ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cis): rename and add sections and subsections (#7738)

Browse Source
This commit is contained in:
Pedro Martín
2025-05-19 09:42:04 +02:00
committed by GitHub
parent e5f1c2b19c
commit a2362b4bbc
18 changed files with 1892 additions and 1581 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/CHANGELOG.md
+1
View File
@@ -24,6 +24,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
### Fixed
- Update CIS 4.0 for M365 provider. [(#7699)](https://github.com/prowler-cloud/prowler/pull/7699)
- Update and upgrade CIS for all the providers [(#7738)](https://github.com/prowler-cloud/prowler/pull/7738)
- Cover policies with conditions with SNS endpoint in `sns_topics_not_publicly_accessible`. [(#7750)](https://github.com/prowler-cloud/prowler/pull/7750)
- Change severity logic for `ec2_securitygroup_allow_ingress_from_internet_to_all_ports` check. [(#7764)](https://github.com/prowler-cloud/prowler/pull/7764)
prowler/compliance/aws/cis_1.4_aws.json
+64 -64
View File
@@ -12,7 +12,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.",
@@ -33,7 +33,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
@@ -54,7 +54,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.",
@@ -76,7 +76,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.",
@@ -97,7 +97,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)",
@@ -118,7 +118,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
@@ -139,7 +139,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.",
@@ -161,7 +161,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.",
@@ -182,7 +182,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
@@ -203,7 +203,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
@@ -224,7 +224,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
@@ -245,7 +245,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
@@ -266,7 +266,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.",
@@ -287,7 +287,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
@@ -308,7 +308,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.",
@@ -329,7 +329,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.",
@@ -350,7 +350,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.",
@@ -371,7 +371,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.",
@@ -392,7 +392,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
@@ -413,7 +413,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.",
@@ -434,7 +434,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
@@ -455,8 +455,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.",
@@ -477,8 +477,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -499,8 +499,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -521,8 +521,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -544,8 +544,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -566,7 +566,7 @@
],
"Attributes": [
{
"Section": "2. Storage",
"Section": "2 Storage",
"SubSection": "2.2. Elastic Compute Cloud (EC2)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
@@ -589,8 +589,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -611,7 +611,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
@@ -632,7 +632,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -653,7 +653,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -674,7 +674,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.",
@@ -695,7 +695,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.",
@@ -716,7 +716,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.",
@@ -737,7 +737,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.",
@@ -758,7 +758,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.",
@@ -779,7 +779,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
@@ -800,7 +800,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.",
@@ -821,7 +821,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.",
@@ -842,7 +842,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
@@ -863,7 +863,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.",
@@ -884,7 +884,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.",
@@ -905,7 +905,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
@@ -926,7 +926,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
@@ -947,7 +947,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
@@ -968,7 +968,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.",
@@ -989,7 +989,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
@@ -1010,7 +1010,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.",
@@ -1031,7 +1031,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.",
@@ -1052,7 +1052,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1073,7 +1073,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
@@ -1094,7 +1094,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.",
@@ -1115,7 +1115,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
@@ -1136,7 +1136,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1159,7 +1159,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1182,7 +1182,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1203,7 +1203,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
@@ -1224,7 +1224,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.",
prowler/compliance/aws/cis_1.5_aws.json
+72 -72
View File
@@ -12,7 +12,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.",
@@ -33,7 +33,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
@@ -54,7 +54,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.",
@@ -76,7 +76,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.",
@@ -97,7 +97,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)",
@@ -118,7 +118,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
@@ -139,7 +139,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.",
@@ -161,7 +161,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.",
@@ -182,7 +182,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
@@ -203,7 +203,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
@@ -224,7 +224,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
@@ -245,7 +245,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
@@ -266,7 +266,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.",
@@ -287,7 +287,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
@@ -308,7 +308,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.",
@@ -329,7 +329,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.",
@@ -350,7 +350,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.",
@@ -371,7 +371,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.",
@@ -392,7 +392,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
@@ -413,7 +413,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.",
@@ -434,7 +434,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
@@ -455,8 +455,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.",
@@ -477,8 +477,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -499,8 +499,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -521,8 +521,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -544,8 +544,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -566,8 +566,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.2. Elastic Compute Cloud (EC2)",
"Section": "2 Storage",
"SubSection": "2.2 Elastic Compute Cloud (EC2)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -589,8 +589,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -611,8 +611,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
@@ -633,8 +633,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.",
@@ -655,7 +655,7 @@
],
"Attributes": [
{
"Section": "2. Storage",
"Section": "2 Storage",
"SubSection": "2.4 Elastic File System (EFS)",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
@@ -677,7 +677,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
@@ -698,7 +698,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -719,7 +719,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -740,7 +740,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.",
@@ -761,7 +761,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.",
@@ -782,7 +782,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.",
@@ -803,7 +803,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.",
@@ -824,7 +824,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.",
@@ -845,7 +845,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
@@ -866,7 +866,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.",
@@ -887,7 +887,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.",
@@ -908,7 +908,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
@@ -929,7 +929,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.",
@@ -950,7 +950,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.",
@@ -971,7 +971,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
@@ -992,7 +992,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
@@ -1013,7 +1013,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
@@ -1034,7 +1034,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.",
@@ -1055,7 +1055,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
@@ -1076,7 +1076,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
