aws_compliance

AWS Compliance

Run pipelines to detect and correct AWS resources that are non-compliant with CIS benchmarks.

aws_cis

The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.

aws_cis.pipeline.cis_v300

steampipe.default

database

default

The name of the notifier to use for sending notification messages.

notifier

The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.

notification_level

header

run_pipelines

CIS v3.0.0

This section contains recommendations for configuring identity and access management related options.

aws_cis.pipeline.cis_v300_1

cis_v300_1

1 Identity and Access Management

Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.

aws_cis.pipeline.cis_v300_1_1

List of notifiers to be used for obtaining action/approval decisions.

approvers

run_pipeline

1.1 Maintain current contact detail

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials.

aws_cis.pipeline.cis_v300_1_10

1.10 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

aws_cis.pipeline.cis_v300_1_11

1.11 Do not setup access keys during initial user setup for all IAM users that have a console password

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys.

aws_cis.pipeline.cis_v300_1_12

1.12 Ensure credentials unused for 45 days or greater are disabled

Access keys are long-term credentials for an IAM user or the AWS account 'root' user.

aws_cis.pipeline.cis_v300_1_13

1.13 Ensure there is only one active access key available for any single IAM user

Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS.

aws_cis.pipeline.cis_v300_1_14

1.14 Ensure access keys are rotated every 90 days or less

IAM users are granted access to services, functions, and data through IAM policies.

aws_cis.pipeline.cis_v300_1_15

1.15 Ensure IAM Users Receive Permissions Only Through Groups

IAM policies are the means by which privileges are granted to users, groups, or roles.

aws_cis.pipeline.cis_v300_1_16

1.16 Ensure IAM policies that allow full "*:*" administrative privileges are not attached

AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services.

aws_cis.pipeline.cis_v300_1_17

1.17 Ensure a support role has been created to manage incidents with AWS Support

AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access.

aws_cis.pipeline.cis_v300_1_18

1.18 Ensure IAM instance roles are used for AWS resource access from instance

To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate.

aws_cis.pipeline.cis_v300_1_19

1.19 Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed

AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.

aws_cis.pipeline.cis_v300_1_2

1.2 Ensure security contact information is registered

Enable IAM Access analyzer for IAM policies about all resources in each active AWS region.

aws_cis.pipeline.cis_v300_1_20

1.20 Ensure that IAM Access analyzer is enabled for all regions

In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption.

aws_cis.pipeline.cis_v300_1_21

1.21 Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

AWS CloudShell is a convenient way of running CLI commands against AWS services

aws_cis.pipeline.cis_v300_1_22

1.22 Ensure access to AWSCloudShellFullAccess is restricted

The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.

aws_cis.pipeline.cis_v300_1_3

1.3 Ensure security questions are registered in the AWS account

The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.

aws_cis.pipeline.cis_v300_1_4

1.4 Ensure no 'root' user account access key exists

The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device.

aws_cis.pipeline.cis_v300_1_5

1.5 Ensure MFA is enabled for the 'root' user account

The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password.

aws_cis.pipeline.cis_v300_1_6

1.6 Ensure hardware MFA is enabled for the 'root' user account

With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted.

aws_cis.pipeline.cis_v300_1_7

1.7 Eliminate use of the 'root' user for administrative and daily tasks

Password policies are, in part, used to enforce password complexity requirements.

aws_cis.pipeline.cis_v300_1_8

1.8 Ensure IAM password policy requires minimum length of 14 or greater

IAM password policies can prevent the reuse of a given password by the same user.

aws_cis.pipeline.cis_v300_1_9

1.9 Ensure IAM password policy prevents password reuse

This section contains recommendations for configuring AWS Storage.

aws_cis.pipeline.cis_v300_2

cis_v300_2

2 Storage

At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.

aws_cis.pipeline.cis_v300_2_1_1

2.1.1 Ensure S3 Bucket Policy is set to deny HTTP requests

Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.

aws_cis.pipeline.cis_v300_2_1_2

2.1.2 Ensure MFA Delete is enabled on S3 buckets

Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected.

aws_cis.pipeline.cis_v300_2_1_3

2.1.3 Ensure all data in Amazon S3 has been discovered, classified and secured when required

Amazon S3 provides Block public access (bucket settings) and Block public access (account settings) to help you manage public access to Amazon S3 resources.

aws_cis.pipeline.cis_v300_2_1_4

2.1.4 Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'

Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.

aws_cis.pipeline.cis_v300_2_2_1

2.2.1 Ensure EBS Volume Encryption is Enabled in all Regions

Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances.

aws_cis.pipeline.cis_v300_2_3_1

2.3.1 Ensure that encryption-at-rest is enabled for RDS Instances

Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window.

aws_cis.pipeline.cis_v300_2_3_2

2.3.2 Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances

Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks.

aws_cis.pipeline.cis_v300_2_3_3

2.3.3 Ensure that public access is not given to RDS Instance

EFS data should be encrypted at rest using AWS KMS (Key Management Service).

aws_cis.pipeline.cis_v300_2_4_1

2.4.1 Ensure that encryption is enabled for EFS file systems

This section contains recommendations for configuring AWS logging features.

aws_cis.pipeline.cis_v300_3

cis_v300_3

3 Logging

AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you.

aws_cis.pipeline.cis_v300_3_1

3.1 Ensure CloudTrail is enabled in all regions

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3.

aws_cis.pipeline.cis_v300_3_2

3.2 Ensure CloudTrail log file validation is enabled

CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket.

aws_cis.pipeline.cis_v300_3_3

3.3 Ensure AWS Config is enabled in all regions

S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket.

aws_cis.pipeline.cis_v300_3_4

3.4 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies.

aws_cis.pipeline.cis_v300_3_5

3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs

AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the customercreated customer master key (CMK).

aws_cis.pipeline.cis_v300_3_6

3.6 Ensure rotation for customer-created symmetric CMKs is enabled

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.

aws_cis.pipeline.cis_v300_3_7

3.7 Ensure VPC flow logging is enabled in all VPCs

S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events.

aws_cis.pipeline.cis_v300_3_8

3.8 Ensure that Object-level logging for write events is enabled for S3 bucket

aws_cis.pipeline.cis_v300_3_9

3.9 Ensure that Object-level logging for read events is enabled for S3 bucket

This section contains recommendations for configuring AWS to assist with monitoring and responding to account activities.

aws_cis.pipeline.cis_v300_4

cis_v300_4

4 Monitoring

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs, or an external Security information and event management (SIEM) environment, and establishing corresponding metric filters and alarms.

aws_cis.pipeline.cis_v300_4_1

4.1 Ensure unauthorized API calls are monitored

aws_cis.pipeline.cis_v300_4_10

4.10 Ensure security group changes are monitored

aws_cis.pipeline.cis_v300_4_11

4.11 Ensure Network Access Control Lists (NACL) changes are monitored

aws_cis.pipeline.cis_v300_4_12

4.12 Ensure changes to network gateways are monitored

aws_cis.pipeline.cis_v300_4_13

4.13 Ensure route table changes are monitored

aws_cis.pipeline.cis_v300_4_14

4.14 Ensure VPC changes are monitored

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs, and establishing corresponding metric filters and alarms.

aws_cis.pipeline.cis_v300_4_15

4.15 Ensure AWS Organizations changes are monitored

Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues.

aws_cis.pipeline.cis_v300_4_16

4.16 Ensure AWS Security Hub is enabled

aws_cis.pipeline.cis_v300_4_2

4.2 Ensure management console sign-in without MFA is monitored

aws_cis.pipeline.cis_v300_4_3

4.3 Ensure usage of 'root' account is monitored

aws_cis.pipeline.cis_v300_4_4

4.4 Ensure IAM policy changes are monitored

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs, or an external Security information and event management (SIEM) environment, where metric filters and alarms can be established.

aws_cis.pipeline.cis_v300_4_5

4.5 Ensure CloudTrail configuration changes are monitored

aws_cis.pipeline.cis_v300_4_6

4.6 Ensure AWS Management Console authentication failures are monitored

aws_cis.pipeline.cis_v300_4_7

4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitored

aws_cis.pipeline.cis_v300_4_8

4.8 Ensure S3 bucket policy changes are monitored

aws_cis.pipeline.cis_v300_4_9

4.9 Ensure AWS Config configuration changes are monitored

This section contains recommendations for configuring security-related aspects of AWS Virtual Private Cloud (VPC).

aws_cis.pipeline.cis_v300_5

cis_v300_5

5 Networking

The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources.

aws_cis.pipeline.cis_v300_5_1

5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389, using either the TCP (6), UDP (17) or ALL (-1) protocols.

aws_cis.pipeline.cis_v300_5_2

5.2 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports

Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.

Pipelines