CRI Profile v2.2 in Security Hub CSPM

The CRI Profile is a cybersecurity framework developed by the Cyber Risk Institute (CRI), a non-profit coalition of financial institutions and trade associations. The framework harmonizes cybersecurity and regulatory expectations for the financial services sector into a common set of requirements. This lets an organization assess itself once and report against multiple regulations. For more information about the framework and its requirements, see CRI Profile overview on the Cyber Risk Institute website.

AWS Security Hub CSPM provides security controls that support a subset of CRI Profile v2.2 requirements. The controls perform automated security checks for certain AWS services and resources. To enable and manage these controls, you can enable CRI Profile v2.2 as a standard in Security Hub CSPM. Note that the controls don't support CRI Profile v2.2 requirements that require manual checks.

Enabling this standard, and passing the checks for its controls, doesn't by itself establish or certify compliance with CRI Profile v2.2. Compliance depends on organizational and operational practices that Security Hub CSPM can't evaluate.

Controls that apply to the standard

The following list specifies which Security Hub CSPM controls apply to CRI Profile v2.2. To review the details of a control, choose the control.

• [Account.1] Security contact information should be provided for an AWS account

• [Account.2] AWS accounts should be part of an AWS Organizations organization

• [ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period

• [ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits

• [Amplify.2] Amplify branches should be tagged

• [APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled

• [APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication

• [APIGateway.3] API Gateway REST API stages should have AWS X-Ray tracing enabled

• [APIGateway.4] API Gateway should be associated with a WAF Web ACL

• [APIGateway.5] API Gateway REST API cache data should be encrypted at rest

• [APIGateway.8] API Gateway routes should specify an authorization type

• [APIGateway.9] Access logging should be configured for API Gateway V2 Stages

• [AppFlow.1] Amazon AppFlow flows should be tagged

• [AppRunner.1] App Runner services should be tagged

• [AppSync.2] AWS AppSync should have field-level logging enabled

• [AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys

• [Athena.4] Athena workgroups should have logging enabled

• [AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks

• [AutoScaling.2] Amazon EC2 Auto Scaling group should cover multiple Availability Zones

• [AutoScaling.3] Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

• [Autoscaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

• [AutoScaling.6] Auto Scaling groups should use multiple instance types in multiple Availability Zones

• [AutoScaling.9] Amazon EC2 Auto Scaling groups should use Amazon EC2 launch templates

• [Backup.1] AWS Backup recovery points should be encrypted at rest

• [Batch.2] Batch scheduling policies should be tagged

• [Batch.4] Compute resources properties in managed Batch compute environments should be tagged

• [CloudFront.1] CloudFront distributions should have a default root object configured

• [CloudFront.3] CloudFront distributions should require encryption in transit

• [CloudFront.4] CloudFront distributions should have origin failover configured

• [CloudFront.5] CloudFront distributions should have logging enabled

• [CloudFront.6] CloudFront distributions should have WAF enabled

• [CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates

• [CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests

• [CloudFront.9] CloudFront distributions should encrypt traffic to custom origins

• [CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

• [CloudFront.12] CloudFront distributions should not point to non-existent S3 origins

• [CloudFront.13] CloudFront distributions should use origin access control

• [CloudFront.15] CloudFront distributions should use the recommended TLS security policy

• [CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events

• [CloudTrail.2] CloudTrail should have encryption at-rest enabled

• [CloudTrail.3] At least one CloudTrail trail should be enabled

• [CloudTrail.4] CloudTrail log file validation should be enabled

• [CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs

• [CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

• [CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

• [CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user

• [CloudWatch.2] Ensure a log metric filter and alarm exist for unauthorized API calls

• [CloudWatch.3] Ensure a log metric filter and alarm exist for Management Console sign-in without MFA

• [CloudWatch.4] Ensure a log metric filter and alarm exist for IAM policy changes

• [CloudWatch.5] Ensure a log metric filter and alarm exist for CloudTrail configuration changes

• [CloudWatch.6] Ensure a log metric filter and alarm exist for AWS Management Console authentication failures

• [CloudWatch.7] Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys

• [CloudWatch.8] Ensure a log metric filter and alarm exist for S3 bucket policy changes

• [CloudWatch.9] Ensure a log metric filter and alarm exist for AWS Config configuration changes