@@ -1097,7 +1097,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.",
@@ -1118,7 +1118,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.",
@@ -1139,7 +1139,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1160,7 +1160,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
@@ -1181,7 +1181,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.",
@@ -1202,7 +1202,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
@@ -1223,7 +1223,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1246,7 +1246,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1269,7 +1269,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1292,7 +1292,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1313,7 +1313,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
@@ -1334,7 +1334,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.",
prowler/compliance/aws/cis_2.0_aws.json
+71 -71
View File
@@ -12,7 +12,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.",
@@ -33,7 +33,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
@@ -54,7 +54,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.",
@@ -76,7 +76,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.",
@@ -97,7 +97,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)",
@@ -118,7 +118,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
@@ -139,7 +139,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.",
@@ -161,7 +161,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.",
@@ -182,7 +182,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
@@ -203,7 +203,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
@@ -224,7 +224,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
@@ -245,7 +245,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
@@ -266,7 +266,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.",
@@ -287,7 +287,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
@@ -308,7 +308,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.",
@@ -329,7 +329,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.",
@@ -350,7 +350,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.",
@@ -371,7 +371,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.",
@@ -392,7 +392,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.",
@@ -413,7 +413,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
@@ -434,7 +434,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.",
@@ -455,7 +455,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
@@ -476,7 +476,7 @@
],
"Attributes": [
{
"Section": "2. Storage",
"Section": "2 Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
@@ -499,8 +499,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -521,8 +521,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -544,8 +544,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -566,8 +566,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.2. Elastic Compute Cloud (EC2)",
"Section": "2 Storage",
"SubSection": "2.2 Elastic Compute Cloud (EC2)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -589,8 +589,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -611,8 +611,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
@@ -633,8 +633,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.",
@@ -655,7 +655,7 @@
],
"Attributes": [
{
"Section": "2. Storage",
"Section": "2 Storage",
"SubSection": "2.4 Elastic File System (EFS)",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
@@ -677,7 +677,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
@@ -698,7 +698,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -719,7 +719,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -740,7 +740,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.",
@@ -761,7 +761,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.",
@@ -782,7 +782,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.",
@@ -803,7 +803,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.",
@@ -824,7 +824,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.",
@@ -845,7 +845,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
@@ -866,7 +866,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.",
@@ -887,7 +887,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.",
@@ -908,7 +908,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
@@ -929,7 +929,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.",
@@ -950,7 +950,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.",
@@ -971,7 +971,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
@@ -992,7 +992,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
@@ -1013,7 +1013,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
@@ -1034,7 +1034,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.",
@@ -1055,7 +1055,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
@@ -1076,7 +1076,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
@@ -1097,7 +1097,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.",
@@ -1118,7 +1118,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.",
@@ -1139,7 +1139,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1160,7 +1160,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
@@ -1181,7 +1181,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.",
@@ -1202,7 +1202,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
@@ -1223,7 +1223,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1246,7 +1246,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1269,7 +1269,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1292,7 +1292,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1313,7 +1313,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
@@ -1334,7 +1334,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.",
@@ -1356,7 +1356,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).",
prowler/compliance/aws/cis_3.0_aws.json
+70 -70
View File
@@ -12,7 +12,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.",
@@ -33,7 +33,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
@@ -54,7 +54,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.",
@@ -76,7 +76,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.",
@@ -97,7 +97,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)",
@@ -118,7 +118,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
@@ -139,7 +139,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.",
@@ -161,7 +161,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.",
@@ -182,7 +182,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
@@ -203,7 +203,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
@@ -224,7 +224,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
@@ -245,7 +245,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
@@ -266,7 +266,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.",
@@ -287,7 +287,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
@@ -306,7 +306,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.",
@@ -327,7 +327,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.",
@@ -348,7 +348,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.",
@@ -369,7 +369,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.",
@@ -390,7 +390,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.",
@@ -411,7 +411,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
@@ -432,7 +432,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.",
@@ -453,7 +453,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
@@ -474,8 +474,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -496,8 +496,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -518,8 +518,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -541,8 +541,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.1. Simple Storage Service (S3)",
"Section": "2 Storage",
"SubSection": "2.1 Simple Storage Service (S3)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -563,8 +563,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.2. Elastic Compute Cloud (EC2)",
"Section": "2 Storage",
"SubSection": "2.2 Elastic Compute Cloud (EC2)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -585,8 +585,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -607,8 +607,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
@@ -629,8 +629,8 @@
],
"Attributes": [
{
"Section": "2. Storage",
"SubSection": "2.3. Relational Database Service (RDS)",
"Section": "2 Storage",
"SubSection": "2.3 Relational Database Service (RDS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to anypublicly accessible RDS database instance, you must disable the database PubliclyAccessible flag and update the VPC security group associated with the instance",
@@ -651,7 +651,7 @@
],
"Attributes": [
{
"Section": "2. Storage",
"Section": "2 Storage",
"SubSection": "2.4 Elastic File System (EFS)",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
@@ -673,7 +673,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
@@ -694,7 +694,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -715,7 +715,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
@@ -736,7 +736,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.",
@@ -757,7 +757,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.",
@@ -778,7 +778,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.",
