Security Hub controls reference
This controls reference provides a list of available AWS Security Hub controls with links to more information about each control. The overview table displays the controls in alphabetical order by control ID. The table provides the following information for each control:
-
Security control ID. This ID applies across standards and indicates the AWS service and resource that the control relates to. The Security Hub console displays security control IDs, regardless of whether consolidated control findings is turned on or off in your account. However, Security Hub findings reference security control IDs only if consolidated control findings is turned on in your account. If consolidated control findings is turned off in your account, Security Hub findings reference standard-specific control IDs.
-
Related requirements (where applicable) from third-party compliance frameworks
-
Security control title. This title applies across standards. The Security Hub console displays security control titles, regardless of whether consolidated control findings is turned on or off in your account. However, Security Hub findings reference security control titles only if consolidated control findings is turned on in your account. If consolidated control findings is turned off in your account, Security Hub findings reference standard-specific control titles.
-
Severity of the control. See Assigning severity to control findings to understand how Security Hub determines the severity level of a control.
-
Schedule type that indicates when the control is evaluated
Select a control to view further details.
Consolidated controls view and consolidated control findings aren't supported in the AWS GovCloud (US) Region and China Regions. In these Regions, control IDs and titles remain the same and may reference standard-specific information. For a list of control IDs and titles in these Regions, see How consolidation impacts control IDs and titles.
Security control ID | Related requirements | Security control title | Severity | Schedule type |
---|---|---|---|---|
NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
Security contact information should be provided for an AWS account |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
AWS accounts should be part of an AWS Organizations organization |
HIGH |
Periodic |
|
NIST.800-53.r5 SC-28(3), NIST.800-53.r5 SC-7(16) |
Imported and ACM-issued certificates should be renewed after a specified time period |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-7(8) |
API Gateway REST and WebSocket API execution logging should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
API Gateway REST API stages should be configured to use SSL certificates for backend authentication |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-7 |
API Gateway REST API stages should have AWS X-Ray tracing enabled |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-4(21) |
API Gateway should be associated with a WAF Web ACL |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
API Gateway REST API cache data should be encrypted at rest |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-3, NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
API Gateway routes should specify an authorization type |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-7(8) |
Access logging should be configured for API Gateway V2 Stages |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/2.2, NIST.800-53.r5 CA-7, NIST.800-53.r5 CP-2(2), NIST.800-53.r5 SI-2 |
Auto Scaling groups associated with a Classic Load Balancer should use load balancer health checks |
LOW |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-2(2), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Amazon EC2 Auto Scaling group should cover multiple Availability Zones |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2) |
HIGH |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
Auto Scaling group launch configuration should not have a metadata response hop limit greater than 1 |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses |
HIGH |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-2(2), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Auto Scaling groups should use multiple instance types in multiple Availability Zones |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
EC2 Auto Scaling groups should use EC2 launch templates |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 SI-4(12), NIST.800-53.r5 SI-4(5) |
CloudFormation stacks should be integrated with Simple Notification Service (SNS) |
LOW |
Change triggered |
|
NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16) |
CloudFront distributions should have a default root object configured |
CRITICAL |
Change triggered |
|
NIST.800-53.r5 SC-7(11) |
CloudFront distributions should have origin access identity enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
CloudFront distributions should require encryption in transit |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
CloudFront distributions should have origin failover configured |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
CloudFront distributions should have logging enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(21) |
CloudFront distributions should have WAF enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
CloudFront distributions should use custom SSL/TLS certificates |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
CloudFront distributions should use SNI to serve HTTPS requests |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
CloudFront distributions should encrypt traffic to custom origins |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
CloudFront distributions should not point to non-existent S3 origins |
