundary Protection | Isolation of System Components	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7(21)	Boundary Protection | Isolation of System Components	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(21)	Boundary Protection | Isolation of System Components	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7(21)	Boundary Protection | Isolation of System Components	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7(21)	Boundary Protection | Isolation of System Components	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7(21)	Boundary Protection | Isolation of System Components	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
SC-7(21)	Boundary Protection | Isolation of System Components	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
SC-7	Boundary Protection	autoscaling-launch-config-public-ip-disabled	If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.
SC-7	Boundary Protection	restricted-ssh	Amazon Elastic Compute Cloud (Amazon EC2) Security Groups can help manage network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Not allowing ingress (or remote) traffic from 0.0.0.0/0 to port 22 on your resources help you restricting remote access.
SC-7	Boundary Protection	ec2-instances-in-vpc	Deploy Amazon Elastic Compute Cloud (Amazon EC2) instances within an Amazon Virtual Private Cloud (Amazon VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection. All traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. Assign Amazon EC2 instances to an Amazon VPC to properly manage access.
SC-7	Boundary Protection	no-unrestricted-route-to-igw	Ensure Amazon EC2 route tables do not have unrestricted routes to an internet gateway. Removing or limiting the access to the internet for workloads within Amazon VPCs can reduce unintended access within your environment.
SC-7	Boundary Protection	redshift-enhanced-vpc-routing-enabled	Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your Amazon VPC. You can then use VPC features such as security groups and network access control lists to secure network traffic. You can also use VPC flow logs to monitor network traffic.
SC-7	Boundary Protection	ssm-document-not-public	Ensure AWS Systems Manager (SSM) documents are not public, as this may allow unintended access to your SSM documents. A public SSM document can expose information about your account, resources and internal processes.
SC-7	Boundary Protection	dms-replication-not-public	Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed. DMS replication instances can contain sensitive information and access control is required for such accounts.
SC-7	Boundary Protection	ebs-snapshot-public-restorable-check	Manage access to the AWS Cloud by ensuring EBS snapshots are not publicly restorable. EBS volume snapshots can contain sensitive information and access control is required for such accounts.
SC-7	Boundary Protection	ec2-instance-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon Elastic Compute Cloud (Amazon EC2) instances cannot be publicly accessed. Amazon EC2 instances can contain sensitive information and access control is required for such accounts.
SC-7	Boundary Protection	elasticsearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service (OpenSearch Service) Domains are within an Amazon Virtual Private Cloud (Amazon VPC). An OpenSearch Service domain within an Amazon VPC enables secure communication between OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7	Boundary Protection	emr-master-no-public-ip	Manage access to the AWS Cloud by ensuring Amazon EMR cluster master nodes cannot be publicly accessed. Amazon EMR cluster master nodes can contain sensitive information and access control is required for such accounts.
SC-7	Boundary Protection	lambda-function-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring AWS Lambda functions cannot be publicly accessed. Public access can potentially lead to degradation of availability of resources.
SC-7	Boundary Protection	lambda-inside-vpc	Deploy AWS Lambda functions within an Amazon Virtual Private Cloud (Amazon VPC) for a secure communication between a function and other services within the Amazon VPC. With this configuration, there is no requirement for an internet gateway, NAT device, or VPN connection. All the traffic remains securely within the AWS Cloud. Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints. To properly manage access, AWS Lambda functions should be assigned to a VPC.
SC-7	Boundary Protection	opensearch-in-vpc-only	Manage access to the AWS Cloud by ensuring Amazon OpenSearch Service domains are within an Amazon Virtual Private Cloud (Amazon VPC). An Amazon OpenSearch Service domain within an Amazon VPC enables secure communication between Amazon OpenSearch Service and other services within the Amazon VPC without the need for an internet gateway, NAT device, or VPN connection.
SC-7	Boundary Protection	rds-instance-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information, and principles and access control is required for such accounts.
SC-7	Boundary Protection	rds-snapshots-public-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Relational Database Service (Amazon RDS) instances are not public. Amazon RDS database instances can contain sensitive information and principles and access control is required for such accounts.
SC-7	Boundary Protection	redshift-cluster-public-access-check	Manage access to resources in the AWS Cloud by ensuring that Amazon Redshift clusters are not public. Amazon Redshift clusters can contain sensitive information and principles and access control is required for such accounts.