@@ -799,7 +799,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
@@ -820,7 +820,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.",
@@ -841,7 +841,7 @@
],
"Attributes": [
{
"Section": "3. Logging",
"Section": "3 Logging",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.",
@@ -862,7 +862,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
@@ -883,7 +883,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.",
@@ -904,7 +904,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.",
@@ -925,7 +925,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
@@ -946,7 +946,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
@@ -967,7 +967,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
@@ -988,7 +988,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.",
@@ -1009,7 +1009,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
@@ -1030,7 +1030,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
@@ -1051,7 +1051,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.",
@@ -1072,7 +1072,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.",
@@ -1093,7 +1093,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1114,7 +1114,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
@@ -1135,7 +1135,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.",
@@ -1156,7 +1156,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
@@ -1177,7 +1177,7 @@
],
"Attributes": [
{
"Section": "4. Monitoring",
"Section": "4 Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
@@ -1200,7 +1200,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1223,7 +1223,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1246,7 +1246,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.",
@@ -1267,7 +1267,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
@@ -1288,7 +1288,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.",
@@ -1309,7 +1309,7 @@
],
"Attributes": [
{
"Section": "5. Networking",
"Section": "5 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).",
prowler/compliance/aws/cis_4.0_aws.json
-53
View File
@@ -13,7 +13,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of the Acceptable Use Policy or indicative of a likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.",
@@ -36,7 +35,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
@@ -59,7 +57,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.",
@@ -82,7 +79,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.",
@@ -105,7 +101,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device.**Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is kept charged and secured, independent of any individual personal devices (non-personal virtual MFA). This lessens the risks of losing access to the MFA due to device loss, device trade-in, or if the individual owning the device is no longer employed at the company.",
@@ -128,7 +123,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.",
@@ -151,7 +145,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
@@ -174,7 +167,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length 14.",
@@ -197,7 +189,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
@@ -220,7 +211,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
@@ -243,7 +233,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.",
@@ -267,7 +256,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.",
@@ -290,7 +278,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)",
@@ -313,7 +300,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be rotated regularly.",
@@ -336,7 +322,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM users are granted access to services, functions, and data through IAM policies. There are four ways to define policies for a user: 1) Edit the user policy directly, also known as an inline or user policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy; 4) add the user to an IAM group that has an inline policy.Only the third implementation is recommended.",
@@ -360,7 +345,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege—that is, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.",
@@ -383,7 +367,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role, with the appropriate policy assigned, to allow authorized users to manage incidents with AWS Support.",
@@ -406,7 +389,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS Access means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
@@ -429,7 +411,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use AWS Certificate Manager (ACM) or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
@@ -452,7 +433,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enable the IAM Access Analyzer for IAM policies regarding all resources in each active AWS region.IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. The results allow you to determine whether an unintended user is permitted, making it easier for administrators to monitor least privilege access. Access Analyzer analyzes only the policies that are applied to resources in the same AWS Region.",
@@ -475,7 +455,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
@@ -498,7 +477,6 @@
"Attributes": [
{
"Section": "1 Identity and Access Management",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. Therefore, it is feasible to install file transfer software, for example, and move data from CloudShell to external internet servers.",
@@ -730,7 +708,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
@@ -753,7 +730,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or remained unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled for all CloudTrails.",
@@ -776,7 +752,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration items (AWS resources), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended that AWS Config be enabled in all regions.",
@@ -799,7 +774,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Server access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that server access logging be enabled on the CloudTrail S3 bucket.",
@@ -822,7 +796,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer-created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
@@ -845,7 +818,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key, which is key material stored within the KMS that is tied to the key ID of the customer-created customer master key (CMK). The backing key is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can occur transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation cannot be enabled for any asymmetric CMK.",
@@ -868,7 +840,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.",
@@ -891,7 +862,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.",
@@ -914,7 +884,6 @@
"Attributes": [
{
"Section": "3 Logging",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.",
@@ -937,7 +906,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
@@ -960,7 +928,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
@@ -983,7 +950,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts to detect unauthorized use or attempts to use the root account.",
@@ -1006,7 +972,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for changes made to Identity and Access Management (IAM) policies.",
@@ -1029,7 +994,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be used to detect changes to CloudTrail's configurations.",
@@ -1052,7 +1016,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
@@ -1075,7 +1038,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer-created CMKs that have changed state to disabled or are scheduled for deletion.",
@@ -1098,7 +1060,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
@@ -1121,7 +1082,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.",
@@ -1144,7 +1104,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Security groups are stateful packet filters that control ingress and egress traffic within a VPC.It is recommended that a metric filter and alarm be established to detect changes to security groups.",
@@ -1167,7 +1126,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for any changes made to NACLs.",
@@ -1190,7 +1148,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Network gateways are required to send and receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
@@ -1213,7 +1170,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways.It is recommended that a metric filter and alarm be established for changes to route tables.",
@@ -1236,7 +1192,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is possible to have more than one VPC within an account; additionally, it is also possible to create a peer connection between two VPCs, enabling network traffic to route between them.It is recommended that a metric filter and alarm be established for changes made to VPCs.",
@@ -1259,7 +1214,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes made to AWS Organizations in the master AWS account.",
@@ -1282,7 +1236,6 @@
"Attributes": [
{
"Section": "4 Monitoring",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Security Hub collects security data from various AWS accounts, services, and supported third-party partner products, helping you analyze your security trends and identify the highest-priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from the AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