• [CloudWatch.10] Ensure a log metric filter and alarm exist for security group changes

• [CloudWatch.11] Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)

• [CloudWatch.12] Ensure a log metric filter and alarm exist for changes to network gateways

• [CloudWatch.13] Ensure a log metric filter and alarm exist for route table changes

• [CloudWatch.14] Ensure a log metric filter and alarm exist for VPC changes

• [CloudWatch.15] CloudWatch alarms should have specified actions configured

• [CloudWatch.16] CloudWatch log groups should be retained for a specified time period

• [CloudWatch.17] CloudWatch alarm actions should be activated

• [CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials

• [CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials

• [CodeBuild.3] CodeBuild S3 logs should be encrypted

• [CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration

• [CodeBuild.7] CodeBuild report group exports should be encrypted at rest

• [CodeGuruProfiler.1] CodeGuru Profiler profiling groups should be tagged

• [CodeGuruReviewer.1] CodeGuru Reviewer repository associations should be tagged

• [Cognito.2] Cognito identity pools should not allow unauthenticated identities

• [Cognito.3] Password policies for Cognito user pools should have strong configurations

• [Config.1] AWS Config should be enabled and use the service-linked role for resource recording

• [Connect.2] Connect Customer instances should have CloudWatch logging enabled

• [DataFirehose.1] Firehose delivery streams should be encrypted at rest

• [DataSync.1] DataSync tasks should have logging enabled

• [DataSync.2] DataSync tasks should be tagged

• [DMS.1] Database Migration Service replication instances should not be public

• [DMS.6] DMS replication instances should have automatic minor version upgrade enabled

• [DMS.7] DMS replication tasks for the target database should have logging enabled

• [DMS.8] DMS replication tasks for the source database should have logging enabled

• [DMS.9] DMS endpoints should use SSL

• [DMS.10] DMS endpoints for Neptune databases should have IAM authorization enabled

• [DMS.11] DMS endpoints for MongoDB should have an authentication mechanism enabled

• [DMS.12] DMS endpoints for Redis OSS should have TLS enabled

• [DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest

• [DocumentDB.2] Amazon DocumentDB clusters should have an adequate backup retention period

• [DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public

• [DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs

• [DocumentDB.5] Amazon DocumentDB clusters should have deletion protection enabled

• [DocumentDB.6] Amazon DocumentDB clusters should be encrypted in transit

• [DynamoDB.1] DynamoDB tables should automatically scale capacity with demand

• [DynamoDB.2] DynamoDB tables should have point-in-time recovery enabled

• [DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest

• [DynamoDB.4] DynamoDB tables should be present in a backup plan

• [DynamoDB.6] DynamoDB tables should have deletion protection enabled

• [DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit

• [EC2.1] Amazon EBS snapshots should not be configured to be publicly restorable

• [EC2.2] VPC default security groups should not allow inbound or outbound traffic

• [EC2.3] Attached Amazon EBS volumes should be encrypted at-rest

• [EC2.4] Stopped EC2 instances should be removed after a specified time period

• [EC2.6] VPC flow logging should be enabled in all VPCs

• [EC2.7] EBS default encryption should be enabled

• [EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

• [EC2.9] Amazon EC2 instances should not have a public IPv4 address

• [EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service

• [EC2.12] Unused Amazon EC2 EIPs should be removed

• [EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22

• [EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389

• [EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses

• [EC2.16] Unused Network Access Control Lists should be removed

• [EC2.17] Amazon EC2 instances should not use multiple ENIs

• [EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports

• [EC2.19] Security groups should not allow unrestricted access to ports with high risk

• [EC2.20] Both VPN tunnels for an AWS Site-to-Site VPN connection should be up

• [EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389

• [EC2.22] Unused Amazon EC2 security groups should be removed

• [EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests

• [EC2.24] Amazon EC2 paravirtual instance types should not be used

• [EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces

• [EC2.28] EBS volumes should be covered by a backup plan

• [EC2.51] EC2 Client VPN endpoints should have client connection logging enabled

• [EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports

• [EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports

• [EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

• [EC2.171] EC2 VPN connections should have logging enabled

• [EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

• [EC2.174] EC2 DHCP option sets should be tagged

• [EC2.176] EC2 prefix lists should be tagged

• [EC2.177] EC2 traffic mirror sessions should be tagged

• [EC2.178] EC2 traffic mirror filters should be tagged

• [EC2.180] EC2 network interfaces should have source/destination checking enabled