SC-7	Boundary Protection	restricted-common-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) security groups. Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. This rule allows you to optionally set blockedPort1 - blockedPort5 parameters (Config Defaults: 20,21,3389,3306,4333). The actual values should reflect your organization's policies.
SC-7	Boundary Protection	s3-account-level-public-access-blocks-periodic	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access. This rule allows you to optionally set the ignorePublicAcls (Config Default: True), blockPublicPolicy (Config Default: True), blockPublicAcls (Config Default: True), and restrictPublicBuckets parameters (Config Default: True). The actual values should reflect your organization's policies.
SC-7	Boundary Protection	s3-bucket-level-public-access-prohibited	Manage access to resources in the AWS Cloud by ensuring that Amazon Simple Storage Service (Amazon S3) buckets cannot be publicly accessed. This rule helps keeping sensitive data safe from unauthorized remote users by preventing public access at the bucket level.
SC-7	Boundary Protection	s3-bucket-public-read-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7	Boundary Protection	s3-bucket-public-write-prohibited	Manage access to resources in the AWS Cloud by only allowing authorized users, processes, and devices access to Amazon Simple Storage Service (Amazon S3) buckets. The management of access should be consistent with the classification of the data.
SC-7	Boundary Protection	sagemaker-notebook-no-direct-internet-access	Manage access to resources in the AWS Cloud by ensuring that Amazon SageMaker notebooks do not allow direct internet access. By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.
SC-7	Boundary Protection	subnet-auto-assign-public-ip-disabled	Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
SC-7	Boundary Protection	vpc-default-security-group-closed	Amazon Elastic Compute Cloud (Amazon EC2) security groups can help in the management of network access by providing stateful filtering of ingress and egress network traffic to AWS resources. Restricting all the traffic on the default security group helps in restricting remote access to your AWS resources.
SC-7	Boundary Protection	vpc-sg-open-only-to-authorized-ports	Manage access to resources in the AWS Cloud by ensuring common ports are restricted on Amazon Elastic Compute Cloud (Amazon EC2) Security Groups. Not restricting access on ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By restricting access to resources within a security group from the internet (0.0.0.0/0) remote access can be controlled to internal systems.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(1)	Transmission Confidentiality and Integrity | Cryptographic Protection	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8(2)	Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8	Transmission Confidentiality and Integrity	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8	Transmission Confidentiality and Integrity	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-8	Transmission Confidentiality and Integrity	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8	Transmission Confidentiality and Integrity	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-8	Transmission Confidentiality and Integrity	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8	Transmission Confidentiality and Integrity	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8	Transmission Confidentiality and Integrity	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-8	Transmission Confidentiality and Integrity	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-8	Transmission Confidentiality and Integrity	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-8	Transmission Confidentiality and Integrity	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-12(2)	Cryptographic Key Establishment and Management | Symmetric Keys	cmk-backing-key-rotation-enabled	Enable key rotation to ensure that keys are rotated after they have reached the end of their crypto period.
SC-12(2)	Cryptographic Key Establishment and Management | Symmetric Keys	kms-cmk-not-scheduled-for-deletion	To help protect data at rest, ensure necessary customer master keys (CMKs) are not scheduled for deletion in AWS Key Management Service (AWS KMS). Because key deletion is necessary at times, this rule can assist in checking for all keys scheduled for deletion, in case a key was scheduled unintentionally.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-12(3)	Cryptographic Key Establishment and Management | Asymmetric Keys	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-12	Cryptographic Key Establishment and Management	cmk-backing-key-rotation-enabled	Enable key rotation to ensure that keys are rotated after they have reached the end of their crypto period.
SC-12	Cryptographic Key Establishment and Management	kms-cmk-not-scheduled-for-deletion	To help protect data at rest, ensure necessary customer master keys (CMKs) are not scheduled for deletion in AWS Key Management Service (AWS KMS). Because key deletion is necessary at times, this rule can assist in checking for all keys scheduled for deletion, in case a key was scheduled unintentionally.
SC-13	Cryptographic Protection	codebuild-project-artifact-encryption	To help protect sensitive data at rest, ensure encryption is enabled for your AWS CodeBuild artifacts.
SC-13	Cryptographic Protection	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
SC-13	Cryptographic Protection	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-13	Cryptographic Protection	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-13	Cryptographic Protection	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
SC-13	Cryptographic Protection	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-13	Cryptographic Protection	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-13	Cryptographic Protection	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-13	Cryptographic Protection	api-gw-cache-enabled-and-encrypted	To help protect data at rest, ensure encryption is enabled for your API Gateway stage's cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-13	Cryptographic Protection	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
SC-13	Cryptographic Protection	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
SC-13	Cryptographic Protection	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
SC-13	Cryptographic Protection	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-13	Cryptographic Protection	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-13	Cryptographic Protection	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
SC-13	Cryptographic Protection	opensearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service domains.