@@ -1307,7 +1260,6 @@
"Attributes": [
{
"Section": "5 Networking",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.",
@@ -1332,7 +1284,6 @@
"Attributes": [
{
"Section": "5 Networking",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.",
@@ -1357,7 +1308,6 @@
"Attributes": [
{
"Section": "5 Networking",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`.",
@@ -1380,7 +1330,6 @@
"Attributes": [
{
"Section": "5 Networking",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If a security group is not specified when an instance is launched, it is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic, both inbound and outbound.The default VPC in every region should have its default security group updated to comply with the following: - No inbound rules. - No outbound rules.Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation.**Note:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly, as it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering by discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
@@ -1403,7 +1352,6 @@
"Attributes": [
{
"Section": "5 Networking",
"SubSection": "",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.",
@@ -1426,7 +1374,6 @@
"Attributes": [
{
"Section": "5 Networking",
"SubSection": "",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).",
prowler/compliance/azure/cis_2.0_azure.json
+151 -151
View File
File diff suppressed because it is too large Load Diff
prowler/compliance/azure/cis_2.1_azure.json
+149 -149
View File
File diff suppressed because it is too large Load Diff
prowler/compliance/azure/cis_3.0_azure.json
+243 -243
View File
File diff suppressed because it is too large Load Diff
prowler/compliance/gcp/cis_2.0_gcp.json
+103 -103
View File
@@ -10,7 +10,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Use corporate login credentials instead of personal accounts, such as Gmail accounts.",
@@ -29,7 +29,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Setup multi-factor authentication for Google Cloud Platform accounts.",
@@ -48,7 +48,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.",
@@ -69,7 +69,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.",
@@ -90,7 +90,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.",
@@ -111,7 +111,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.",
@@ -132,7 +132,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.",
@@ -153,7 +153,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGERUNIT`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).",
@@ -174,7 +174,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.",
@@ -195,7 +195,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).",
@@ -216,7 +216,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.",
@@ -237,7 +237,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.",
@@ -256,7 +256,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.",
@@ -277,7 +277,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.",
@@ -298,7 +298,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.",
@@ -319,7 +319,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "User managed service accounts should not have user-managed keys.",
@@ -340,7 +340,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.",
@@ -359,7 +359,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.",
@@ -380,7 +380,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.",
@@ -401,7 +401,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.",
@@ -422,7 +422,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored. Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners. The project owner has all the privileges on the project the role belongs to. These are summarized below: - All viewer permissions on all GCP Services within the project - Permissions for actions that modify the state of all GCP services within the project - Manage roles and permissions for a project and all resources within the project - Set up billing for a project Granting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.",
@@ -443,7 +443,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.",
@@ -464,7 +464,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.",
@@ -485,7 +485,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.",
@@ -506,7 +506,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.",
@@ -527,7 +527,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).",
@@ -548,7 +548,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects. Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.",
@@ -569,7 +569,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.",
@@ -590,7 +590,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.",
@@ -611,7 +611,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.",
@@ -632,7 +632,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.",
@@ -651,7 +651,7 @@
"Checks": [],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.",
@@ -672,7 +672,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.",
@@ -693,7 +693,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.",
@@ -714,7 +714,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.",
@@ -735,7 +735,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.",
@@ -756,7 +756,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.",
@@ -777,7 +777,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -798,7 +798,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -819,7 +819,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.",
@@ -840,7 +840,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "To prevent use of `default` network, a project should not have a `default` network.",
@@ -861,7 +861,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.",
@@ -880,7 +880,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: ``` TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA ```",
@@ -899,7 +899,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.",
@@ -920,7 +920,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support. If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.",
@@ -941,7 +941,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.",
@@ -962,7 +962,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.",
@@ -983,7 +983,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.",
@@ -1004,7 +1004,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Compute instances should not be configured to have external IP addresses.",
@@ -1025,7 +1025,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.",
@@ -1046,7 +1046,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.",
@@ -1067,7 +1067,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.",
@@ -1088,7 +1088,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. Forwarding of data packets should be disabled to prevent data loss or information disclosure.",
@@ -1107,7 +1107,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In order to maintain the highest level of security all connections to an application should be secure by default.",
@@ -1128,7 +1128,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.",
@@ -1147,7 +1147,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed. This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.",
@@ -1168,7 +1168,7 @@
],
"Attributes": [
{
"Section": "5. Storage",
"Section": "5 Storage",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.",
@@ -1189,7 +1189,7 @@
],
"Attributes": [
{
"Section": "5. Storage",
"Section": "5 Storage",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.",
@@ -1210,7 +1210,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to have all SQL database instances set to enable automated backups.",
@@ -1231,7 +1231,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.",
@@ -1252,7 +1252,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.",
@@ -1273,7 +1273,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.",
@@ -1292,8 +1292,8 @@
"Checks": [],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.1. MySQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.1 MySQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances. This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.",
@@ -1314,8 +1314,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.1. MySQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.1 MySQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`",
@@ -1336,8 +1336,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.1. MySQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.1 MySQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.",
@@ -1358,8 +1358,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are: - `TERSE` - `DEFAULT` - `VERBOSE` `TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information. `VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error. Ensure an appropriate value is set to 'DEFAULT' or stricter.",
@@ -1380,8 +1380,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.",