• [EC2.181] EC2 launch templates should enable encryption for attached EBS volumes

• [ECR.1] ECR private repositories should have image scanning configured

• [ECR.2] ECR private repositories should have tag immutability configured

• [ECR.3] ECR repositories should have at least one lifecycle policy configured

• [ECS.2] ECS services should not have public IP addresses assigned to them automatically

• [ECS.3] ECS task definitions should not share the host's process namespace

• [ECS.4] ECS containers should run as non-privileged

• [ECS.5] ECS task definitions should configure containers to be limited to read-only access to root filesystems

• [ECS.8] Secrets should not be passed as container environment variables

• [ECS.9] ECS task definitions should have a logging configuration

• [ECS.10] ECS Fargate services should run on the latest Fargate platform version

• [ECS.12] ECS clusters should use Container Insights

• [ECS.16] ECS task sets should not automatically assign public IP addresses

• [ECS.17] ECS task definitions should not use host network mode

• [EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS

• [EFS.2] Amazon EFS volumes should be in backup plans

• [EFS.3] EFS access points should enforce a root directory

• [EFS.4] EFS access points should enforce a user identity

• [EFS.6] EFS mount targets should not be associated with subnets that assign public IP addresses on launch

• [EFS.7] EFS file systems should have automatic backups enabled

• [EFS.8] EFS file systems should be encrypted at rest

• [EKS.1] EKS cluster endpoints should not be publicly accessible

• [EKS.2] EKS clusters should run on a supported Kubernetes version

• [EKS.8] EKS clusters should have audit logging enabled

• [ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled

• [ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled

• [ElastiCache.3] ElastiCache replication groups should have automatic failover enabled

• [ElastiCache.4] ElastiCache replication groups should be encrypted at rest

• [ElastiCache.5] ElastiCache replication groups should be encrypted in transit

• [ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

• [ElastiCache.7] ElastiCache clusters should not use the default subnet group

• [ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

• [ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

• [ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch

• [ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

• [ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager

• [ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination

• [ELB.4] Application Load Balancer should be configured to drop invalid http headers

• [ELB.5] Application and Classic Load Balancers logging should be enabled

• [ELB.6] Application, Gateway, and Network Load Balancers should have deletion protection enabled

• [ELB.7] Classic Load Balancers should have connection draining enabled

• [ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong AWS Configuration

• [ELB.9] Classic Load Balancers should have cross-zone load balancing enabled

• [ELB.10] Classic Load Balancer should span multiple Availability Zones

• [ELB.12] Application Load Balancer should be configured with defensive or strictest desync mitigation mode

• [ELB.13] Application, Network and Gateway Load Balancers should span multiple Availability Zones

• [ELB.14] Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

• [ELB.16] Application Load Balancers should be associated with an AWS WAF web ACL

• [ELB.17] Application and Network Load Balancers with listeners should use recommended security policies

• [ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

• [ELB.21] Application and Network Load Balancer target groups should use encrypted health check protocols

• [ELB.22] ELB target groups should use encrypted transport protocols

• [EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses

• [EMR.2] Amazon EMR block public access setting should be enabled

• [EMR.3] Amazon EMR security configurations should be encrypted at rest

• [EMR.4] Amazon EMR security configurations should be encrypted in transit

• [ES.1] Elasticsearch domains should have encryption at-rest enabled

• [ES.2] Elasticsearch domains should not be publicly accessible

• [ES.3] Elasticsearch domains should encrypt data sent between nodes

• [ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled

• [ES.5] Elasticsearch domains should have audit logging enabled

• [ES.6] Elasticsearch domains should have at least three data nodes

• [ES.7] Elasticsearch domains should be configured with at least three dedicated master nodes

• [ES.8] Connections to Elasticsearch domains should be encrypted using the latest TLS security policy

• [EventBridge.3] EventBridge custom event buses should have a resource-based policy attached

• [EventBridge.4] EventBridge global endpoints should have event replication enabled

• [FSx.1] FSx for OpenZFS file systems should be configured to copy tags to backups and volumes

• [FSx.2] FSx for Lustre file systems should be configured to copy tags to backups

• [FSx.3] FSx for OpenZFS file systems should be configured for Multi-AZ deployment