SC-13	Cryptographic Protection	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SC-13	Cryptographic Protection	redshift-cluster-kms-enabled	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your Amazon Redshift cluster. Because sensitive data can exist at rest in Redshift clusters, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-13	Cryptographic Protection	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
SC-13	Cryptographic Protection	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-13	Cryptographic Protection	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
SC-13	Cryptographic Protection	secretsmanager-using-cmk	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for AWS Secrets Manager secrets. Because sensitive data can exist at rest in Secrets Manager secrets, enable encryption at rest to help protect that data.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23(3)	Session Authenticity | Unique System-generated Session Identifiers	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23(5)	Session Authenticity | Allowed Certificate Authorities	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-23(5)	Session Authenticity | Allowed Certificate Authorities	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-23	Session Authenticity	elasticsearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23	Session Authenticity	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23	Session Authenticity	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SC-23	Session Authenticity	opensearch-node-to-node-encryption-check	Ensure node-to-node encryption for Amazon OpenSearch Service is enabled. Node-to-node encryption enables TLS 1.2 encryption for all communications within the Amazon Virtual Private Cloud (Amazon VPC). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23	Session Authenticity	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23	Session Authenticity	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SC-23	Session Authenticity	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-23	Session Authenticity	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SC-23	Session Authenticity	redshift-require-tls-ssl	Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-23	Session Authenticity	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	codebuild-project-artifact-encryption	To help protect sensitive data at rest, ensure encryption is enabled for your AWS CodeBuild artifacts.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	api-gw-cache-enabled-and-encrypted	To help protect data at rest, ensure encryption is enabled for your API Gateway stage's cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	opensearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service domains.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	redshift-cluster-kms-enabled	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your Amazon Redshift cluster. Because sensitive data can exist at rest in Redshift clusters, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
SC-28(1)	Protection of Information at Rest | Cryptographic Protection	secretsmanager-using-cmk	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for AWS Secrets Manager secrets. Because sensitive data can exist at rest in Secrets Manager secrets, enable encryption at rest to help protect that data.
SC-28(3)	Protection of Information at Rest | Cryptographic Keys	acm-certificate-expiration-check	Ensure network integrity is protected by ensuring X509 certificates are issued by AWS ACM. These certificates must be valid and unexpired. This rule requires a value for daysToExpiration (AWS Foundational Security Best Practices value: 90). The actual value should reflect your organization's policies.
SC-28(3)	Protection of Information at Rest | Cryptographic Keys	cmk-backing-key-rotation-enabled	Enable key rotation to ensure that keys are rotated after they have reached the end of their crypto period.
SC-28	Protection of Information at Rest	codebuild-project-artifact-encryption	To help protect sensitive data at rest, ensure encryption is enabled for your AWS CodeBuild artifacts.
SC-28	Protection of Information at Rest	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
SC-28	Protection of Information at Rest	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
SC-28	Protection of Information at Rest	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	api-gw-cache-enabled-and-encrypted	To help protect data at rest, ensure encryption is enabled for your API Gateway stage's cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
SC-28	Protection of Information at Rest	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
SC-28	Protection of Information at Rest	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
SC-28	Protection of Information at Rest	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
SC-28	Protection of Information at Rest	opensearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service domains.
SC-28	Protection of Information at Rest	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SC-28	Protection of Information at Rest	redshift-cluster-kms-enabled	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your Amazon Redshift cluster. Because sensitive data can exist at rest in Redshift clusters, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
SC-28	Protection of Information at Rest	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
SC-28	Protection of Information at Rest	secretsmanager-using-cmk	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for AWS Secrets Manager secrets. Because sensitive data can exist at rest in Secrets Manager secrets, enable encryption at rest to help protect that data.
SC-36(2)	Distributed Processing and Storage | Synchronization	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
SC-36	Distributed Processing and Storage	elb-cross-zone-load-balancing-enabled	Enable cross-zone load balancing for your Elastic Load Balancers (ELBs) to help maintain adequate capacity and availability. The cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled availability zone. It also improves your application's ability to handle the loss of one or more instances.