@@ -1402,8 +1402,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are: - `none` - `ddl` - `mod` - `all` The value `ddl` logs all data definition statements. The value `mod` logs all ddl statements, plus data-modifying statements. The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included. A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.",
@@ -1424,8 +1424,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. In contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC). Limiting network access to your database will limit potential attacks.",
@@ -1446,8 +1446,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.",
@@ -1468,8 +1468,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.",
@@ -1490,8 +1490,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.",
@@ -1512,8 +1512,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.",
@@ -1534,8 +1534,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.",
@@ -1556,8 +1556,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.",
@@ -1578,8 +1578,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`",
@@ -1600,8 +1600,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1622,8 +1622,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.",
@@ -1644,8 +1644,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.",
@@ -1666,8 +1666,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`.",
@@ -1688,8 +1688,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1710,7 +1710,7 @@
],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.",
@@ -1731,7 +1731,7 @@
],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.",
@@ -1752,7 +1752,7 @@
],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.",
prowler/compliance/gcp/cis_3.0_gcp.json
+103 -103
View File
@@ -10,7 +10,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Use corporate login credentials instead of consumer accounts, such as Gmail accounts.",
@@ -30,7 +30,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Setup multi-factor authentication for Google Cloud Platform accounts.",
@@ -50,7 +50,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.",
@@ -72,7 +72,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "User-managed service accounts should not have user-managed keys.",
@@ -94,7 +94,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.",
@@ -116,7 +116,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.",
@@ -138,7 +138,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.",
@@ -160,7 +160,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.",
@@ -182,7 +182,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.",
@@ -204,7 +204,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGER[UNIT]`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).",
@@ -226,7 +226,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.",
@@ -248,7 +248,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.",
@@ -268,7 +268,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.",
@@ -290,7 +290,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.",
@@ -312,7 +312,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.",
@@ -334,7 +334,7 @@
],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.",
@@ -354,7 +354,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Identity and Access Management",
"Section": "1 Identity and Access Management",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.",
@@ -376,7 +376,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.",
@@ -398,7 +398,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).",
@@ -420,7 +420,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.",
@@ -442,7 +442,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored.Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners.The project owner has all the privileges on the project the role belongs to. These are summarized below:- All viewer permissions on all GCP Services within the project- Permissions for actions that modify the state of all GCP services within the project- Manage roles and permissions for a project and all resources within the project- Set up billing for a projectGranting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.",
@@ -464,7 +464,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects.Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.",
@@ -486,7 +486,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.",
@@ -508,7 +508,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.",
@@ -530,7 +530,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.",
@@ -552,7 +552,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.",
@@ -574,7 +574,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.",
@@ -596,7 +596,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.",
@@ -616,7 +616,7 @@
"Checks": [],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.",
@@ -638,7 +638,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.Cloud Asset Inventory Service (CAIS) API enablement is not required for operation of the service, but rather enables the mechanism for searching/exporting CAIS asset data directly.",
@@ -658,7 +658,7 @@
"Checks": [],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.",
@@ -680,7 +680,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.",
@@ -702,7 +702,7 @@
],
"Attributes": [
{
"Section": "2. Logging and Monitoring",
"Section": "2 Logging and Monitoring",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.",
@@ -724,7 +724,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "To prevent use of `default` network, a project should not have a `default` network.",
@@ -746,7 +746,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.",
@@ -768,7 +768,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.",
@@ -790,7 +790,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -812,7 +812,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -834,7 +834,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.",
@@ -856,7 +856,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.",
@@ -878,7 +878,7 @@
],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.",
@@ -898,7 +898,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: ```TLS_RSA_WITH_AES_128_GCM_SHA256TLS_RSA_WITH_AES_256_GCM_SHA384TLS_RSA_WITH_AES_128_CBC_SHATLS_RSA_WITH_AES_256_CBC_SHATLS_RSA_WITH_3DES_EDE_CBC_SHA```",
@@ -918,7 +918,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Networking",
"Section": "3 Networking",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.",
@@ -940,7 +940,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.",
@@ -962,7 +962,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.",
@@ -984,7 +984,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.",
@@ -1006,7 +1006,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.",
@@ -1028,7 +1028,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.",
@@ -1050,7 +1050,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.Forwarding of data packets should be disabled to prevent data loss or information disclosure.",
@@ -1072,7 +1072,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.",
@@ -1094,7 +1094,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.",
@@ -1116,7 +1116,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Compute instances should not be configured to have external IP addresses.",
@@ -1136,7 +1136,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "In order to maintain the highest level of security all connections to an application should be secure by default.",
@@ -1158,7 +1158,7 @@
],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.",
@@ -1178,7 +1178,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Virtual Machines",
"Section": "4 Virtual Machines",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed.This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.",
@@ -1200,7 +1200,7 @@
],
"Attributes": [
{
"Section": "5. Storage",
"Section": "5 Storage",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.",
@@ -1222,7 +1222,7 @@
],
"Attributes": [
{
"Section": "5. Storage",
"Section": "5 Storage",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.",
@@ -1244,7 +1244,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.",
@@ -1266,7 +1266,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.",
@@ -1288,7 +1288,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.",
@@ -1310,7 +1310,7 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"Section": "6 Cloud SQL Database Services",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to have all SQL database instances set to enable automated backups.",
@@ -1330,8 +1330,8 @@
"Checks": [],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.1. MySQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.1 MySQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Manual",
"Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances.This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.",
@@ -1353,8 +1353,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.1. MySQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.1 MySQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`",