• [FSx.5] FSx for Windows File Server file systems should be configured for Multi-AZ deployment

• [Glue.3] AWS Glue machine learning transforms should be encrypted at rest

• [Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue

• [GuardDuty.1] GuardDuty should be enabled

• [GuardDuty.5] GuardDuty EKS Audit Log Monitoring should be enabled

• [GuardDuty.6] GuardDuty Lambda Protection should be enabled

• [GuardDuty.7] GuardDuty EKS Runtime Monitoring should be enabled

• [GuardDuty.8] GuardDuty Malware Protection for EC2 should be enabled

• [GuardDuty.9] GuardDuty RDS Protection should be enabled

• [GuardDuty.10] GuardDuty S3 Protection should be enabled

• [GuardDuty.11] GuardDuty Runtime Monitoring should be enabled

• [GuardDuty.12] GuardDuty ECS Runtime Monitoring should be enabled

• [GuardDuty.13] GuardDuty EC2 Runtime Monitoring should be enabled

• [IAM.1] IAM policies should not allow full "*" administrative privileges

• [IAM.2] IAM users should not have IAM policies attached

• [IAM.3] IAM users' access keys should be rotated every 90 days or less

• [IAM.4] IAM root user access key should not exist

• [IAM.5] MFA should be enabled for all IAM users that have a console password

• [IAM.6] Hardware MFA should be enabled for the root user

• [IAM.7] Password policies for IAM users should have strong configurations

• [IAM.8] Unused IAM user credentials should be removed

• [IAM.9] MFA should be enabled for the root user

• [IAM.10] Password policies for IAM users should have strong configurations

• [IAM.11] Ensure IAM password policy requires at least one uppercase letter

• [IAM.12] Ensure IAM password policy requires at least one lowercase letter

• [IAM.13] Ensure IAM password policy requires at least one symbol

• [IAM.14] Ensure IAM password policy requires at least one number

• [IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater

• [IAM.16] Ensure IAM password policy prevents password reuse

• [IAM.17] Ensure IAM password policy expires passwords within 90 days or less

• [IAM.18] Ensure a support role has been created to manage incidents with AWS Support

• [IAM.19] MFA should be enabled for all IAM users

• [IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services

• [IAM.22] IAM user credentials unused for 45 days should be removed

• [IAM.26] Expired SSL/TLS certificates managed in IAM should be removed

• [IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached

• [IAM.28] IAM Access Analyzer external access analyzer should be enabled

• [Inspector.1] Amazon Inspector EC2 scanning should be enabled

• [Inspector.2] Amazon Inspector ECR scanning should be enabled

• [Inspector.3] Amazon Inspector Lambda code scanning should be enabled

• [Inspector.4] Amazon Inspector Lambda standard scanning should be enabled

• [IoTTwinMaker.2] AWS IoT TwinMaker workspaces should be tagged

• [IVS.1] IVS playback key pairs should be tagged

• [IVS.2] IVS recording configurations should be tagged

• [Keyspaces.1] Amazon Keyspaces keyspaces should be tagged

• [Kinesis.1] Kinesis streams should be encrypted at rest

• [KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys

• [KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

• [KMS.3] AWS KMS keys should not be deleted unintentionally

• [KMS.4] AWS KMS key rotation should be enabled

• [KMS.5] KMS keys should not be publicly accessible

• [Lambda.1] Lambda function policies should prohibit public access

• [Lambda.2] Lambda functions should use supported runtimes

• [Lambda.3] Lambda functions should be in a VPC

• [Lambda.5] VPC Lambda functions should operate in multiple Availability Zones

• [Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled

• [Macie.1] Amazon Macie should be enabled

• [Macie.2] Macie automated sensitive data discovery should be enabled

• [MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch

• [MQ.5] ActiveMQ brokers should use active/standby deployment mode

• [MQ.6] RabbitMQ brokers should use cluster deployment mode

• [MSK.1] MSK clusters should be encrypted in transit among broker nodes

• [MSK.2] MSK clusters should have enhanced monitoring configured

• [MSK.3] MSK Connect connectors should be encrypted in transit

• [MSK.4] MSK clusters should have public access disabled

• [MSK.5] MSK connectors should have logging enabled

• [MSK.6] MSK clusters should disable unauthenticated access

• [Neptune.1] Neptune DB clusters should be encrypted at rest

• [Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs

• [Neptune.3] Neptune DB cluster snapshots should not be public

• [Neptune.4] Neptune DB clusters should have deletion protection enabled

• [Neptune.5] Neptune DB clusters should have automated backups enabled

• [Neptune.6] Neptune DB cluster snapshots should be encrypted at rest

• [Neptune.7] Neptune DB clusters should have IAM database authentication enabled