SC-36	Distributed Processing and Storage	dynamodb-autoscaling-enabled	Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to adjust provisioned throughput capacity that automatically responds to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read/write capacity to handle sudden increases in traffic, without throttling.
SC-36	Distributed Processing and Storage	rds-multi-az-support	Multi-AZ support in Amazon Relational Database Service (Amazon RDS) provides enhanced availability and durability for database instances. When you provision a Multi-AZ database instance, Amazon RDS automatically creates a primary database instance, and synchronously replicates the data to a standby instance in a different Availability Zone. Each Availability Zone runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable. In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby so that you can resume database operations as soon as the failover is complete.
SC-36	Distributed Processing and Storage	vpc-vpn-2-tunnels-up	Redundant Site-to-Site VPN tunnels can be implemented to achieve resilience requirements. It uses two tunnels to help ensure connectivity in case one of the Site-to-Site VPN connections becomes unavailable. To protect against a loss of connectivity, in case your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your Amazon Virtual Private Cloud (Amazon VPC) and virtual private gateway by using a second customer gateway.
SI-2(2)	Flaw Remediation | Automated Flaw Remediation Status	ec2-managedinstance-patch-compliance-status-check	Enable this rule to help with identification and documentation of Amazon Elastic Compute Cloud (Amazon EC2) vulnerabilities. The rule checks if Amazon EC2 instance patch compliance in AWS Systems Manager as required by your organization's policies and procedures.
SI-2(2)	Flaw Remediation | Automated Flaw Remediation Status	elastic-beanstalk-managed-updates-enabled	Enabling managed platform updates for an Amazon Elastic Beanstalk environment ensures that the latest available platform fixes, updates, and features for the environment are installed. Keeping up to date with patch installation is a best practice in securing systems.
SI-2(2)	Flaw Remediation | Automated Flaw Remediation Status	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
SI-2(3)	Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions	ec2-instance-managed-by-systems-manager	An inventory of the software platforms and applications within the organization is possible by managing Amazon Elastic Compute Cloud (Amazon EC2) instances with AWS Systems Manager. Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.
SI-2(3)	Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions	ec2-managedinstance-association-compliance-status-check	Use AWS Systems Manager Associations to help with inventory of software platforms and applications within an organization. AWS Systems Manager assigns a configuration state to your managed instances and allows you to set baselines of operating system patch levels, software installations, application configurations, and other details about your environment.
SI-2(3)	Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions	ec2-managedinstance-patch-compliance-status-check	Enable this rule to help with identification and documentation of Amazon Elastic Compute Cloud (Amazon EC2) vulnerabilities. The rule checks if Amazon EC2 instance patch compliance in AWS Systems Manager as required by your organization's policies and procedures.
SI-2(4)	Flaw Remediation | Automated Patch Management Tools	ec2-managedinstance-patch-compliance-status-check	Enable this rule to help with identification and documentation of Amazon Elastic Compute Cloud (Amazon EC2) vulnerabilities. The rule checks if Amazon EC2 instance patch compliance in AWS Systems Manager as required by your organization's policies and procedures.
SI-2(4)	Flaw Remediation | Automated Patch Management Tools	elastic-beanstalk-managed-updates-enabled	Enabling managed platform updates for an Amazon Elastic Beanstalk environment ensures that the latest available platform fixes, updates, and features for the environment are installed. Keeping up to date with patch installation is a best practice in securing systems.
SI-2(4)	Flaw Remediation | Automated Patch Management Tools	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
SI-2(5)	Flaw Remediation | Automatic Software and Firmware Updates	ec2-managedinstance-patch-compliance-status-check	Enable this rule to help with identification and documentation of Amazon Elastic Compute Cloud (Amazon EC2) vulnerabilities. The rule checks if Amazon EC2 instance patch compliance in AWS Systems Manager as required by your organization's policies and procedures.
SI-2(5)	Flaw Remediation | Automatic Software and Firmware Updates	elastic-beanstalk-managed-updates-enabled	Enabling managed platform updates for an Amazon Elastic Beanstalk environment ensures that the latest available platform fixes, updates, and features for the environment are installed. Keeping up to date with patch installation is a best practice in securing systems.
SI-2(5)	Flaw Remediation | Automatic Software and Firmware Updates	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
SI-2	Flaw Remediation	lambda-dlq-check	Enable this rule to help notify the appropriate personnel through Amazon Simple Queue Service (Amazon SQS) or Amazon Simple Notification Service (Amazon SNS) when a function has failed.
SI-2	Flaw Remediation	rds-enhanced-monitoring-enabled	Enable Amazon Relational Database Service (Amazon RDS) to help monitor Amazon RDS availability. This provides detailed visibility into the health of your Amazon RDS database instances. When the Amazon RDS storage is using more than one underlying physical device, Enhanced Monitoring collects the data for each device. Also, when the Amazon RDS database instance is running in a Multi-AZ deployment, the data for each device on the secondary host is collected, and the secondary host metrics.
SI-2	Flaw Remediation	autoscaling-group-elb-healthcheck-required	The Elastic Load Balancer (ELB) health checks for Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling groups support maintenance of adequate capacity and availability. The load balancer periodically sends pings, attempts connections, or sends requests to test Amazon EC2 instances health in an auto-scaling group. If an instance is not reporting back, traffic is sent to a new Amazon EC2 instance.
SI-2	Flaw Remediation	beanstalk-enhanced-health-reporting-enabled	AWS Elastic Beanstalk enhanced health reporting enables a more rapid response to changes in the health of the underlying infrastructure. These changes could result in a lack of availability of the application. Elastic Beanstalk enhanced health reporting provides a status descriptor to gauge the severity of the identified issues and identify possible causes to investigate.
SI-2	Flaw Remediation	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
SI-2	Flaw Remediation	dynamodb-throughput-limit-check	Enable this rule to ensure that provisioned throughput capacity is checked on your Amazon DynamoDB tables. This is the amount of read/write activity that each table can support. DynamoDB uses this information to reserve sufficient system resources to meet your throughput requirements. This rule generates an alert when the throughput approaches the maximum limit for a customer's account. This rule allows you to optionally set accountRCUThresholdPercentage (Config Default: 80) and accountWCUThresholdPercentage (Config Default: 80) parameters. The actual values should reflect your organization's policies.
SI-2	Flaw Remediation	ec2-managedinstance-patch-compliance-status-check	Enable this rule to help with identification and documentation of Amazon Elastic Compute Cloud (Amazon EC2) vulnerabilities. The rule checks if Amazon EC2 instance patch compliance in AWS Systems Manager as required by your organization's policies and procedures.
SI-2	Flaw Remediation	elastic-beanstalk-managed-updates-enabled	Enabling managed platform updates for an Amazon Elastic Beanstalk environment ensures that the latest available platform fixes, updates, and features for the environment are installed. Keeping up to date with patch installation is a best practice in securing systems.
SI-2	Flaw Remediation	redshift-cluster-maintenancesettings-check	This rule ensures that Amazon Redshift clusters have the preferred settings for your organization. Specifically, that they have preferred maintenance windows and automated snapshot retention periods for the database. This rule requires you to set the allowVersionUpgrade. The default is true. It also lets you optionally set the preferredMaintenanceWindow (the default is sat:16:00-sat:16:30), and the automatedSnapshotRetentionPeriod (the default is 1). The actual values should reflect your organization's policies.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	s3-event-notifications-enabled	Amazon S3 event notifications can alert relevant personnel of any accidental or intentional modifications on your bucket objects. Example alerts include: new object is creation, object removal, object restoration, lost and replicated objects.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SI-3(8)	Malicious Code Protection | Detect Unauthorized Commands	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
SI-4(1)	System Monitoring | System-wide Intrusion Detection System	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4(2)	System Monitoring | Automated Tools and Mechanisms for Real-time Analysis	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4(4)	System Monitoring | Inbound and Outbound Communications Traffic	s3-event-notifications-enabled	Amazon S3 event notifications can alert relevant personnel of any accidental or intentional modifications on your bucket objects. Example alerts include: new object is creation, object removal, object restoration, lost and replicated objects.
SI-4(4)	System Monitoring | Inbound and Outbound Communications Traffic	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4(5)	System Monitoring | System-generated Alerts	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
SI-4(5)	System Monitoring | System-generated Alerts	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
SI-4(5)	System Monitoring | System-generated Alerts	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4(12)	System Monitoring | Automated Organization-generated Alerts	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
SI-4(13)	System Monitoring | Analyze Traffic and Event Patterns	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4(20)	System Monitoring | Privileged Users	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
SI-4(20)	System Monitoring | Privileged Users	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
SI-4(20)	System Monitoring | Privileged Users	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
SI-4(20)	System Monitoring | Privileged Users	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
SI-4(20)	System Monitoring | Privileged Users	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
SI-4(20)	System Monitoring | Privileged Users	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
SI-4(20)	System Monitoring | Privileged Users	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
SI-4(20)	System Monitoring | Privileged Users	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SI-4(20)	System Monitoring | Privileged Users	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
SI-4(22)	System Monitoring | Unauthorized Network Services	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4(25)	System Monitoring | Optimize Network Traffic Analysis	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-4	System Monitoring	s3-event-notifications-enabled	Amazon S3 event notifications can alert relevant personnel of any accidental or intentional modifications on your bucket objects. Example alerts include: new object is creation, object removal, object restoration, lost and replicated objects.