@@ -1376,8 +1376,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.1. MySQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.1 MySQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.",
@@ -1399,8 +1399,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are:- `TERSE`- `DEFAULT`- `VERBOSE``TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information.`VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error.Ensure an appropriate value is set to 'DEFAULT' or stricter.",
@@ -1422,8 +1422,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.",
@@ -1445,8 +1445,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.",
@@ -1468,8 +1468,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are:- `none`- `ddl`- `mod`- `all`The value `ddl` logs all data definition statements.The value `mod` logs all ddl statements, plus data-modifying statements.The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.",
@@ -1491,8 +1491,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.",
@@ -1514,8 +1514,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.",
@@ -1537,8 +1537,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.",
@@ -1560,8 +1560,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.2. PostgreSQL Database",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.2 PostgreSQL Database",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.",
@@ -1583,8 +1583,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`",
@@ -1606,8 +1606,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.This flag is deprecated for all SQL Server versions in CGP. Going forward, you can't set its value to on. However, if you have this flag enabled, we strongly recommend that you either remove the flag from your database or set it to off. For cross-database access, use the [Microsoft tutorial for signing stored procedures with a certificate](https://learn.microsoft.com/en-us/sql/relational-databases/tutorial-signing-stored-procedures-with-a-certificate?view=sql-server-ver16).",
@@ -1629,8 +1629,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.",
@@ -1652,8 +1652,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.",
@@ -1675,8 +1675,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1694,12 +1694,12 @@
"Id": "6.3.6",
"Description": "Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'",
"Checks": [
"cloudsql_instance_sqlserver_trace_flag\""
"cloudsql_instance_sqlserver_trace_flag"
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.",
@@ -1721,8 +1721,8 @@
],
"Attributes": [
{
"Section": "6. Cloud SQL Database Services",
"SubSection": "6.3. SQL Server",
"Section": "6 Cloud SQL Database Services",
"SubSection": "6.3 SQL Server",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended not to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `on`.",
@@ -1744,7 +1744,7 @@
],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 1",
"AssessmentStatus": "Automated",
"Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.",
@@ -1766,7 +1766,7 @@
],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.",
@@ -1788,7 +1788,7 @@
],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.",
@@ -1808,7 +1808,7 @@
"Checks": [],
"Attributes": [
{
"Section": "7. BigQuery",
"Section": "7 BigQuery",
"Profile": "Level 2",
"AssessmentStatus": "Manual",
"Description": "BigQuery tables can contain sensitive data that for security purposes should be discovered, monitored, classified, and protected. Google Cloud's Sensitive Data Protection tools can automatically provide data classification of all BigQuery data across an organization.",
@@ -1830,7 +1830,7 @@
],
"Attributes": [
{
"Section": "8. Dataproc",
"Section": "8 Dataproc",
"Profile": "Level 2",
"AssessmentStatus": "Automated",
"Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).",
prowler/compliance/kubernetes/cis_1.10_kubernetes.json
+253 -253
View File
File diff suppressed because it is too large Load Diff
prowler/compliance/kubernetes/cis_1.8_kubernetes.json
+123 -123
View File
@@ -10,7 +10,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -31,7 +31,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -52,7 +52,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -73,7 +73,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -94,7 +94,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -115,7 +115,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -136,7 +136,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -157,7 +157,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -178,7 +178,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -199,7 +199,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -220,7 +220,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -241,7 +241,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -262,7 +262,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -283,7 +283,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -304,7 +304,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -325,7 +325,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -346,7 +346,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -367,7 +367,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -388,7 +388,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -409,7 +409,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -430,7 +430,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.1 Control Plane Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -453,7 +453,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -476,7 +476,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -499,7 +499,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -522,7 +522,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -545,7 +545,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -568,7 +568,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -591,7 +591,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -614,7 +614,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -637,7 +637,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -660,7 +660,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -683,7 +683,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -706,7 +706,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -729,7 +729,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Automated",
@@ -752,7 +752,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Automated",
@@ -775,7 +775,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Automated",
@@ -798,7 +798,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -821,7 +821,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -844,7 +844,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -867,7 +867,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -890,7 +890,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -913,7 +913,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -936,7 +936,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -959,7 +959,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -982,7 +982,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1005,7 +1005,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1028,7 +1028,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1051,7 +1051,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1074,7 +1074,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1095,7 +1095,7 @@
"Checks": [],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1118,7 +1118,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.2 API Server",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1141,7 +1141,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1164,7 +1164,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1187,7 +1187,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1210,7 +1210,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1233,7 +1233,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1256,7 +1256,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1279,7 +1279,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.3 Controller Manager",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1302,7 +1302,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.4 Scheduler",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1325,7 +1325,7 @@
],
"Attributes": [
{
"Section": "1. Control Plane Components",
"Section": "1 Control Plane Components",
"SubSection": "1.4 Scheduler",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1500,7 +1500,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Control Plane Configuration",
"Section": "3 Control Plane Configuration",
"SubSection": "3.1 Authentication and Authorization",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1521,7 +1521,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Control Plane Configuration",
"Section": "3 Control Plane Configuration",
"SubSection": "3.1 Authentication and Authorization",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1542,7 +1542,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Control Plane Configuration",
"Section": "3 Control Plane Configuration",
"SubSection": "3.1 Authentication and Authorization",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1563,7 +1563,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Control Plane Configuration",