HIGH |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/2.1, CIS AWS Foundations Benchmark v1.4.0/3.1, NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-14(1), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8), NIST.800-53.r5 SA-8(22) |
CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events |
HIGH |
Periodic |
|
PCI DSS v3.2.1/3.4, CIS AWS Foundations Benchmark v1.2.0/2.7, CIS AWS Foundations Benchmark v1.4.0/3.7, NIST.800-53.r5 AU-9, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
CloudTrail should have encryption at-rest enabled |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/10.1, PCI DSS v3.2.1/10.2.1, PCI DSS v3.2.1/10.2.2, PCI DSS v3.2.1/10.2.3, PCI DSS v3.2.1/10.2.4, PCI DSS v3.2.1/10.2.5, PCI DSS v3.2.1/10.2.6, PCI DSS v3.2.1/10.2.7, PCI DSS v3.2.1/10.3.1, PCI DSS v3.2.1/10.3.2, PCI DSS v3.2.1/10.3.3, PCI DSS v3.2.1/10.3.4, PCI DSS v3.2.1/10.3.5, PCI DSS v3.2.1/10.3.6 |
CloudTrail should be enabled |
HIGH |
Periodic |
|
PCI DSS v3.2.1/10.5.2, PCI DSS v3.2.1/10.5.5, CIS AWS Foundations Benchmark v1.2.0/2.2, CIS AWS Foundations Benchmark v1.4.0/3.2, NIST.800-53.r5 AU-9, NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-7(1), NIST.800-53.r5 SI-7(3), NIST.800-53.r5 SI-7(7) |
CloudTrail log file validation should be enabled |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/10.5.3, CIS AWS Foundations Benchmark v1.2.0/2.4, CIS AWS Foundations Benchmark v1.4.0/3.4, NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 AU-7(1), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-20, NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-4(5), NIST.800-53.r5 SI-7(8) |
CloudTrail trails should be integrated with Amazon CloudWatch Logs |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/2.3, CIS AWS Foundations Benchmark v1.4.0/3.3 |
Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible |
CRITICAL |
Periodic and change triggered |
|
CIS AWS Foundations Benchmark v1.2.0/2.6, CIS AWS Foundations Benchmark v1.4.0/3.6 |
Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket |
LOW |
Periodic |
|
PCI DSS v3.2.1/7.2.1, CIS AWS Foundations Benchmark v1.2.0/1.1, CIS AWS Foundations Benchmark v1.2.0/3.3, CIS AWS Foundations Benchmark v1.4.0/1.7, CIS AWS Foundations Benchmark v1.4.0/4.3 |
A log metric filter and alarm should exist for usage of the "root" user |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.1 |
Ensure a log metric filter and alarm exist for unauthorized API calls |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.2 |
Ensure a log metric filter and alarm exist for Management Console sign-in without MFA |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.4, CIS AWS Foundations Benchmark v1.4.0/4.4 |
Ensure a log metric filter and alarm exist for IAM policy changes |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.5, CIS AWS Foundations Benchmark v1.4.0/4.5 |
Ensure a log metric filter and alarm exist for CloudTrail configuration changes |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.6, CIS AWS Foundations Benchmark v1.4.0/4.6 |
Ensure a log metric filter and alarm exist for AWS Management Console authentication failures |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.7, CIS AWS Foundations Benchmark v1.4.0/4.7 |
Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.8, CIS AWS Foundations Benchmark v1.4.0/4.8 |
Ensure a log metric filter and alarm exist for S3 bucket policy changes |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.9, CIS AWS Foundations Benchmark v1.4.0/4.9 |
Ensure a log metric filter and alarm exist for AWS Config configuration changes |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.10, CIS AWS Foundations Benchmark v1.4.0/4.10 |
Ensure a log metric filter and alarm exist for security group changes |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.11, CIS AWS Foundations Benchmark v1.4.0/4.11 |
Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.12, CIS AWS Foundations Benchmark v1.4.0/4.12 |
Ensure a log metric filter and alarm exist for changes to network gateways |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.13, CIS AWS Foundations Benchmark v1.4.0/4.13 |
Ensure a log metric filter and alarm exist for route table changes |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/3.14, CIS AWS Foundations Benchmark v1.4.0/4.14 |
Ensure a log metric filter and alarm exist for VPC changes |
LOW |
Periodic |
|
NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 CA-7, NIST.800-53.r5 IR-4(1), NIST.800-53.r5 IR-4(5), NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-20, NIST.800-53.r5 SI-4(12), NIST.800-53.r5 SI-4(5) |
CloudWatch alarms should have an action configured for the ALARM state |
HIGH |
Change triggered |
|
NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-11, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12 |
CloudWatch log groups should be retained for at least 1 year |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-4(12) |
CloudWatch alarm actions should be activated |
HIGH |
Change triggered |
|
PCI DSS v3.2.1/8.2.1, NIST.800-53.r5 SA-3 |
CodeBuild GitHub or Bitbucket source repository URLs should use OAuth |
CRITICAL |
Change triggered |
|
PCI DSS v3.2.1/8.2.1, NIST.800-53.r5 IA-5(7), NIST.800-53.r5 SA-3 |
CodeBuild project environment variables should not contain clear text credentials |
CRITICAL |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6) |
CodeBuild S3 logs should be encrypted |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-9(7), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
CodeBuild project environments should have a logging configuration |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2) |
CodeBuild project environments should not have privileged mode enabled |
HIGH |
Change triggered |
|
PCI DSS v3.2.1/10.5.2, PCI DSS v3.2.1/11.5, CIS AWS Foundations Benchmark v1.2.0/2.5, CIS AWS Foundations Benchmark v1.4.0/3.5, NIST.800-53.r5 CM-3, NIST.800-53.r5 CM-6(1), NIST.800-53.r5 CM-8, NIST.800-53.r5 CM-8(2) |