SI-4	System Monitoring	cloud-trail-log-file-validation-enabled	Utilize AWS CloudTrail log file validation to check the integrity of CloudTrail logs. Log file validation helps determine if a log file was modified or deleted or unchanged after CloudTrail delivered it. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
SI-4	System Monitoring	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.
SI-7(1)	Software, Firmware, and Information Integrity | Integrity Checks	cloud-trail-log-file-validation-enabled	Utilize AWS CloudTrail log file validation to check the integrity of CloudTrail logs. Log file validation helps determine if a log file was modified or deleted or unchanged after CloudTrail delivered it. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
SI-7(3)	Software, Firmware, and Information Integrity | Centrally Managed Integrity Tools	cloud-trail-log-file-validation-enabled	Utilize AWS CloudTrail log file validation to check the integrity of CloudTrail logs. Log file validation helps determine if a log file was modified or deleted or unchanged after CloudTrail delivered it. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	codebuild-project-artifact-encryption	To help protect sensitive data at rest, ensure encryption is enabled for your AWS CodeBuild artifacts.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	dynamodb-table-encrypted-kms	Ensure that encryption is enabled for your Amazon DynamoDB tables. Because sensitive data can exist at rest in these tables, enable encryption at rest to help protect that data. By default, DynamoDB tables are encrypted with an AWS owned customer master key (CMK).
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	ec2-ebs-encryption-by-default	To help protect data at rest, ensure that encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes. Because sensitive data can exist at rest in these volumes, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	elbv2-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	elb-tls-https-listeners-only	Ensure that your Elastic Load Balancers (ELBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	kinesis-stream-encrypted	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Kinesis Streams.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	opensearch-https-required	Because sensitive data can exist and to help protect data in transit, ensure HTTPS is enabled for connections to your Amazon OpenSearch Service domains.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	rds-snapshot-encrypted	Ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) snapshots. Because sensitive data can exist at rest, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	s3-default-encryption-kms	Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	sagemaker-notebook-instance-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker notebook. Because sensitive data can exist at rest in SageMaker notebook, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	sns-encrypted-kms	To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	alb-http-to-https-redirection-check	To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	api-gw-cache-enabled-and-encrypted	To help protect data at rest, ensure encryption is enabled for your API Gateway stage's cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	api-gw-ssl-enabled	Ensure Amazon API Gateway REST API stages are configured with SSL certificates to allow backend systems to authenticate that requests originate from API Gateway.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	cloud-trail-encryption-enabled	Because sensitive data may exist and to help protect data at rest, ensure encryption is enabled for your AWS CloudTrail trails.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	efs-encrypted-check	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	elasticsearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	elb-acm-certificate-required	Because sensitive data can exist and to help protect data at transit, ensure encryption is enabled for your Elastic Load Balancing. Use AWS Certificate Manager to manage, provision and deploy public and private SSL/TLS certificates with AWS services and internal resources.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	encrypted-volumes	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic Block Store (Amazon EBS) volumes.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	opensearch-encrypted-at-rest	Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service domains.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	rds-storage-encrypted	To help protect data at rest, ensure that encryption is enabled for your Amazon Relational Database Service (Amazon RDS) instances. Because sensitive data can exist at rest in Amazon RDS instances, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	redshift-cluster-kms-enabled	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your Amazon Redshift cluster. Because sensitive data can exist at rest in Redshift clusters, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	s3-bucket-server-side-encryption-enabled	To help protect data at rest, ensure encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in Amazon S3 buckets, enable encryption to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	s3-bucket-ssl-requests-only	To help protect data in transit, ensure that your Amazon Simple Storage Service (Amazon S3) buckets require requests to use Secure Socket Layer (SSL). Because sensitive data can exist, enable encryption in transit to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	sagemaker-endpoint-configuration-kms-key-configured	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for your SageMaker endpoint. Because sensitive data can exist at rest in SageMaker endpoint, enable encryption at rest to help protect that data.
SI-7(6)	Software, Firmware, and Information Integrity | Cryptographic Protection	secretsmanager-using-cmk	To help protect data at rest, ensure encryption with AWS Key Management Service (AWS KMS) is enabled for AWS Secrets Manager secrets. Because sensitive data can exist at rest in Secrets Manager secrets, enable encryption at rest to help protect that data.
SI-7(7)	Software, Firmware, and Information Integrity | Integration of Detection and Response	cloud-trail-log-file-validation-enabled	Utilize AWS CloudTrail log file validation to check the integrity of CloudTrail logs. Log file validation helps determine if a log file was modified or deleted or unchanged after CloudTrail delivered it. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	elasticsearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. Domain error logs can assist with security and access audits, and can help to diagnose availability issues.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	multi-region-cloudtrail-enabled	AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from where the calls were made, and when the calls occurred. CloudTrail will deliver log files from all AWS Regions to your S3 bucket if MULTI_REGION_CLOUD_TRAIL_ENABLED is enabled. Additionally, when AWS launches a new Region, CloudTrail will create the same trail in the new Region. As a result, you will receive log files containing API activity for the new Region without taking any action.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	opensearch-logs-to-cloudwatch	Ensure Amazon OpenSearch Service domains have error logs enabled and streamed to Amazon CloudWatch Logs for retention and response. OpenSearch Service error logs can assist with security and access audits, and can help to diagnose availability issues.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	wafv2-logging-enabled	To help with logging and monitoring within your environment, enable AWS WAF (V2) logging on regional and global web ACLs. AWS WAF logging provides detailed information about the traffic that is analyzed by your web ACL. The logs record the time that AWS WAF received the request from your AWS resource, information about the request, and an action for the rule that each request matched.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	api-gw-execution-logging-enabled	API Gateway logging displays detailed views of users who accessed the API and the way they accessed the API. This insight enables visibility of user activities.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	cloudtrail-enabled	AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	cloudtrail-s3-dataevents-enabled	The collection of Simple Storage Service (Amazon S3) data events helps in detecting any anomalous activity. The details include AWS account information that accessed an Amazon S3 bucket, IP address, and time of event.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	elb-logging-enabled	Elastic Load Balancing activity is a central point of communication within an environment. Ensure ELB logging is enabled. The collected data provides detailed information about requests sent to the ELB. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	rds-logging-enabled	To help with logging and monitoring within your environment, ensure Amazon Relational Database Service (Amazon RDS) logging is enabled. With Amazon RDS logging, you can capture events such as connections, disconnections, queries, or tables queried.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	redshift-cluster-configuration-check	To protect data at rest, ensure that encryption is enabled for your Amazon Redshift clusters. You must also ensure that required configurations are deployed on Amazon Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database. This rule requires that a value is set for clusterDbEncrypted (Config Default : TRUE), and loggingEnabled (Config Default: TRUE). The actual values should reflect your organization's policies.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	s3-bucket-logging-enabled	Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.
SI-7(8)	Software, Firmware, and Information Integrity | Auditing Capability for Significant Events	vpc-flow-logs-enabled	The VPC flow logs provide detailed records for information about the IP traffic going to and from network interfaces in your Amazon Virtual Private Cloud (Amazon VPC). By default, the flow log record includes values for the different components of the IP flow, including the source, destination, and protocol.
SI-12	Information Management and Retention	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
SI-12	Information Management and Retention	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SI-12	Information Management and Retention	dynamodb-pitr-enabled	Enable this rule to check that information has been backed up. It also maintains the backups by ensuring that point-in-time recovery is enabled in Amazon DynamoDB. The recovery maintains continuous backups of your table for the last 35 days.
SI-12	Information Management and Retention	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SI-12	Information Management and Retention	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SI-12	Information Management and Retention	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
SI-12	Information Management and Retention	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
SI-13(5)	Predictable Failure Prevention | Failover Capability	dynamodb-in-backup-plan	To help with data back-up processes, ensure your Amazon DynamoDB tables are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SI-13(5)	Predictable Failure Prevention | Failover Capability	ebs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic Block Store (Amazon EBS) volumes are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SI-13(5)	Predictable Failure Prevention | Failover Capability	efs-in-backup-plan	To help with data back-up processes, ensure your Amazon Elastic File System (Amazon EFS) file systems are a part of an AWS Backup plan. AWS Backup is a fully managed backup service with a policy-based backup solution. This solution simplifies your backup management and enables you to meet your business and regulatory backup compliance requirements.
SI-13(5)	Predictable Failure Prevention | Failover Capability	elb-cross-zone-load-balancing-enabled	Enable cross-zone load balancing for your Elastic Load Balancers (ELBs) to help maintain adequate capacity and availability. The cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled availability zone. It also improves your application's ability to handle the loss of one or more instances.
SI-13(5)	Predictable Failure Prevention | Failover Capability	rds-instance-deletion-protection-enabled	Ensure Amazon Relational Database Service (Amazon RDS) instances have deletion protection enabled. Use deletion protection to prevent your Amazon RDS instances from being accidentally or maliciously deleted, which can lead to loss of availability for your applications.
SI-13(5)	Predictable Failure Prevention | Failover Capability	redshift-backup-enabled	To help with data back-up processes, ensure your Amazon Redshift clusters have automated snapshots. When automated snapshots are enabled for a cluster, Redshift periodically takes snapshots of that cluster. By default, Redshift takes a snapshot every eight hours or every 5 GB for each node of data changes, or whichever comes first.
SI-13(5)	Predictable Failure Prevention | Failover Capability	s3-version-lifecycle-policy-check	Ensure Amazon S3 lifecycle policies are configured to help define actions that you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
SI-13(5)	Predictable Failure Prevention | Failover Capability	db-instance-backup-enabled	The backup feature of Amazon RDS creates backups of your databases and transaction logs. Amazon RDS automatically creates a storage volume snapshot of your DB instance, backing up the entire DB instance. The system allows you to set specific retention periods to meet your resilience requirements.
SI-13(5)	Predictable Failure Prevention | Failover Capability	dynamodb-autoscaling-enabled	Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to adjust provisioned throughput capacity that automatically responds to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read/write capacity to handle sudden increases in traffic, without throttling.
SI-13(5)	Predictable Failure Prevention | Failover Capability	dynamodb-pitr-enabled	Enable this rule to check that information has been backed up. It also maintains the backups by ensuring that point-in-time recovery is enabled in Amazon DynamoDB. The recovery maintains continuous backups of your table for the last 35 days.
SI-13(5)	Predictable Failure Prevention | Failover Capability	elasticache-redis-cluster-automatic-backup-check	When automatic backups are enabled, Amazon ElastiCache creates a backup of the cluster on a daily basis. The backup can be retained for a number of days as specified by your organization. Automatic backups can help guard against data loss. If a failure occurs, you can create a new cluster, which restores your data from the most recent backup.
SI-13(5)	Predictable Failure Prevention | Failover Capability	rds-multi-az-support	Multi-AZ support in Amazon Relational Database Service (Amazon RDS) provides enhanced availability and durability for database instances. When you provision a Multi-AZ database instance, Amazon RDS automatically creates a primary database instance, and synchronously replicates the data to a standby instance in a different Availability Zone. Each Availability Zone runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable. In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby so that you can resume database operations as soon as the failover is complete.
SI-13(5)	Predictable Failure Prevention | Failover Capability	s3-bucket-replication-enabled	Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.
SI-13(5)	Predictable Failure Prevention | Failover Capability	s3-bucket-versioning-enabled	Amazon Simple Storage Service (Amazon S3) bucket versioning helps keep multiple variants of an object in the same Amazon S3 bucket. Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.
SI-13(5)	Predictable Failure Prevention | Failover Capability	vpc-vpn-2-tunnels-up	Redundant Site-to-Site VPN tunnels can be implemented to achieve resilience requirements. It uses two tunnels to help ensure connectivity in case one of the Site-to-Site VPN connections becomes unavailable. To protect against a loss of connectivity, in case your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your Amazon Virtual Private Cloud (Amazon VPC) and virtual private gateway by using a second customer gateway.
SI-20	Tainting	cloudwatch-alarm-action-check	Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.
SI-20	Tainting	cloud-trail-cloud-watch-logs-enabled	Use Amazon CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
SI-20	Tainting	guardduty-enabled-centralized	Amazon GuardDuty can help to monitor and detect potential cybersecurity events by using threat intelligence feeds. These include lists of malicious IPs and machine learning to identify unexpected, unauthorized, and malicious activity within your AWS Cloud environment.

Template

The template is available on GitHub: Operational Best Practices for NIST 800-53 rev 5.