"Section": "3 Control Plane Configuration",
"SubSection": "3.2 Logging",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -1584,7 +1584,7 @@
"Checks": [],
"Attributes": [
{
"Section": "3. Control Plane Configuration",
"Section": "3 Control Plane Configuration",
"SubSection": "3.2 Logging",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -1607,7 +1607,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -1630,7 +1630,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1651,7 +1651,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1672,7 +1672,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1695,7 +1695,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1718,7 +1718,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1739,7 +1739,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1760,7 +1760,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1783,7 +1783,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1806,7 +1806,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.1 Worker Node Configuration Files",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1829,7 +1829,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1852,7 +1852,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1875,7 +1875,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1898,7 +1898,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1921,7 +1921,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1944,7 +1944,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -1965,7 +1965,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -1988,7 +1988,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 2 - Worker Node",
"AssessmentStatus": "Manual",
@@ -2011,7 +2011,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -2034,7 +2034,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Automated",
@@ -2055,7 +2055,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -2078,7 +2078,7 @@
],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -2099,7 +2099,7 @@
"Checks": [],
"Attributes": [
{
"Section": "4. Worker Nodes",
"Section": "4 Worker Nodes",
"SubSection": "4.2 Kubelet",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -2122,7 +2122,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2145,7 +2145,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2168,7 +2168,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Worker Node",
"AssessmentStatus": "Manual",
@@ -2191,7 +2191,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2212,7 +2212,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2233,7 +2233,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2254,7 +2254,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2275,7 +2275,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2298,7 +2298,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2321,7 +2321,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2344,7 +2344,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2367,7 +2367,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2390,7 +2390,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.1 RBAC and Service Accounts",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2411,7 +2411,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2434,7 +2434,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2457,7 +2457,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -2480,7 +2480,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -2503,7 +2503,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -2526,7 +2526,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -2549,7 +2549,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Automated",
@@ -2572,7 +2572,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -2595,7 +2595,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Automated",
@@ -2618,7 +2618,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2641,7 +2641,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2662,7 +2662,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2685,7 +2685,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.2 Pod Security Standards",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2706,7 +2706,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.3 Network Policies and CNI",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2727,7 +2727,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.3 Network Policies and CNI",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2750,7 +2750,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.4 Secrets Management",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2771,7 +2771,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.4 Secrets Management",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2792,7 +2792,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.4 Secrets Management",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2813,7 +2813,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.7 General Policies",
"Profile": "Level 1 - Master Node",
"AssessmentStatus": "Manual",
@@ -2836,7 +2836,7 @@
],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.7 General Policies",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2857,7 +2857,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.7 General Policies",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
@@ -2878,7 +2878,7 @@
"Checks": [],
"Attributes": [
{
"Section": "5. Policies",
"Section": "5 Policies",
"SubSection": "5.7 General Policies",
"Profile": "Level 2 - Master Node",
"AssessmentStatus": "Manual",
prowler/compliance/m365/cis_4.0_m365.json
+252 -126
View File
File diff suppressed because it is too large Load Diff
prowler/lib/outputs/compliance/cis/cis_m365.py
+2
View File
@@ -48,6 +48,7 @@ class M365CIS(ComplianceOutput):
Requirements_Id=requirement.Id,
Requirements_Description=requirement.Description,
Requirements_Attributes_Section=attribute.Section,
Requirements_Attributes_SubSection=attribute.SubSection,
Requirements_Attributes_Profile=attribute.Profile,
Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
Requirements_Attributes_Description=attribute.Description,
@@ -79,6 +80,7 @@ class M365CIS(ComplianceOutput):
Requirements_Id=requirement.Id,
Requirements_Description=requirement.Description,
Requirements_Attributes_Section=attribute.Section,
Requirements_Attributes_SubSection=attribute.SubSection,
Requirements_Attributes_Profile=attribute.Profile,
Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
Requirements_Attributes_Description=attribute.Description,
prowler/lib/outputs/compliance/cis/models.py
+1
View File
@@ -82,6 +82,7 @@ class M365CISModel(BaseModel):
Requirements_Id: str
Requirements_Description: str
Requirements_Attributes_Section: str
Requirements_Attributes_SubSection: Optional[str]
Requirements_Attributes_Profile: str
Requirements_Attributes_AssessmentStatus: str
Requirements_Attributes_Description: str
tests/lib/outputs/compliance/cis/cis_m365_test.py
+182
View File
@@ -0,0 +1,182 @@
from datetime import datetime
from io import StringIO
from freezegun import freeze_time
from mock import patch
from prowler.lib.outputs.compliance.cis.cis_m365 import M365CIS
from prowler.lib.outputs.compliance.cis.models import M365CISModel
from tests.lib.outputs.compliance.fixtures import CIS_4_0_M365
from tests.lib.outputs.fixtures.fixtures import generate_finding_output
from tests.providers.m365.m365_fixtures import DOMAIN, LOCATION, TENANT_ID
class TestM365CIS:
def test_output_transform(self):
findings = [
generate_finding_output(
provider="m365",
compliance={"CIS-4.0": "2.1.3"},
account_name=DOMAIN,
account_uid=TENANT_ID,
region=LOCATION,
)
]
# Clear the data from CSV class
output = M365CIS(findings, CIS_4_0_M365)
output_data = output.data[0]
assert isinstance(output_data, M365CISModel)
assert output_data.Provider == "m365"
assert output_data.TenantId == TENANT_ID
assert output_data.Location == LOCATION
assert output_data.Description == CIS_4_0_M365.Description
assert output_data.Requirements_Id == CIS_4_0_M365.Requirements[0].Id
assert (
output_data.Requirements_Description
== CIS_4_0_M365.Requirements[0].Description
)
assert (
output_data.Requirements_Attributes_Section
== CIS_4_0_M365.Requirements[0].Attributes[0].Section
)
assert (
output_data.Requirements_Attributes_SubSection
== CIS_4_0_M365.Requirements[0].Attributes[0].SubSection
)
assert (
output_data.Requirements_Attributes_Profile
== CIS_4_0_M365.Requirements[0].Attributes[0].Profile
)
assert (
output_data.Requirements_Attributes_AssessmentStatus
== CIS_4_0_M365.Requirements[0].Attributes[0].AssessmentStatus
)
assert (
output_data.Requirements_Attributes_Description
== CIS_4_0_M365.Requirements[0].Attributes[0].Description
)
assert (
output_data.Requirements_Attributes_RationaleStatement
== CIS_4_0_M365.Requirements[0].Attributes[0].RationaleStatement
)
assert (
output_data.Requirements_Attributes_ImpactStatement
== CIS_4_0_M365.Requirements[0].Attributes[0].ImpactStatement
)
assert (
output_data.Requirements_Attributes_RemediationProcedure
== CIS_4_0_M365.Requirements[0].Attributes[0].RemediationProcedure
)
assert (