AWS Config should be enabled |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Database Migration Service replication instances should not be public |
CRITICAL |
Periodic |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-2(2), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
DynamoDB tables should automatically scale capacity with demand |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
DynamoDB tables should have point-in-time recovery enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
DynamoDB Accelerator (DAX) clusters should be encrypted at rest |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
DynamoDB tables should be covered by a backup plan |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
EBS snapshots should not be publicly restorable |
CRITICAL |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/2.1, CIS AWS Foundations Benchmark v1.2.0/4.3, CIS AWS Foundations Benchmark v1.4.0/5.3, NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
The VPC default security group should not allow inbound and outbound traffic |
HIGH |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
Attached EBS volumes should be encrypted at-rest |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
Stopped EC2 instances should be removed after a specified time period |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/2.9, PCI DSS v3.2.1/10.3.3, PCI DSS v3.2.1/10.3.4, PCI DSS v3.2.1/10.3.5, PCI DSS v3.2.1/10.3.6, CIS AWS Foundations Benchmark v1.4.0/3.9, NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-7(8) |
VPC flow logging should be enabled in all VPCs |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.4.0/2.2.1, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
EBS default encryption should be enabled |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6 |
EC2 instances should use Instance Metadata Service Version 2 (IMDSv2) |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
EC2 instances should not have a public IPv4 address |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4) |
Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/2.4, NIST.800-53.r5 CM-8(1) |
Unused EC2 EIPs should be removed |
LOW |
Change triggered |
|
CIS AWS Foundations Benchmark v1.2.0/4.1, PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/2.2.2, NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CM-7, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
Security groups should not allow ingress from 0.0.0.0/0 to port 22 |
HIGH |
Change triggered |
|
CIS AWS Foundations Benchmark v1.2.0/4.2 |
Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
EC2 subnets should not automatically assign public IP addresses |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CM-8(1) |
Unused Network Access Control Lists should be removed |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-4(21) |
EC2 instances should not use multiple ENIs |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
Security groups should only allow unrestricted incoming traffic for authorized ports |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-7, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
Security groups should not allow unrestricted access to ports with high risk |
CRITICAL |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Both VPN tunnels for an AWS Site-to-Site VPN connection should be up |
MEDIUM |
Change triggered |
|
CIS AWS Foundations Benchmark v1.4.0/5.1, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-7, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(5) |
Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389 |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CM-8(1) |
Unused EC2 security groups should be removed |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
EC2 Transit Gateways should not automatically accept VPC attachment requests |
HIGH |
Change triggered |
|
NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
EC2 paravirtual instance types should not be used |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
EC2 launch templates should not assign public IPs to network interfaces |
HIGH |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
EBS volumes should be covered by a backup plan |
LOW |
Periodic |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
EC2 instances should be launched in a VPC |
HIGH |
Change triggered |
|
NIST.800-53.r5 RA-5 |
ECR private repositories should have image scanning configured |
HIGH |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-8(1) |
ECR private repositories should have tag immutability configured |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
ECR repositories should have at least one lifecycle policy configured |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6 |
Amazon ECS task definitions should have secure networking modes and user definitions. |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
ECS services should not have public IP addresses assigned to them automatically |
HIGH |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
ECS task definitions should not share the host's process namespace |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6 |
ECS containers should run as non-privileged |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6 |
ECS containers should be limited to read-only access to root filesystems |
HIGH |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Secrets should not be passed as container environment variables |
HIGH |
Change triggered |
|
NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
ECS Fargate services should run on the latest Fargate platform version |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
ECS clusters should use Container Insights |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