• [Neptune.8] Neptune DB clusters should be configured to copy tags to snapshots

• [Neptune.9] Neptune DB clusters should be deployed across multiple Availability Zones

• [NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones

• [NetworkFirewall.2] Network Firewall logging should be enabled

• [NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

• [NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets

• [NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

• [NetworkFirewall.6] Stateless Network Firewall rule group should not be empty

• [NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled

• [NetworkFirewall.10] Network Firewall firewalls should have subnet change protection enabled

• [Opensearch.1] OpenSearch domains should have encryption at rest enabled

• [Opensearch.2] OpenSearch domains should not be publicly accessible

• [Opensearch.3] OpenSearch domains should encrypt data sent between nodes

• [Opensearch.4] OpenSearch domain error logging to CloudWatch Logs should be enabled

• [Opensearch.5] OpenSearch domains should have audit logging enabled

• [Opensearch.6] OpenSearch domains should have at least three data nodes

• [Opensearch.7] OpenSearch domains should have fine-grained access control enabled

• [Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy

• [Opensearch.10] OpenSearch domains should have the latest software update installed

• [Opensearch.11] OpenSearch domains should have at least three dedicated primary nodes

• [PCA.1] AWS Private CA root certificate authority should be disabled

• [RDS.1] RDS snapshot should be private

• [RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration

• [RDS.3] RDS DB instances should have encryption at-rest enabled

• [RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest

• [RDS.5] RDS DB instances should be configured with multiple Availability Zones

• [RDS.6] Enhanced monitoring should be configured for RDS DB instances

• [RDS.7] RDS clusters should have deletion protection enabled

• [RDS.8] RDS DB instances should have deletion protection enabled

• [RDS.9] RDS DB instances should publish logs to CloudWatch Logs

• [RDS.10] IAM authentication should be configured for RDS instances

• [RDS.11] RDS instances should have automatic backups enabled

• [RDS.12] IAM authentication should be configured for RDS clusters

• [RDS.13] RDS automatic minor version upgrades should be enabled

• [RDS.14] Amazon Aurora clusters should have backtracking enabled

• [RDS.15] RDS DB clusters should be configured for multiple Availability Zones

• [RDS.16] Aurora DB clusters should be configured to copy tags to DB snapshots

• [RDS.17] RDS DB instances should be configured to copy tags to snapshots

• [RDS.19] Existing RDS event notification subscriptions should be configured for critical cluster events

• [RDS.20] Existing RDS event notification subscriptions should be configured for critical database instance events

• [RDS.21] An RDS event notifications subscription should be configured for critical database parameter group events

• [RDS.22] An RDS event notifications subscription should be configured for critical database security group events

• [RDS.23] RDS instances should not use a database engine default port

• [RDS.24] RDS Database clusters should use a custom administrator username

• [RDS.25] RDS database instances should use a custom administrator username

• [RDS.26] RDS DB instances should be protected by a backup plan

• [RDS.27] RDS DB clusters should be encrypted at rest

• [RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

• [RDS.35] RDS DB clusters should have automatic minor version upgrade enabled

• [RDS.36] RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs

• [RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

• [RDS.38] RDS for PostgreSQL DB instances should be encrypted in transit

• [RDS.39] RDS for MySQL DB instances should be encrypted in transit

• [RDS.41] RDS for SQL Server DB instances should be encrypted in transit

• [RDS.44] RDS for MariaDB DB instances should be encrypted in transit

• [RDS.45] Aurora MySQL DB clusters should have audit logging enabled

• [Redshift.1] Amazon Redshift clusters should prohibit public access

• [Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit

• [Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled

• [Redshift.4] Amazon Redshift clusters should have audit logging enabled

• [Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled

• [Redshift.7] Redshift clusters should use enhanced VPC routing

• [Redshift.8] Amazon Redshift clusters should not use the default Admin username

• [Redshift.10] Redshift clusters should be encrypted at rest

• [Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins

• [Redshift.16] Redshift cluster subnet groups should have subnets from multiple Availability Zones