output_data.Requirements_Attributes_AuditProcedure
== CIS_4_0_M365.Requirements[0].Attributes[0].AuditProcedure
)
assert (
output_data.Requirements_Attributes_AdditionalInformation
== CIS_4_0_M365.Requirements[0].Attributes[0].AdditionalInformation
)
assert (
output_data.Requirements_Attributes_References
== CIS_4_0_M365.Requirements[0].Attributes[0].References
)
assert (
output_data.Requirements_Attributes_DefaultValue
== CIS_4_0_M365.Requirements[0].Attributes[0].DefaultValue
)
assert output_data.Status == "PASS"
assert output_data.StatusExtended == ""
assert output_data.ResourceId == ""
assert output_data.ResourceName == ""
assert output_data.CheckId == "test-check-id"
assert output_data.Muted is False
# Test manual check
output_data_manual = output.data[1]
assert output_data_manual.Provider == "m365"
assert output_data_manual.TenantId == TENANT_ID
assert output_data_manual.Location == LOCATION
assert output_data_manual.Description == CIS_4_0_M365.Description
assert output_data_manual.Requirements_Id == CIS_4_0_M365.Requirements[1].Id
assert (
output_data_manual.Requirements_Description
== CIS_4_0_M365.Requirements[1].Description
)
assert (
output_data_manual.Requirements_Attributes_Section
== CIS_4_0_M365.Requirements[1].Attributes[0].Section
)
assert (
output_data.Requirements_Attributes_SubSection
== CIS_4_0_M365.Requirements[0].Attributes[0].SubSection
)
assert (
output_data_manual.Requirements_Attributes_Profile
== CIS_4_0_M365.Requirements[1].Attributes[0].Profile
)
assert (
output_data_manual.Requirements_Attributes_AssessmentStatus
== CIS_4_0_M365.Requirements[1].Attributes[0].AssessmentStatus
)
assert (
output_data_manual.Requirements_Attributes_Description
== CIS_4_0_M365.Requirements[1].Attributes[0].Description
)
assert (
output_data_manual.Requirements_Attributes_RationaleStatement
== CIS_4_0_M365.Requirements[1].Attributes[0].RationaleStatement
)
assert (
output_data_manual.Requirements_Attributes_ImpactStatement
== CIS_4_0_M365.Requirements[1].Attributes[0].ImpactStatement
)
assert (
output_data_manual.Requirements_Attributes_RemediationProcedure
== CIS_4_0_M365.Requirements[1].Attributes[0].RemediationProcedure
)
assert (
output_data_manual.Requirements_Attributes_AuditProcedure
== CIS_4_0_M365.Requirements[1].Attributes[0].AuditProcedure
)
assert (
output_data_manual.Requirements_Attributes_AdditionalInformation
== CIS_4_0_M365.Requirements[1].Attributes[0].AdditionalInformation
)
assert (
output_data_manual.Requirements_Attributes_References
== CIS_4_0_M365.Requirements[1].Attributes[0].References
)
assert (
output_data_manual.Requirements_Attributes_DefaultValue
== CIS_4_0_M365.Requirements[1].Attributes[0].DefaultValue
)
assert output_data_manual.Status == "MANUAL"
assert output_data_manual.StatusExtended == "Manual check"
assert output_data_manual.ResourceId == "manual_check"
assert output_data_manual.ResourceName == "Manual check"
assert output_data_manual.CheckId == "manual"
assert output_data_manual.Muted is False
@freeze_time(datetime.now())
def test_batch_write_data_to_file(self):
mock_file = StringIO()
findings = [
generate_finding_output(
provider="m365",
compliance={"CIS-4.0": "2.1.3"},
account_name=DOMAIN,
account_uid=TENANT_ID,
region=LOCATION,
)
]
# Clear the data from CSV class
output = M365CIS(findings, CIS_4_0_M365)
output._file_descriptor = mock_file
with patch.object(mock_file, "close", return_value=None):
output.batch_write_data_to_file()
mock_file.seek(0)
content = mock_file.read()
expected_csv = f"PROVIDER;DESCRIPTION;TENANTID;LOCATION;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SUBSECTION;REQUIREMENTS_ATTRIBUTES_PROFILE;REQUIREMENTS_ATTRIBUTES_ASSESSMENTSTATUS;REQUIREMENTS_ATTRIBUTES_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_RATIONALESTATEMENT;REQUIREMENTS_ATTRIBUTES_IMPACTSTATEMENT;REQUIREMENTS_ATTRIBUTES_REMEDIATIONPROCEDURE;REQUIREMENTS_ATTRIBUTES_AUDITPROCEDURE;REQUIREMENTS_ATTRIBUTES_ADDITIONALINFORMATION;REQUIREMENTS_ATTRIBUTES_DEFAULTVALUE;REQUIREMENTS_ATTRIBUTES_REFERENCES;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED\r\nm365;The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.;00000000-0000-0000-0000-000000000000;global;{datetime.now()};2.1.3;Ensure MFA Delete is enabled on S3 buckets;2.1. Simple Storage Service (S3);;Level 1;Automated;Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.;Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.;;Perform the steps below to enable MFA delete on an S3 bucket.Note:-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.-You must use your 'root' account to enable MFA Delete on S3 buckets.**From Command line:**1. Run the s3api put-bucket-versioning command aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode;Perform the steps below to confirm MFA delete is configured on an S3 Bucket**From Console:**1. Login to the S3 console at `https://console.aws.amazon.com/s3/`2. Click the `Check` box next to the Bucket name you want to confirm3. In the window under `Properties`4. Confirm that Versioning is `Enabled`5. Confirm that MFA Delete is `Enabled`**From Command Line:**1. Run the `get-bucket-versioning aws s3api get-bucket-versioning --bucket my-bucket Output example: <VersioningConfiguration xmlns=`http://s3.amazonaws.com/doc/2006-03-01/`> <Status>Enabled</Status> <MfaDelete>Enabled</MfaDelete></VersioningConfiguration>\ If the Console or the CLI output does not show Versioning and MFA Delete `enabled` refer to the remediation below.;;By default, MFA Delete is not enabled on S3 buckets.;https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html;PASS;;;;test-check-id;False\r\nm365;The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.;00000000-0000-0000-0000-000000000000;global;{datetime.now()};2.1.4;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1.1 Control Plane Node Configuration Files;;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ``` Verify that the permissions are `600` or more restrictive.;;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;https://kubernetes.io/docs/admin/kube-apiserver/;MANUAL;Manual check;manual_check;Manual check;manual;False\r\n"
assert content == expected_csv
tests/lib/outputs/compliance/fixtures.py
+52
View File
@@ -243,6 +243,58 @@ CIS_1_5_AWS = Compliance(
],
)
CIS_4_0_M365_NAME = "cis_4.0_m365"
CIS_4_0_M365 = Compliance(
Framework="CIS",
Provider="M365",
Version="4.0",
Description="The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.",
Requirements=[
Compliance_Requirement(
Checks=[
"mfa_delete_enabled",
],
Id="2.1.3",
Description="Ensure MFA Delete is enabled on S3 buckets",
Attributes=[
CIS_Requirement_Attribute(
Section="2.1. Simple Storage Service (S3)",
Profile="Level 1",
AssessmentStatus="Automated",
Description="Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
RationaleStatement="Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.",
ImpactStatement="",
RemediationProcedure="Perform the steps below to enable MFA delete on an S3 bucket.Note:-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.-You must use your 'root' account to enable MFA Delete on S3 buckets.**From Command line:**1. Run the s3api put-bucket-versioning command aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode",
AuditProcedure="Perform the steps below to confirm MFA delete is configured on an S3 Bucket**From Console:**1. Login to the S3 console at `https://console.aws.amazon.com/s3/`2. Click the `Check` box next to the Bucket name you want to confirm3. In the window under `Properties`4. Confirm that Versioning is `Enabled`5. Confirm that MFA Delete is `Enabled`**From Command Line:**1. Run the `get-bucket-versioning aws s3api get-bucket-versioning --bucket my-bucket Output example: <VersioningConfiguration xmlns=`http://s3.amazonaws.com/doc/2006-03-01/`> <Status>Enabled</Status> <MfaDelete>Enabled</MfaDelete></VersioningConfiguration>\ If the Console or the CLI output does not show Versioning and MFA Delete `enabled` refer to the remediation below.",
AdditionalInformation="",
References="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html",
DefaultValue="By default, MFA Delete is not enabled on S3 buckets.",
)
],
),
Compliance_Requirement(
Checks=[],
Id="2.1.4",
Description="Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive",
Attributes=[
CIS_Requirement_Attribute(
Section="1.1 Control Plane Node Configuration Files",
Profile="Level 1 - Master Node",
AssessmentStatus="Automated",
Description="Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.",
RationaleStatement="The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
ImpactStatement="",
RemediationProcedure="Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```",
AuditProcedure="Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ``` Verify that the permissions are `600` or more restrictive.",
AdditionalInformation="",
References="https://kubernetes.io/docs/admin/kube-apiserver/",
DefaultValue="By default, the `kube-controller-manager.yaml` file has permissions of `640`.",
)
],
),
],
)
MITRE_ATTACK_AWS_NAME = "mitre_attack_aws"
MITRE_ATTACK_AWS = Compliance(
Framework="MITRE-ATTACK",