Elastic File System should be configured to encrypt file data at-rest using AWS KMS |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
Amazon EFS volumes should be in backup plans |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-6(10) |
EFS access points should enforce a root directory |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-6(2) |
EFS access points should enforce a user identity |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
EKS clusters should run on a supported Kubernetes version |
HIGH |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
ElastiCache Redis clusters should have automatic backup enabled |
HIGH |
Periodic |
|
NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
ElastiCache for Redis cache clusters should have auto minor version upgrades enabled |
HIGH |
Periodic |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
ElastiCache replication groups should have automatic failover enabled |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
ElastiCache replication groups should have encryption-at-rest enabled |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
ElastiCache replication groups should have encryption-in-transit enabled |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6 |
ElastiCache replication groups of earlier Redis versions should have Redis AUTH enabled |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
ElastiCache clusters should not use the default subnet group |
HIGH |
Periodic |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
Elastic Beanstalk environments should have enhanced health reporting enabled |
LOW |
Change triggered |
|
NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
Elastic Beanstalk managed platform updates should be enabled |
HIGH |
Change triggered |
|
PCI DSS v3.2.1/2.3, PCI DSS v3.2.1/4.1, NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
Application Load Balancer should be configured to redirect all HTTP requests to HTTPS |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(5), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
Classic Load Balancer listeners should be configured with HTTPS or TLS termination |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8(2) |
Application Load Balancer should be configured to drop http headers |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-7(8) |
Application and Classic Load Balancers logging should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2) |
Application Load Balancer deletion protection should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Classic Load Balancers should have connection draining enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
Classic Load Balancers with SSL listeners should use a predefined security policy that has strong configuration |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Classic Load Balancers should have cross-zone load balancing enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Classic Load Balancer should span multiple Availability Zones |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Application Load Balancer should be configured with defensive or strictest desync mitigation mode |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Application, Network and Gateway Load Balancers should span multiple Availability Zones |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Classic Load Balancer should be configured with defensive or strictest desync mitigation mode |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Amazon Elastic MapReduce cluster master nodes should not have public IP addresses |
HIGH |
Periodic |
|
PCI DSS v3.2.1/3.4, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
Elasticsearch domains should have encryption at-rest enabled |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Elasticsearch domains should be in a VPC |
CRITICAL |
Periodic |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2) |
Elasticsearch domains should encrypt data sent between nodes |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
Elasticsearch domain error logging to CloudWatch Logs should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
Elasticsearch domains should have audit logging enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Elasticsearch domains should have at least three data nodes |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
Elasticsearch domains should be configured with at least three dedicated master nodes |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
Connections to Elasticsearch domains should be encrypted using TLS 1.2 |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/11.4, NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 CA-7, NIST.800-53.r5 CM-8(3), NIST.800-53.r5 RA-3(4), NIST.800-53.r5 SA-11(1), NIST.800-53.r5 SA-11(6), NIST.800-53.r5 SA-15(2), NIST.800-53.r5 SA-15(8), NIST.800-53.r5 SA-8(19), NIST.800-53.r5 SA-8(21), NIST.800-53.r5 SA-8(25), NIST.800-53.r5 SC-5, NIST.800-53.r5 SC-5(1), NIST.800-53.r5 SC-5(3), NIST.800-53.r5 SI-20, NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(1), NIST.800-53.r5 SI-4(13), NIST.800-53.r5 SI-4(2), NIST.800-53.r5 SI-4(22), NIST.800-53.r5 SI-4(25), NIST.800-53.r5 SI-4(4), NIST.800-53.r5 SI-4(5) |
GuardDuty should be enabled |
HIGH |
Periodic |
|
PCI DSS v3.2.1/7.2.1, CIS AWS Foundations Benchmark v1.2.0/1.22, CIS AWS Foundations Benchmark v1.4.0/1.16, NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2), NIST.800-53.r5 AC-6(3) |
IAM policies should not allow full "*" administrative privileges |
HIGH |
Change triggered |
|
PCI DSS v3.2.1/7.2.1, CIS AWS Foundations Benchmark v1.2.0/1.16, NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3) |
IAM users should not have IAM policies attached |
LOW |
Change triggered |
|
CIS AWS Foundations Benchmark v1.2.0/1.4, CIS AWS Foundations Benchmark v1.4.0/1.14, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-2(3), NIST.800-53.r5 AC-3(15) |
IAM users' access keys should be rotated every 90 days or less |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/2.1, PCI DSS v3.2.1/2.2, PCI DSS v3.2.1/7.2.1, CIS AWS Foundations Benchmark v1.2.0/1.12, CIS AWS Foundations Benchmark v1.4.0/1.4, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2) |
IAM root user access key should not exist |
CRITICAL |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.2, CIS AWS Foundations Benchmark v1.4.0/1.10, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 IA-2(1), NIST.800-53.r5 IA-2(2), NIST.800-53.r5 IA-2(6), NIST.800-53.r5 IA-2(8) |
MFA should be enabled for all IAM users that have a console password |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/8.3.1, CIS AWS Foundations Benchmark v1.2.0/1.14, CIS AWS Foundations Benchmark v1.4.0/1.6, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 IA-2(1), NIST.800-53.r5 IA-2(2), NIST.800-53.r5 IA-2(6), NIST.800-53.r5 IA-2(8) |
Hardware MFA should be enabled for the root user |
CRITICAL |
Periodic |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-2(3), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 IA-5(1) |
Password policies for IAM users should have strong configurations |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/8.1.4, CIS AWS Foundations Benchmark v1.2.0/1.3, NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-2(3), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6 |
Unused IAM user credentials should be removed |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/8.3.1, CIS AWS Foundations Benchmark v1.2.0/1.13, CIS AWS Foundations Benchmark v1.4.0/1.5, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 IA-2(1), NIST.800-53.r5 IA-2(2), NIST.800-53.r5 IA-2(6), NIST.800-53.r5 IA-2(8) |
Virtual MFA should be enabled for the root user |
CRITICAL |
Periodic |
|
PCI DSS v3.2.1/8.1.4, PCI DSS v3.2.1/8.2.3, PCI DSS v3.2.1/8.2.4, PCI DSS v3.2.1/8.2.5 |
Password policies for IAM users should have strong configurations |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.5 |
Ensure IAM password policy requires at least one uppercase letter |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.6 |
Ensure IAM password policy requires at least one lowercase letter |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.7 |
Ensure IAM password policy requires at least one symbol |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.8 |
Ensure IAM password policy requires at least one number |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.9, CIS AWS Foundations Benchmark v1.4.0/1.8 |
Ensure IAM password policy requires minimum password length of 14 or greater |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.10, CIS AWS Foundations Benchmark v1.4.0/1.9 |
Ensure IAM password policy prevents password reuse |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.11 |
Ensure IAM password policy expires passwords within 90 days or less |
LOW |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.20, CIS AWS Foundations Benchmark v1.4.0/1.17 |
Ensure a support role has been created to manage incidents with AWS Support |
LOW |
Periodic |
|
PCI DSS v3.2.1/8.3.1, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 IA-2(1), NIST.800-53.r5 IA-2(2), NIST.800-53.r5 IA-2(6), NIST.800-53.r5 IA-2(8) |
MFA should be enabled for all IAM users |
MEDIUM |
Periodic |
|
CIS AWS Foundations Benchmark v1.2.0/1.1 |
Avoid the use of the root user |
LOW |
Periodic |
|
NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2), NIST.800-53.r5 AC-6(3) |
IAM customer managed policies that you create should not allow wildcard actions for services |
LOW |
Change triggered |
|
CIS AWS Foundations Benchmark v1.4.0/1.12 |
IAM user credentials unused for 45 days should be removed |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
Kinesis streams should be encrypted at rest |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3) |
IAM customer managed policies should not allow decryption actions on all KMS keys |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3) |
IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-12(2) |
AWS KMS keys should not be deleted unintentionally |
CRITICAL |
Periodic |
|
PCI DSS v3.2.1/3.6.4, CIS AWS Foundations Benchmark v1.2.0/2.8, CIS AWS Foundations Benchmark v1.4.0/3.8, NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-28(3) |
AWS KMS key rotation should be enabled |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Lambda function policies should prohibit public access |
CRITICAL |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
Lambda functions should use supported runtimes |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Lambda functions should be in a VPC |
LOW |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
VPC Lambda functions should operate in more than one Availability Zone |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Network Firewall policies should have at least one rule group associated |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
The default stateless action for Network Firewall policies should be drop or forward for full packets |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
The default stateless action for Network Firewall policies should be drop or forward for fragmented packets |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(5) |
Stateless network firewall rule group should not be empty |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6) |
OpenSearch domains should have encryption at rest enabled |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
OpenSearch domains should be in a VPC |
CRITICAL |
Change triggered |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2) |
OpenSearch domains should encrypt data sent between nodes |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
OpenSearch domain error logging to CloudWatch Logs should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
OpenSearch domains should have audit logging enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
OpenSearch domains should have at least three data nodes |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6 |
OpenSearch domains should have fine-grained access control enabled |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
Connections to OpenSearch domains should be encrypted using TLS 1.2 |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
RDS snapshot should be private |
CRITICAL |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration |
CRITICAL |
Change triggered |
|
CIS AWS Foundations Benchmark v1.4.0/2.3.1, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
RDS DB instances should have encryption at-rest enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
RDS cluster snapshots and database snapshots should be encrypted at rest |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
RDS DB instances should be configured with multiple Availability Zones |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
Enhanced monitoring should be configured for RDS DB instances |
LOW |
Change triggered |
|
NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2) |
RDS clusters should have deletion protection enabled |
LOW |
Change triggered |
|
NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
RDS DB instances should have deletion protection enabled |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
Database logging should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6 |
IAM authentication should be configured for RDS instances |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
RDS instances should have automatic backups enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6 |
IAM authentication should be configured for RDS clusters |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
RDS automatic minor version upgrades should be enabled |
HIGH |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SI-13(5) |
Amazon Aurora clusters should have backtracking enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
RDS DB clusters should be configured for multiple Availability Zones |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
RDS DB clusters should be configured to copy tags to snapshots |
LOW |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) |
RDS DB instances should be configured to copy tags to snapshots |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
RDS instances should be deployed in a VPC |
HIGH |
Change triggered |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
An RDS event notifications subscription should be configured for critical cluster events |
LOW |
Change triggered |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
An RDS event notifications subscription should be configured for critical database instance events |
LOW |
Change triggered |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
An RDS event notifications subscription should be configured for critical database parameter group events |
LOW |
Change triggered |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 |
An RDS event notifications subscription should be configured for critical database security group events |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) |
RDS instances should not use a database engine default port |
LOW |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
RDS Database Clusters should use a custom administrator username |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
RDS database instances should use a custom administrator username |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
RDS DB instances should be covered by a backup plan |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Amazon Redshift clusters should prohibit public access |
CRITICAL |
Change triggered |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2) |
Connections to Amazon Redshift clusters should be encrypted in transit |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-13(5) |
Amazon Redshift clusters should have automatic snapshots enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
Amazon Redshift clusters should have audit logging enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
Amazon Redshift should have automatic upgrades to major versions enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Redshift clusters should use enhanced VPC routing |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Amazon Redshift clusters should not use the default Admin username |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
Redshift clusters should not use the default database name |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, CIS AWS Foundations Benchmark v1.4.0/2.1.5, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
S3 Block Public Access setting should be enabled |
MEDIUM |
Periodic |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.6, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
S3 buckets should prohibit public read access |
CRITICAL |
Periodic and change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
S3 buckets should prohibit public write access |
CRITICAL |
Periodic and change triggered |
|
PCI DSS v3.2.1/3.4, CIS AWS Foundations Benchmark v1.4.0/2.1.1, NIST.800-53.r5 AU-9, NIST.800-53.r5 AU-9(2), NIST.800-53.r5 AU-9(7), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
S3 buckets should have server-side encryption enabled |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/4.1, CIS AWS Foundations Benchmark v1.4.0/2.1.2, NIST.800-53.r5 AC-17(2), NIST.800-53.r5 AC-4, NIST.800-53.r5 IA-5(1), NIST.800-53.r5 SC-12(3), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2), NIST.800-53.r5 SI-7(6) |
S3 buckets should require requests to use Secure Socket Layer |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
S3 permissions granted to other AWS accounts in bucket policies should be restricted |
HIGH |
Change triggered |
|
PCI DSS v3.2.1/2.2, NIST.800-53.r5 AU-9(2), NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-36(2), NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
S3 buckets should have cross-Region replication enabled |
LOW |
Change triggered |
|
CIS AWS Foundations Benchmark v1.4.0/2.1.5, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
S3 Block Public Access setting should be enabled at the bucket-level |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) |
S3 bucket server access logging should be enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
S3 buckets with versioning enabled should have lifecycle policies configured |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(4) |
S3 buckets should have event notifications enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6 |
S3 access control lists (ACLs) should not be used to manage user access to buckets |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) |
S3 buckets should have lifecycle policies configured |
LOW |
Change triggered |
|
NIST.800-53.r5 AU-9(2), NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5) |
S3 buckets should use versioning |
LOW |
Change triggered |
|
PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
Amazon SageMaker notebook instances should not have direct internet access |
HIGH |
Periodic |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
SageMaker notebook instances should be launched in a custom VPC |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2) |
Users should not have root access to SageMaker notebook instances |
HIGH |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15) |
Secrets Manager secrets should have automatic rotation enabled |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15) |
Secrets Manager secrets configured with automatic rotation should rotate successfully |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15) |
Remove unused Secrets Manager secrets |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15) |
Secrets Manager secrets should be rotated within a specified number of days |
MEDIUM |
Periodic |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
SNS topics should be encrypted at-rest using AWS KMS |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2 |
Logging of delivery status should be enabled for notification messages sent to a topic |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) |
Amazon SQS queues should be encrypted at rest |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/2.4, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-8, NIST.800-53.r5 CM-8(1), NIST.800-53.r5 CM-8(2), NIST.800-53.r5 CM-8(3), NIST.800-53.r5 SA-15(2), NIST.800-53.r5 SA-15(8), NIST.800-53.r5 SA-3, NIST.800-53.r5 SI-2(3) |
EC2 instances should be managed by AWS Systems Manager |
MEDIUM |
Change triggered |
|
PCI DSS v3.2.1/6.2, NIST.800-53.r5 CM-8(3), NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(3), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) |
EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation |
HIGH |
Change triggered |
|
PCI DSS v3.2.1/2.4, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-8, NIST.800-53.r5 CM-8(1), NIST.800-53.r5 CM-8(3), NIST.800-53.r5 SI-2(3) |
EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT |
LOW |
Change triggered |
|
NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) |
SSM documents should not be public |
CRITICAL |
Periodic |
|
NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-7(8) |
AWS WAF Classic Global Web ACL logging should be enabled |
MEDIUM |
Periodic |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21) |
A WAF Regional rule should have at least one condition |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21) |
A WAF Regional rule group should have at least one rule |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
A WAF Regional web ACL should have at least one rule or rule group |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
A WAF global rule should have at least one condition |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
A WAF global rule group should have at least one rule |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21) |
A WAF global web ACL should have at least one rule or rule group |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 |
A WAFv2 web ACL should have at least one rule or rule group |
MEDIUM |
Change triggered |
|
NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-7(8) |
AWS WAFv2 web ACL logging should be activated |
Low |
Periodic |
Topics
- AWS account controls
- AWS Certificate Manager controls
- Amazon API Gateway controls
- Amazon EC2 Auto Scaling controls
- AWS CloudFormation controls
- Amazon CloudFront controls
- AWS CloudTrail controls
- Amazon CloudWatch controls
- AWS CodeBuild controls
- AWS Config controls
- AWS Database Migration Service controls
- Amazon DynamoDB controls
- Amazon Elastic Container Registry controls
- Amazon ECS controls
- Amazon Elastic Compute Cloud controls
- Amazon Elastic File System controls
- Amazon Elastic Kubernetes Service controls
- Amazon ElastiCache controls
- AWS Elastic Beanstalk controls
- Elastic Load Balancing controls
- Amazon EMR controls
- Elasticsearch controls
- Amazon GuardDuty controls
- AWS Identity and Access Management controls
- Amazon Kinesis controls
- AWS Key Management Service controls
- AWS Lambda controls
- AWS Network Firewall controls
- Amazon OpenSearch Service controls
- Amazon Relational Database Service controls
- Amazon Redshift controls
- Amazon Simple Storage Service controls
- Amazon SageMaker controls
- AWS Secrets Manager controls
- Amazon Simple Notification Service controls
- Amazon Simple Queue Service controls
- Amazon EC2 Systems Manager controls
- AWS WAF controls