• [Redshift.18] Redshift clusters should have Multi-AZ deployments enabled

• [RedshiftServerless.1] Amazon Redshift Serverless workgroups should use enhanced VPC routing

• [RedshiftServerless.2] Connections to Redshift Serverless workgroups should be required to use SSL

• [RedshiftServerless.3] Redshift Serverless workgroups should prohibit public access

• [RedshiftServerless.6] Redshift Serverless namespaces should export logs to CloudWatch Logs

• [Route53.2] Route 53 public hosted zones should log DNS queries

• [S3.1] S3 general purpose buckets should have block public access settings enabled

• [S3.2] S3 general purpose buckets should block public read access

• [S3.3] S3 general purpose buckets should block public write access

• [S3.5] S3 general purpose buckets should require requests to use TLS

• [S3.6] S3 general purpose bucket policies should restrict access to other AWS accounts

• [S3.7] S3 general purpose buckets should use cross-Region replication

• [S3.8] S3 general purpose buckets should block public access

• [S3.9] S3 general purpose buckets should have server access logging enabled

• [S3.10] S3 general purpose buckets with versioning enabled should have Lifecycle configurations

• [S3.11] S3 general purpose buckets should have event notifications enabled

• [S3.12] ACLs should not be used to manage user access to S3 general purpose buckets

• [S3.13] S3 general purpose buckets should have Lifecycle configurations

• [S3.14] S3 general purpose buckets should have versioning enabled

• [S3.15] S3 general purpose buckets should have Object Lock enabled

• [S3.17] S3 general purpose buckets should be encrypted at rest with AWS KMS keys

• [S3.19] S3 access points should have block public access settings enabled

• [S3.20] S3 general purpose buckets should have MFA delete enabled

• [S3.22] S3 general purpose buckets should log object-level write events

• [S3.23] S3 general purpose buckets should log object-level read events

• [S3.24] S3 Multi-Region Access Points should have block public access settings enabled

• [SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access

• [SageMaker.2] SageMaker notebook instances should be launched in a custom VPC

• [SageMaker.3] Users should not have root access to SageMaker notebook instances

• [SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1

• [SageMaker.5] SageMaker models should have network isolation enabled

• [SageMaker.8] SageMaker notebook instances should run on supported platforms

• [SecretsManager.1] Secrets Manager secrets should have automatic rotation enabled

• [SecretsManager.2] Secrets Manager secrets configured with automatic rotation should rotate successfully

• [SecretsManager.3] Remove unused Secrets Manager secrets

• [SecretsManager.4] Secrets Manager secrets should be rotated within a specified number of days

• [ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only

• [SNS.1] SNS topics should be encrypted at-rest using AWS KMS

• [SNS.4] SNS topic access policies should not allow public access

• [SQS.1] Amazon SQS queues should be encrypted at rest

• [SQS.3] SQS queue access policies should not allow public access

• [SSM.1] Amazon EC2 instances should be managed by AWS Systems Manager

• [SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

• [SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT

• [SSM.4] SSM documents should not be public

• [SSM.6] SSM Automation should have CloudWatch logging enabled

• [SSM.7] SSM documents should have the block public sharing setting enabled

• [StepFunctions.1] Step Functions state machines should have logging turned on

• [Transfer.2] Transfer Family servers should not use FTP protocol for endpoint connection

• [Transfer.3] Transfer Family connectors should have logging enabled

• [Transfer.4] Transfer Family agreements should be tagged

• [Transfer.6] Transfer Family connectors should be tagged

• [WAF.1] AWS WAF Classic Global Web ACL logging should be enabled

• [WAF.2] AWS WAF Classic Regional rules should have at least one condition

• [WAF.3] AWS WAF Classic Regional rule groups should have at least one rule

• [WAF.4] AWS WAF Classic Regional web ACLs should have at least one rule or rule group

• [WAF.6] AWS WAF Classic global rules should have at least one condition

• [WAF.7] AWS WAF Classic global rule groups should have at least one rule

• [WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

• [WAF.10] AWS WAF web ACLs should have at least one rule or rule group

• [WAF.11] AWS WAF web ACL logging should be enabled

• [WAF.12] AWS WAF rules should have CloudWatch metrics enabled

• [WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest

• [WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest