diff --git a/dashboard/compliance/pci_4_0_aws.py b/dashboard/compliance/pci_4_0_aws.py new file mode 100644 index 0000000000..72e4690563 --- /dev/null +++ b/dashboard/compliance/pci_4_0_aws.py @@ -0,0 +1,24 @@ +import warnings + +from dashboard.common_methods import get_section_containers_format3 + +warnings.filterwarnings("ignore") + + +def get_table(data): + aux = data[ + [ + "REQUIREMENTS_ID", + "REQUIREMENTS_ATTRIBUTES_SECTION", + "REQUIREMENTS_DESCRIPTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ] + + return get_section_containers_format3( + aux, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID" + ) diff --git a/prowler/compliance/aws/pci_4.0_aws.json b/prowler/compliance/aws/pci_4.0_aws.json new file mode 100644 index 0000000000..573848c59d --- /dev/null +++ b/prowler/compliance/aws/pci_4.0_aws.json @@ -0,0 +1,23030 @@ +{ + "Framework": "PCI", + "Version": "4.0", + "Provider": "AWS", + "Description": "The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard. It's administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS applies to entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). This includes, but isn't limited to, merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.", + "Requirements": [ + { + "Id": "1.2.5.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.2.5.2", + "Description": "Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.5.3", + "Description": "Checks if Amazon CloudFront distributions are using a minimum security policy and cipher suite of TLSv1", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.5.4", + "Description": "Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_sni_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.5.5", + "Description": "Checks if Amazon CloudFront distributions are encrypting traffic to custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_origin_traffic_encrypted" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.5.6", + "Description": "Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.5.7", + "Description": "Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.2.5.8", + "Description": "Checks whether your Classic Load Balancer SSL listeners are using a custom policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.2.5.9", + "Description": "Checks if your Classic Load Balancer SSL listeners use a predefined policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.2.5.10", + "Description": "Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.2.5.11", + "Description": "Checks if Amazon EMR clusters have Kerberos enabled", + "Name": "emr", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "emr" + } + ] + }, + { + "Id": "1.2.5.12", + "Description": "Checks whether connections to OpenSearch domains are using HTTPS", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_https_communications_enforced" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.2.5.13", + "Description": "Check if Amazon OpenSearch Service nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.2.5.14", + "Description": "Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients", + "Name": "redshift", + "Checks": [ + "redshift_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.2.5.15", + "Description": "Checks if S3 buckets have policies that require requests to use SSL/TLS", + "Name": "s3", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.5.16", + "Description": "Checks if a server created with AWS Transfer Family uses FTP for endpoint connection", + "Name": "transfer", + "Checks": [ + "transfer_server_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "transfer" + } + ] + }, + { + "Id": "1.2.5.17", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.1", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.2.8.2", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.2.8.3", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.2.8.4", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.8.5", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.2.8.6", + "Description": "Checks if the Bitbucket source repository URL contains sign-in credentials or not", + "Name": "codebuild", + "Checks": [ + "codebuild_project_source_repo_url_no_sensitive_credentials" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "1.2.8.7", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "dms" + } + ] + }, + { + "Id": "1.2.8.8", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "1.2.8.9", + "Description": "Checks if the AWS Client VPN authorization rules authorizes connection access for all clients", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.10", + "Description": "Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.11", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled", + "Name": "ec2", + "Checks": [ + "ec2_transitgateway_auto_accept_vpc_attachments" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.12", + "Description": "Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible", + "Name": "eks", + "Checks": [ + "eks_cluster_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "eks" + } + ] + }, + { + "Id": "1.2.8.13", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "opensearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.2.8.14", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.2.8.15", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.2.8.16", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "emr" + } + ] + }, + { + "Id": "1.2.8.17", + "Description": "For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.18", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.2.8.19", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.2.8.20", + "Description": "Checks if a Lambda function is allowed access to a virtual private cloud (VPC)", + "Name": "awslambda", + "Checks": [ + "awslambda_function_inside_vpc" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.2.8.21", + "Description": "Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_allow_ingress_tcp_port_3389" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.22", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.2.8.23", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.2.8.24", + "Description": "Checks if a Stateless Network Firewall Rule Group contains rules", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.2.8.25", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.2.8.26", + "Description": "Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.2.8.27", + "Description": "Checks if there are any Amazon Relational Database Service (Amazon RDS)\n DB security groups that are not the default DB security group", + "Name": "rds", + "Checks": [ + "rds_instance_event_subscription_security_groups" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.2.8.28", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.2.8.29", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.2.8.30", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.8.31", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.8.32", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.8.33", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.8.34", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.8.35", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.2.8.36", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.2.8.37", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.2.8.38", + "Description": "Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.2.8.39", + "Description": "Checks if there are unused network access control lists (network ACLs)", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_unused" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.40", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.2.8.41", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.2.8.42", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.2.8.43", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.2.8.44", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.2.8.45", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.2.8.46", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.2.8.47", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.1.1", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.1.2", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.1.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.1.4", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.1.5", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.3.1.6", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.3.1.7", + "Description": "Checks if the Bitbucket source repository URL contains sign-in credentials or not", + "Name": "codebuild", + "Checks": [ + "codebuild_project_source_repo_url_no_sensitive_credentials" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "1.3.1.8", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "dms" + } + ] + }, + { + "Id": "1.3.1.9", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "1.3.1.10", + "Description": "Checks if the AWS Client VPN authorization rules authorizes connection access for all clients", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.11", + "Description": "Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.12", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled", + "Name": "ec2", + "Checks": [ + "ec2_transitgateway_auto_accept_vpc_attachments" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.13", + "Description": "Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible", + "Name": "eks", + "Checks": [ + "eks_cluster_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "eks" + } + ] + }, + { + "Id": "1.3.1.14", + "Description": "Checks if Amazon ElastiCache clusters are configured with a custom subnet group", + "Name": "elasticache", + "Checks": [ + "elasticache_cluster_uses_public_subnet" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "1.3.1.15", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "opensearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.3.1.16", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.3.1.17", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.3.1.18", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "emr" + } + ] + }, + { + "Id": "1.3.1.19", + "Description": "For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.20", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.21", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.1.22", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.3.1.23", + "Description": "Checks if a Lambda function is allowed access to a virtual private cloud (VPC)", + "Name": "awslambda", + "Checks": [ + "awslambda_function_inside_vpc" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.3.1.24", + "Description": "Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_allow_ingress_tcp_port_3389" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.25", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.3.1.26", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.3.1.27", + "Description": "Checks if a Stateless Network Firewall Rule Group contains rules", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.3.1.28", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.1.29", + "Description": "Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.3.1.30", + "Description": "Checks if there are any Amazon Relational Database Service (Amazon RDS)\n DB security groups that are not the default DB security group", + "Name": "rds", + "Checks": [ + "rds_instance_event_subscription_security_groups" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.3.1.31", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.3.1.32", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.3.1.33", + "Description": "Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled", + "Name": "redshift", + "Checks": [ + "redshift_cluster_enhanced_vpc_routing" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.3.1.34", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.1.35", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.1.36", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.1.37", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.1.38", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.1.39", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.1.40", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.3.1.41", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.3.1.42", + "Description": "Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.1.43", + "Description": "Checks if there are unused network access control lists (network ACLs)", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_unused" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.44", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.1.45", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.1.46", + "Description": "Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status", + "Name": "vpc", + "Checks": [ + "vpc_vpn_connection_tunnels_up" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.1.47", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.1.48", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.1.49", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.1.50", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.1.51", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.1.52", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.2.1", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.2.2", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.2.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.2.4", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.3.2.5", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.3.2.6", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.3.2.7", + "Description": "Checks if the Bitbucket source repository URL contains sign-in credentials or not", + "Name": "codebuild", + "Checks": [ + "codebuild_project_source_repo_url_no_sensitive_credentials" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "1.3.2.8", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "dms" + } + ] + }, + { + "Id": "1.3.2.9", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "1.3.2.10", + "Description": "Checks if the AWS Client VPN authorization rules authorizes connection access for all clients", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.11", + "Description": "Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.12", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled", + "Name": "ec2", + "Checks": [ + "ec2_transitgateway_auto_accept_vpc_attachments" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.13", + "Description": "Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible", + "Name": "eks", + "Checks": [ + "eks_cluster_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "eks" + } + ] + }, + { + "Id": "1.3.2.14", + "Description": "Checks if Amazon ElastiCache clusters are configured with a custom subnet group", + "Name": "elasticache", + "Checks": [ + "elasticache_cluster_uses_public_subnet" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "1.3.2.15", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "opensearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.3.2.16", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.3.2.17", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.3.2.18", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "emr" + } + ] + }, + { + "Id": "1.3.2.19", + "Description": "For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.20", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.21", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.2.22", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.3.2.23", + "Description": "Checks if a Lambda function is allowed access to a virtual private cloud (VPC)", + "Name": "awslambda", + "Checks": [ + "awslambda_function_inside_vpc" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.3.2.24", + "Description": "Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_allow_ingress_tcp_port_3389" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.25", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.3.2.26", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.3.2.27", + "Description": "Checks if a Stateless Network Firewall Rule Group contains rules", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.3.2.28", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.2.29", + "Description": "Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.3.2.30", + "Description": "Checks if there are any Amazon Relational Database Service (Amazon RDS)\n DB security groups that are not the default DB security group", + "Name": "rds", + "Checks": [ + "rds_instance_event_subscription_security_groups" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.3.2.31", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.3.2.32", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.3.2.33", + "Description": "Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled", + "Name": "redshift", + "Checks": [ + "redshift_cluster_enhanced_vpc_routing" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.3.2.34", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.2.35", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.2.36", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.2.37", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.2.38", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.2.39", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.3.2.40", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.3.2.41", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.3.2.42", + "Description": "Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.2.43", + "Description": "Checks if there are unused network access control lists (network ACLs)", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_unused" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.44", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.2.45", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.3.2.46", + "Description": "Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status", + "Name": "vpc", + "Checks": [ + "vpc_vpn_connection_tunnels_up" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.3.2.47", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.2.48", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.2.49", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.2.50", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.2.51", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.3.2.52", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.1.1", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.1.2", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.1.3", + "Description": "Checks if Amazon ElastiCache clusters are configured with a custom subnet group", + "Name": "elasticache", + "Checks": [ + "elasticache_cluster_uses_public_subnet" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "1.4.1.4", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.1.5", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.1.6", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.1.7", + "Description": "Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled", + "Name": "redshift", + "Checks": [ + "redshift_cluster_enhanced_vpc_routing" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.4.1.8", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.4.1.9", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.1.10", + "Description": "Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status", + "Name": "vpc", + "Checks": [ + "vpc_vpn_connection_tunnels_up" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.2.1", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.2.2", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.2.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.2.4", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.2.5", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.4.2.6", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.4.2.7", + "Description": "Checks if the Bitbucket source repository URL contains sign-in credentials or not", + "Name": "codebuild", + "Checks": [ + "codebuild_project_source_repo_url_no_sensitive_credentials" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "1.4.2.8", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "dms" + } + ] + }, + { + "Id": "1.4.2.9", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "1.4.2.10", + "Description": "Checks if the AWS Client VPN authorization rules authorizes connection access for all clients", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.11", + "Description": "Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.12", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled", + "Name": "ec2", + "Checks": [ + "ec2_transitgateway_auto_accept_vpc_attachments" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.13", + "Description": "Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible", + "Name": "eks", + "Checks": [ + "eks_cluster_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "eks" + } + ] + }, + { + "Id": "1.4.2.14", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "opensearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.4.2.15", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.4.2.16", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.4.2.17", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "emr" + } + ] + }, + { + "Id": "1.4.2.18", + "Description": "For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.19", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.2.20", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.4.2.21", + "Description": "Checks if a Lambda function is allowed access to a virtual private cloud (VPC)", + "Name": "awslambda", + "Checks": [ + "awslambda_function_inside_vpc" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.4.2.22", + "Description": "Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_allow_ingress_tcp_port_3389" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.23", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.4.2.24", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.4.2.25", + "Description": "Checks if a Stateless Network Firewall Rule Group contains rules", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.4.2.26", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.2.27", + "Description": "Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.4.2.28", + "Description": "Checks if there are any Amazon Relational Database Service (Amazon RDS)\n DB security groups that are not the default DB security group", + "Name": "rds", + "Checks": [ + "rds_instance_event_subscription_security_groups" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.4.2.29", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.4.2.30", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.4.2.31", + "Description": "Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled", + "Name": "redshift", + "Checks": [ + "redshift_cluster_enhanced_vpc_routing" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.4.2.32", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.4.2.33", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.4.2.34", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.4.2.35", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.4.2.36", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.4.2.37", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.4.2.38", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.4.2.39", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.4.2.40", + "Description": "Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.2.41", + "Description": "Checks if there are unused network access control lists (network ACLs)", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_unused" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.42", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.2.43", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.2.44", + "Description": "Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status", + "Name": "vpc", + "Checks": [ + "vpc_vpn_connection_tunnels_up" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.2.45", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.2.46", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.2.47", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.2.48", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.2.49", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.2.50", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.4.3.1", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.4.3.2", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined default stateless action for full packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_full_packets" + ], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.4.3.3", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.4.4.1", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.4.2", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.4.4.3", + "Description": "Checks if Amazon ElastiCache clusters are configured with a custom subnet group", + "Name": "elasticache", + "Checks": [ + "elasticache_cluster_uses_public_subnet" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "1.4.4.4", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VPC) and rule name (ec2-instances-in-vpc) are different", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.4.5", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.4.6", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.4.7", + "Description": "Checks if Amazon Redshift cluster has 'enhancedVpcRouting' enabled", + "Name": "redshift", + "Checks": [ + "redshift_cluster_enhanced_vpc_routing" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.4.4.8", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.4.4.9", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.4.10", + "Description": "Checks if both virtual private network (VPN) tunnels provided by AWS Site-to-Site VPN are in UP status", + "Name": "vpc", + "Checks": [ + "vpc_vpn_connection_tunnels_up" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.4.5.1", + "Description": "Checks if Amazon EC2 Launch Templates are set to assign public IP addresses to Network Interfaces", + "Name": "ec2", + "Checks": [ + "ec2_launch_template_no_public_ip" + ], + "Attributes": [ + { + "Section": "1.4.5: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.4.5.2", + "Description": "Checks if ECSTaskDefinitions are configured to share a host’s process namespace with its Amazon Elastic Container Service (Amazon ECS) containers", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_host_namespace_not_shared" + ], + "Attributes": [ + { + "Section": "1.4.5: Network connections between trusted and untrusted networks are controlled. ", + "Service": "ecs" + } + ] + }, + { + "Id": "1.5.1.1", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.5.1.2", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.5.1.3", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "1.5.1.4", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.5.1.5", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "1.5.1.6", + "Description": "Checks if the Bitbucket source repository URL contains sign-in credentials or not", + "Name": "codebuild", + "Checks": [ + "codebuild_project_source_repo_url_no_sensitive_credentials" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "1.5.1.7", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "dms" + } + ] + }, + { + "Id": "1.5.1.8", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "1.5.1.9", + "Description": "Checks if the AWS Client VPN authorization rules authorizes connection access for all clients", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.10", + "Description": "Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.11", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled", + "Name": "ec2", + "Checks": [ + "ec2_transitgateway_auto_accept_vpc_attachments" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.12", + "Description": "Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible", + "Name": "eks", + "Checks": [ + "eks_cluster_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "eks" + } + ] + }, + { + "Id": "1.5.1.13", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "opensearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.5.1.14", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.5.1.15", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "elb" + } + ] + }, + { + "Id": "1.5.1.16", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "emr" + } + ] + }, + { + "Id": "1.5.1.17", + "Description": "For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.18", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.5.1.19", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.5.1.20", + "Description": "Checks if a Lambda function is allowed access to a virtual private cloud (VPC)", + "Name": "awslambda", + "Checks": [ + "awslambda_function_inside_vpc" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "1.5.1.21", + "Description": "Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_allow_ingress_tcp_port_3389" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.22", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.5.1.23", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.5.1.24", + "Description": "Checks if a Stateless Network Firewall Rule Group contains rules", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "1.5.1.25", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.5.1.26", + "Description": "Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "1.5.1.27", + "Description": "Checks if there are any Amazon Relational Database Service (Amazon RDS)\n DB security groups that are not the default DB security group", + "Name": "rds", + "Checks": [ + "rds_instance_event_subscription_security_groups" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.5.1.28", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "rds" + } + ] + }, + { + "Id": "1.5.1.29", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "redshift" + } + ] + }, + { + "Id": "1.5.1.30", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.5.1.31", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.5.1.32", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.5.1.33", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.5.1.34", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.5.1.35", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "s3" + } + ] + }, + { + "Id": "1.5.1.36", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.5.1.37", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "1.5.1.38", + "Description": "Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "vpc" + } + ] + }, + { + "Id": "1.5.1.39", + "Description": "Checks if there are unused network access control lists (network ACLs)", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_unused" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.40", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "ec2" + } + ] + }, + { + "Id": "1.5.1.41", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.5.1.42", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.5.1.43", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.5.1.44", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.5.1.45", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "waf" + } + ] + }, + { + "Id": "1.5.1.46", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.1.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.1.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.1.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.1.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.1.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.1.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.1.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.1.8", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.2.1.1.9", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.2.1.1.10", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.1.11", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.1.12", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.1.13", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.1.14", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.1.15", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.1.16", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.1.17", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.1.18", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.1.19", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.1.20", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.1.21", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.1.22", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.1.23", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.1.24", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.1.25", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.1.26", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.1.27", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.1.28", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.1.29", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.1.30", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.1.31", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.2.1.1.32", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.2.1.1.33", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.1.34", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.1.35", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.1.36", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.1.37", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.2.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.2.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.2.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.2.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.2.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.2.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.2.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.2.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.2.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.2.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.2.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.2.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.2.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.2.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.2.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.2.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.2.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.2.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.2.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.2.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.2.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.2.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.2.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.2.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.2.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.2.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.2.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.2.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.2.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.2.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.2.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.3.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.3.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.3.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.3.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.3.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.3.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.3.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.3.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.3.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.3.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.3.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.3.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.3.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.3.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.3.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.3.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.3.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.3.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.3.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.3.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.3.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.3.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.3.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.3.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.3.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.3.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.3.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.3.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.3.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.3.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.3.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.4.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.4.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.4.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.4.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.4.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.4.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.4.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.4.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.4.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.4.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.4.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.4.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.4.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.4.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.4.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.4.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.4.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.4.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.4.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.4.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.4.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.4.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.4.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.4.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.4.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.4.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.4.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.4.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.4.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.4.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.4.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.5.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.5.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.5.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.5.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.5.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.5.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.5.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.5.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.5.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.5.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.5.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.5.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.5.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.5.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.5.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.5.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.5.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.5.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.5.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.5.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.5.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.5.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.5.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.5.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.5.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.5.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.5.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.5.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.5.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.5.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.5.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.6.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.6.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.6.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.6.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.6.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.6.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.6.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.6.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.6.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.6.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.6.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.6.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.6.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.6.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.6.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.6.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.6.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.6.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.6.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.6.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.6.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.6.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.6.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.6.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.6.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.6.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.6.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.6.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.6.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.6.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.6.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.7.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.7.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.7.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.7.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.7.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.7.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.7.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.7.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.7.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.7.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.7.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.7.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.7.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.7.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.7.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.7.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.7.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.7.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.7.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.7.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.7.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.7.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.7.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.7.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.7.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.7.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.7.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.7.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.7.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.7.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.7.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.1.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.1.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.1.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.1.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.1.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.1.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.1.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.1.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.1.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.1.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.1.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.1.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.1.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.1.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.1.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.1.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.1.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.1.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.1.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.1.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.1.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.1.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.1.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.1.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.2.2.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.2.2.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.2.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.2.2.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.2.2.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.2.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.2.2.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.2.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.2.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.2.2.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.2.2.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.2.2.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.2.2.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.2.2.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.2.2.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.2.2.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.2.2.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.2.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.2.2.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.2.2.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.2.2.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.2.2.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.2.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.2.2.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.2.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.2.2.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.2.2.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.2.2.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.2.2.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.2.2.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.2.2.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.3.1.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.3.1.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.3.1.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.3.1.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.3.1.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.3.1.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.3.1.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.1.8", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.1.9", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.3.1.10", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.3.1.11", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.3.1.12", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.3.1.13", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.3.1.14", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.3.1.15", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.3.1.16", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.3.1.17", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.3.1.18", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.3.1.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.1.20", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.3.1.21", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.3.1.22", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.1.23", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.1.24", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.3.1.25", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.3.1.26", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.3.1.27", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.1.28", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.3.1.29", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.3.1.30", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.3.1.31", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.3.2.1", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "backup" + } + ] + }, + { + "Id": "10.3.2.2", + "Description": "Checks that there is at least one AWS CloudTrail trail defined with security best practices", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_insights_exist" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.2.3", + "Description": "Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.3.2.4", + "Description": "Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.2.5", + "Description": "Checks if AWS CloudTrail creates a signed digest file with logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_log_file_validation_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.2.6", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.3.2.7", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.3.2.8", + "Description": "Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable", + "Name": "ec2", + "Checks": [ + "ec2_ebs_snapshot_account_block_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.3.2.9", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.3.2.10", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_root_directory" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "efs" + } + ] + }, + { + "Id": "10.3.2.11", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_user_identity" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "efs" + } + ] + }, + { + "Id": "10.3.2.12", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "emr" + } + ] + }, + { + "Id": "10.3.2.13", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "10.3.2.14", + "Description": "Checks if an Amazon Neptune manual DB cluster snapshot is public", + "Name": "neptune", + "Checks": [ + "neptune_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.3.2.15", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.2.16", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public", + "Name": "rds", + "Checks": [ + "rds_snapshots_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.2.17", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.3.2.18", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.19", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.20", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.21", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.22", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.23", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.24", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.2.25", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "10.3.2.26", + "Description": "Checks if AWS Systems Manager documents owned by the account are public", + "Name": "ssm", + "Checks": [ + "ssm_documents_set_as_public" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ssm" + } + ] + }, + { + "Id": "10.3.3.1", + "Description": "Checks if Amazon Aurora DB clusters are protected by a backup plan", + "Name": "rds", + "Checks": [ + "rds_cluster_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.3.2", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "backup" + } + ] + }, + { + "Id": "10.3.3.3", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "backup" + } + ] + }, + { + "Id": "10.3.3.4", + "Description": "Checks that there is at least one AWS CloudTrail trail defined with security best practices", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_insights_exist" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.3.5", + "Description": "Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.3.3.6", + "Description": "Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.3.7", + "Description": "Checks if AWS CloudTrail creates a signed digest file with logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_log_file_validation_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.3.8", + "Description": "Checks if RDS DB instances have backups enabled", + "Name": "rds", + "Checks": [ + "rds_instance_backup_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.3.9", + "Description": "Checks whether Amazon DynamoDB table is present in AWS Backup Plans", + "Name": "dynamodb", + "Checks": [ + "dynamodb_table_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "10.3.3.10", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "10.3.3.11", + "Description": "Checks if Amazon DynamoDB tables are protected by a backup plan", + "Name": "dynamodb", + "Checks": [ + "dynamodb_table_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "10.3.3.12", + "Description": "Check if Amazon Elastic Block Store (Amazon EBS) volumes are added in backup plans of AWS Backup", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.3.3.13", + "Description": "Checks if Amazon Elastic Block Store (Amazon EBS) volumes are protected by a backup plan", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.3.3.14", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) instances are protected by a backup plan", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.3.3.15", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup", + "Name": "efs", + "Checks": [ + "efs_have_backup_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "efs" + } + ] + }, + { + "Id": "10.3.3.16", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) File Systems are protected by a backup plan", + "Name": "efs", + "Checks": [ + "efs_have_backup_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "efs" + } + ] + }, + { + "Id": "10.3.3.17", + "Description": "Check if the Amazon ElastiCache Redis clusters have automatic backup turned on", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "10.3.3.18", + "Description": "Checks if Amazon FSx File Systems are protected by a backup plan", + "Name": "fsx", + "Checks": [ + "fsx_file_system_copy_tags_to_backups_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "fsx" + } + ] + }, + { + "Id": "10.3.3.19", + "Description": "Checks if an Amazon Neptune DB cluster retention period is set to specific number of days", + "Name": "neptune", + "Checks": [ + "neptune_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.3.3.20", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) databases are present in AWS Backup plans", + "Name": "rds", + "Checks": [ + "rds_instance_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.3.21", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) instances are protected by a backup plan", + "Name": "rds", + "Checks": [ + "rds_instance_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.3.3.22", + "Description": "Checks that Amazon Redshift automated snapshots are enabled for clusters", + "Name": "redshift", + "Checks": [ + "redshift_cluster_automated_snapshot" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.3.3.23", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.3.24", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) buckets are protected by a backup plan", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_protected_by_backup_plan" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.3.4.1", + "Description": "Checks if CloudFront distribution with Amazon S3 Origin type has origin access identity configured", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_s3_origin_access_control" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.3.4.2", + "Description": "Checks if an Amazon CloudFront distribution with an Amazon Simple Storage Service (Amazon S3) Origin type has origin access control (OAC) enabled", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_s3_origin_access_control" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.3.4.3", + "Description": "Checks that there is at least one AWS CloudTrail trail defined with security best practices", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_insights_exist" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.4.4", + "Description": "Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.3.4.5", + "Description": "Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.4.6", + "Description": "Checks if AWS CloudTrail creates a signed digest file with logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_log_file_validation_enabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.3.4.7", + "Description": "Checks if the S3 bucket has lock enabled, by default", + "Name": "s3", + "Checks": [ + "s3_bucket_object_lock" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.4.8", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.3.4.9", + "Description": "Checks if versioning is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_object_versioning" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.4.1.1.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.4.1.1.2", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.4.1.1.3", + "Description": "Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.4.1.1.4", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.4.1.1.5", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.4.1.1.6", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.4.1.1.7", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.4.1.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.4.1.2", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.4.1.3", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.4.1.4", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.4.1.5", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.4.1.6", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.4.2.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.4.2.2", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.4.2.3", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.4.2.4", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.4.2.5", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.4.2.6", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.4.2.7", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.4.3.1", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.5.1.1", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "backup" + } + ] + }, + { + "Id": "10.5.1.2", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "backup" + } + ] + }, + { + "Id": "10.5.1.3", + "Description": "Checks that there is at least one AWS CloudTrail trail defined with security best practices", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_insights_exist" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.5.1.4", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.5.1.5", + "Description": "Checks if an Amazon Document DB cluster retention period is set to specific number of days", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.5.1.6", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "10.5.1.7", + "Description": "Checks if EBS volumes are attached to EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.5.1.8", + "Description": "Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured", + "Name": "ecr", + "Checks": [ + "ecr_repositories_lifecycle_policy_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "ecr" + } + ] + }, + { + "Id": "10.5.1.9", + "Description": "Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "10.5.1.10", + "Description": "Checks if Amazon OpenSearch Service domains have audit logging enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_audit_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "10.5.1.11", + "Description": "Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "10.5.1.12", + "Description": "Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.5.1.13", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.6.3.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "10.6.3.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.6.3.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.6.3.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "appsync" + } + ] + }, + { + "Id": "10.6.3.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.6.3.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "10.6.3.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.6.3.8", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.6.3.9", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.6.3.10", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.6.3.11", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "10.6.3.12", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "dms" + } + ] + }, + { + "Id": "10.6.3.13", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "10.6.3.14", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.6.3.15", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.6.3.16", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.6.3.17", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "ecs" + } + ] + }, + { + "Id": "10.6.3.18", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "eks" + } + ] + }, + { + "Id": "10.6.3.19", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "10.6.3.20", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "elb" + } + ] + }, + { + "Id": "10.6.3.21", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "iam" + } + ] + }, + { + "Id": "10.6.3.22", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.6.3.23", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "mq" + } + ] + }, + { + "Id": "10.6.3.24", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "10.6.3.25", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "neptune" + } + ] + }, + { + "Id": "10.6.3.26", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "10.6.3.27", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "10.6.3.28", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.6.3.29", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "rds" + } + ] + }, + { + "Id": "10.6.3.30", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.6.3.31", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "redshift" + } + ] + }, + { + "Id": "10.6.3.32", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "route53" + } + ] + }, + { + "Id": "10.6.3.33", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.6.3.34", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.6.3.35", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "s3" + } + ] + }, + { + "Id": "10.6.3.36", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.6.3.37", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.6.3.38", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "10.6.3.39", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "vpc" + } + ] + }, + { + "Id": "10.6.3.40", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.6.3.41", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.6.3.42", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "waf" + } + ] + }, + { + "Id": "10.7.1.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.7.1.2", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "10.7.1.3", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.7.1.4", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.7.1.5", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.7.1.6", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.7.1.7", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.7.1.8", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "10.7.2.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "10.7.2.2", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "10.7.2.3", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.7.2.4", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "10.7.2.5", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "ec2" + } + ] + }, + { + "Id": "10.7.2.6", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "10.7.2.7", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "sns" + } + ] + }, + { + "Id": "10.7.2.8", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "11.3.1.1.1", + "Description": "Checks if all of the specified applications are installed on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "11.3.1.1.2", + "Description": "Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance", + "Name": "ssm", + "Checks": [ + "ssm_managed_compliant_patching" + ], + "Attributes": [ + { + "Section": "11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ssm" + } + ] + }, + { + "Id": "11.3.1.2.1", + "Description": "Checks if a private Amazon Elastic Container Registry (Amazon ECR) repository has image scanning enabled", + "Name": "ecr", + "Checks": [ + "ecr_repositories_scan_images_on_push_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ecr" + } + ] + }, + { + "Id": "11.3.1.3.1", + "Description": "Checks if all of the specified applications are installed on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "11.3.1.3.2", + "Description": "Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance", + "Name": "ssm", + "Checks": [ + "ssm_managed_compliant_patching" + ], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ssm" + } + ] + }, + { + "Id": "11.3.1.3.3", + "Description": "Checks if a private Amazon Elastic Container Registry (Amazon ECR) repository has image scanning enabled", + "Name": "ecr", + "Checks": [ + "ecr_repositories_scan_images_on_push_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ecr" + } + ] + }, + { + "Id": "11.3.1.1", + "Description": "Checks if all of the specified applications are installed on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "11.3.1.2", + "Description": "Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance", + "Name": "ssm", + "Checks": [ + "ssm_managed_compliant_patching" + ], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ssm" + } + ] + }, + { + "Id": "11.3.1.3", + "Description": "Checks if a private Amazon Elastic Container Registry (Amazon ECR) repository has image scanning enabled", + "Name": "ecr", + "Checks": [ + "ecr_repositories_scan_images_on_push_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "ecr" + } + ] + }, + { + "Id": "11.5.1.1.1", + "Description": "Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection", + "Name": "shield", + "Checks": [ + "shield_advanced_protection_in_internet_facing_load_balancers" + ], + "Attributes": [ + { + "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "shield" + } + ] + }, + { + "Id": "11.5.1.1.2", + "Description": "Checks if Amazon GuardDuty is enabled in your AWS account and AWS Region", + "Name": "guardduty", + "Checks": [ + "guardduty_is_enabled" + ], + "Attributes": [ + { + "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "guardduty" + } + ] + }, + { + "Id": "11.5.1.1", + "Description": "Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection", + "Name": "shield", + "Checks": [ + "shield_advanced_protection_in_internet_facing_load_balancers" + ], + "Attributes": [ + { + "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "shield" + } + ] + }, + { + "Id": "11.5.1.2", + "Description": "Checks if Amazon GuardDuty is enabled in your AWS account and AWS Region", + "Name": "guardduty", + "Checks": [ + "guardduty_is_enabled" + ], + "Attributes": [ + { + "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "guardduty" + } + ] + }, + { + "Id": "11.5.2.1", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "11.5.2.2", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "11.5.2.3", + "Description": "Checks whether CloudWatch alarms with the given metric name have the specified settings", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "11.5.2.4", + "Description": "Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "11.5.2.5", + "Description": "Checks if Amazon S3 Events Notifications are enabled on an S3 bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_event_notifications_enabled" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "s3" + } + ] + }, + { + "Id": "11.5.2.6", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "sns" + } + ] + }, + { + "Id": "11.6.1.1", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "11.6.1.2", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "11.6.1.3", + "Description": "Checks whether CloudWatch alarms with the given metric name have the specified settings", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "11.6.1.4", + "Description": "Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "11.6.1.5", + "Description": "Checks if Amazon S3 Events Notifications are enabled on an S3 bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_event_notifications_enabled" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "s3" + } + ] + }, + { + "Id": "11.6.1.6", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "sns" + } + ] + }, + { + "Id": "12.10.5.1", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "12.10.5.2", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "12.10.5.3", + "Description": "Checks whether CloudWatch alarms with the given metric name have the specified settings", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "12.10.5.4", + "Description": "Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "12.10.5.5", + "Description": "Checks if Amazon S3 Events Notifications are enabled on an S3 bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_event_notifications_enabled" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "s3" + } + ] + }, + { + "Id": "12.10.5.6", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "sns" + } + ] + }, + { + "Id": "12.4.2.1.1", + "Description": "Checks if AWS Service Catalog shares portfolios to an organization (a collection of AWS accounts treated as a single unit) when integration is enabled with AWS Organizations", + "Name": "servicecatalog", + "Checks": [ + "servicecatalog_portfolio_shared_within_organization_only" + ], + "Attributes": [ + { + "Section": "12.4.2.1: PCI DSS compliance is managed. ", + "Service": "servicecatalog" + } + ] + }, + { + "Id": "2.2.5.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.5.2", + "Description": "Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.5.3", + "Description": "Checks if Amazon CloudFront distributions are using a minimum security policy and cipher suite of TLSv1", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.5.4", + "Description": "Checks if Amazon CloudFront distributions are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_sni_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.5.5", + "Description": "Checks if Amazon CloudFront distributions are encrypting traffic to custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_origin_traffic_encrypted" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.5.6", + "Description": "Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.5.7", + "Description": "Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "2.2.5.8", + "Description": "Checks whether your Classic Load Balancer SSL listeners are using a custom policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.5.9", + "Description": "Checks if your Classic Load Balancer SSL listeners use a predefined policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.5.10", + "Description": "Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.5.11", + "Description": "Checks if Amazon EMR clusters have Kerberos enabled", + "Name": "emr", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "emr" + } + ] + }, + { + "Id": "2.2.5.12", + "Description": "Checks whether connections to OpenSearch domains are using HTTPS", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_https_communications_enforced" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "2.2.5.13", + "Description": "Check if Amazon OpenSearch Service nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "2.2.5.14", + "Description": "Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients", + "Name": "redshift", + "Checks": [ + "redshift_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "redshift" + } + ] + }, + { + "Id": "2.2.5.15", + "Description": "Checks if S3 buckets have policies that require requests to use SSL/TLS", + "Name": "s3", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "s3" + } + ] + }, + { + "Id": "2.2.5.16", + "Description": "Checks if a server created with AWS Transfer Family uses FTP for endpoint connection", + "Name": "transfer", + "Checks": [ + "transfer_server_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "transfer" + } + ] + }, + { + "Id": "2.2.5.17", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "ec2" + } + ] + }, + { + "Id": "2.2.7.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.7.2", + "Description": "Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.7.3", + "Description": "Checks if Amazon CloudFront distributions are encrypting traffic to custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_origin_traffic_encrypted" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.7.4", + "Description": "Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "2.2.7.5", + "Description": "Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS", + "Name": "dynamodb", + "Checks": [ + "dynamodb_accelerator_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "2.2.7.6", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection", + "Name": "dms", + "Checks": [ + "dms_endpoint_ssl_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "dms" + } + ] + }, + { + "Id": "2.2.7.7", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints", + "Name": "dms", + "Checks": [ + "dms_endpoint_redis_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "dms" + } + ] + }, + { + "Id": "2.2.7.8", + "Description": "Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "2.2.7.9", + "Description": "Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "2.2.7.10", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.7.11", + "Description": "Checks whether your Classic Load Balancer SSL listeners are using a custom policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.7.12", + "Description": "Checks if your Classic Load Balancer SSL listeners use a predefined policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.7.13", + "Description": "Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "elb" + } + ] + }, + { + "Id": "2.2.7.14", + "Description": "Checks if Amazon EMR clusters have Kerberos enabled", + "Name": "emr", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "emr" + } + ] + }, + { + "Id": "2.2.7.15", + "Description": "Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster", + "Name": "kafka", + "Checks": [ + "kafka_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "kafka" + } + ] + }, + { + "Id": "2.2.7.16", + "Description": "Checks whether connections to OpenSearch domains are using HTTPS", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_https_communications_enforced" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "2.2.7.17", + "Description": "Check if Amazon OpenSearch Service nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "2.2.7.18", + "Description": "Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients", + "Name": "redshift", + "Checks": [ + "redshift_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "redshift" + } + ] + }, + { + "Id": "2.2.7.19", + "Description": "Checks if S3 buckets have policies that require requests to use SSL/TLS", + "Name": "s3", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.2.1.1", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.2.1.2", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.2.1.3", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "3.2.1.4", + "Description": "Checks if an Amazon Document DB cluster retention period is set to specific number of days", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.2.1.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.2.1.6", + "Description": "Checks if EBS volumes are attached to EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.2.1.7", + "Description": "Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured", + "Name": "ecr", + "Checks": [ + "ecr_repositories_lifecycle_policy_enabled" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "ecr" + } + ] + }, + { + "Id": "3.2.1.8", + "Description": "Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.2.1.9", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.1.1.1", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.1.1.2", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.1.1.3", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "3.3.1.1.4", + "Description": "Checks if an Amazon Document DB cluster retention period is set to specific number of days", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.3.1.1.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.3.1.1.6", + "Description": "Checks if EBS volumes are attached to EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.3.1.1.7", + "Description": "Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured", + "Name": "ecr", + "Checks": [ + "ecr_repositories_lifecycle_policy_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ecr" + } + ] + }, + { + "Id": "3.3.1.1.8", + "Description": "Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.1.1.9", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.1.3.1", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.1.3.2", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.1.3.3", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "3.3.1.3.4", + "Description": "Checks if an Amazon Document DB cluster retention period is set to specific number of days", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.3.1.3.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.3.1.3.6", + "Description": "Checks if EBS volumes are attached to EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.3.1.3.7", + "Description": "Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured", + "Name": "ecr", + "Checks": [ + "ecr_repositories_lifecycle_policy_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ecr" + } + ] + }, + { + "Id": "3.3.1.3.8", + "Description": "Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.1.3.9", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.2.1", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.2.2", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.2.3", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "3.3.2.4", + "Description": "Checks if an Amazon Document DB cluster retention period is set to specific number of days", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.3.2.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.3.2.6", + "Description": "Checks if EBS volumes are attached to EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.3.2.7", + "Description": "Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured", + "Name": "ecr", + "Checks": [ + "ecr_repositories_lifecycle_policy_enabled" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ecr" + } + ] + }, + { + "Id": "3.3.2.8", + "Description": "Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.2.9", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.3.1", + "Description": "Checks if a backup plan has a backup rule that satisfies the required frequency and retention period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.3.2", + "Description": "Checks if a recovery point expires no earlier than after the specified period", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.3.3.3", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "3.3.3.4", + "Description": "Checks if an Amazon Document DB cluster retention period is set to specific number of days", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_backup_enabled" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.3.3.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Amazon DynamoDB tables", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_pitr_enabled" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.3.3.6", + "Description": "Checks if EBS volumes are attached to EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.3.3.7", + "Description": "Checks if a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured", + "Name": "ecr", + "Checks": [ + "ecr_repositories_lifecycle_policy_enabled" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "ecr" + } + ] + }, + { + "Id": "3.3.3.8", + "Description": "Checks if a lifecycle rule is configured for an Amazon Simple Storage Service (Amazon S3) bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.3.3.9", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) version enabled buckets have lifecycle policy configured", + "Name": "s3", + "Checks": [ + "s3_bucket_lifecycle_enabled" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.1.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.5.1.1.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.5.1.1.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.5.1.1.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.5.1.1.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.5.1.1.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.5.1.1.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.5.1.1.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.5.1.1.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.5.1.3.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.5.1.3.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.5.1.3.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.5.1.3.4", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.5.1.3.5", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.5.1.3.6", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "dms" + } + ] + }, + { + "Id": "3.5.1.3.7", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.5.1.3.8", + "Description": "Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable", + "Name": "ec2", + "Checks": [ + "ec2_ebs_snapshot_account_block_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.5.1.3.9", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "ecs" + } + ] + }, + { + "Id": "3.5.1.3.10", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_root_directory" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "efs" + } + ] + }, + { + "Id": "3.5.1.3.11", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_user_identity" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "efs" + } + ] + }, + { + "Id": "3.5.1.3.12", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.5.1.3.13", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.5.1.3.14", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "emr" + } + ] + }, + { + "Id": "3.5.1.3.15", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.5.1.3.16", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.5.1.3.17", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.5.1.3.18", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "3.5.1.3.19", + "Description": "Checks if an Amazon Neptune manual DB cluster snapshot is public", + "Name": "neptune", + "Checks": [ + "neptune_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "neptune" + } + ] + }, + { + "Id": "3.5.1.3.20", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "rds" + } + ] + }, + { + "Id": "3.5.1.3.21", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public", + "Name": "rds", + "Checks": [ + "rds_snapshots_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "rds" + } + ] + }, + { + "Id": "3.5.1.3.22", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "redshift" + } + ] + }, + { + "Id": "3.5.1.3.23", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.24", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.25", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.26", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.27", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.28", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.29", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.3.30", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "3.5.1.3.31", + "Description": "Checks if AWS Systems Manager documents owned by the account are public", + "Name": "ssm", + "Checks": [ + "ssm_documents_set_as_public" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "ssm" + } + ] + }, + { + "Id": "3.5.1.1", + "Description": "Checks if all methods in Amazon API Gateway stages have cache enabled and cache encrypted", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_cache_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.5.1.2", + "Description": "Checks if an Amazon Athena workgroup is encrypted at rest", + "Name": "athena", + "Checks": [ + "athena_workgroup_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "athena" + } + ] + }, + { + "Id": "3.5.1.3", + "Description": "Checks if a recovery point is encrypted", + "Name": "backup", + "Checks": [ + "backup_recovery_point_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "backup" + } + ] + }, + { + "Id": "3.5.1.4", + "Description": "Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "3.5.1.5", + "Description": "Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "3.5.1.6", + "Description": "Checks if an AWS CodeBuild project has encryption enabled for all of its artifacts", + "Name": "codebuild", + "Checks": [ + "codebuild_project_s3_logs_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "3.5.1.7", + "Description": "Checks if the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY", + "Name": "codebuild", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "3.5.1.8", + "Description": "Checks if a AWS CodeBuild project configured with Amazon S3 Logs has encryption enabled for its logs", + "Name": "codebuild", + "Checks": [ + "codebuild_project_s3_logs_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "3.5.1.9", + "Description": "Checks if Amazon DynamoDB Accelerator (DAX) clusters are encrypted", + "Name": "dynamodb", + "Checks": [ + "dynamodb_accelerator_cluster_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.5.1.10", + "Description": "Checks if storage encryption is enabled for your Amazon DocumentDB (with MongoDB compatibility) clusters", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_storage_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "3.5.1.11", + "Description": "Checks if Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS)", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_kms_cmk_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.5.1.12", + "Description": "Checks if the Amazon DynamoDB tables are encrypted and checks their status", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_kms_cmk_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "3.5.1.13", + "Description": "Checks if Amazon Elastic Block Store (EBS) encryption is enabled by default", + "Name": "ec2", + "Checks": [ + "ec2_ebs_snapshots_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.5.1.14", + "Description": "Checks if secrets are passed as container environment variables", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_no_environment_secrets" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "ecs" + } + ] + }, + { + "Id": "3.5.1.15", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS)", + "Name": "efs", + "Checks": [ + "efs_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "efs" + } + ] + }, + { + "Id": "3.5.1.16", + "Description": "Checks if Amazon EKS clusters are configured to have Kubernetes secrets encrypted using AWS KMS", + "Name": "eks", + "Checks": [ + "eks_cluster_kms_cmk_encryption_in_secrets_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "eks" + } + ] + }, + { + "Id": "3.5.1.17", + "Description": "Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys", + "Name": "eks", + "Checks": [ + "eks_cluster_kms_cmk_encryption_in_secrets_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "eks" + } + ] + }, + { + "Id": "3.5.1.18", + "Description": "Checks if Amazon ElastiCache replication groups have encryption-at-rest enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_rest_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "3.5.1.19", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains have encryption at rest configuration enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "3.5.1.20", + "Description": "Checks if attached Amazon EBS volumes are encrypted and optionally are encrypted with a specified KMS key", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "ec2" + } + ] + }, + { + "Id": "3.5.1.21", + "Description": "Checks if Amazon Kinesis streams are encrypted at rest with server-side encryption", + "Name": "kinesis", + "Checks": [ + "kinesis_stream_encrypted_at_rest" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "kinesis" + } + ] + }, + { + "Id": "3.5.1.22", + "Description": "Checks if storage encryption is enabled for your Amazon Neptune DB clusters", + "Name": "neptune", + "Checks": [ + "neptune_cluster_storage_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "neptune" + } + ] + }, + { + "Id": "3.5.1.23", + "Description": "Checks if an Amazon Neptune DB cluster has snapshots encrypted", + "Name": "neptune", + "Checks": [ + "neptune_cluster_snapshot_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "neptune" + } + ] + }, + { + "Id": "3.5.1.24", + "Description": "Checks if Amazon OpenSearch Service domains have encryption at rest configuration enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "3.5.1.25", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster is encrypted at rest", + "Name": "rds", + "Checks": [ + "rds_cluster_storage_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "rds" + } + ] + }, + { + "Id": "3.5.1.26", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted", + "Name": "rds", + "Checks": [ + "rds_snapshots_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "rds" + } + ] + }, + { + "Id": "3.5.1.27", + "Description": "Checks if storage encryption is enabled for your Amazon Relational Database Service (Amazon RDS) DB instances", + "Name": "rds", + "Checks": [ + "rds_instance_storage_encrypted" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "rds" + } + ] + }, + { + "Id": "3.5.1.28", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "redshift" + } + ] + }, + { + "Id": "3.5.1.29", + "Description": "Checks if Amazon Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption", + "Name": "redshift", + "Checks": [ + "redshift_cluster_encrypted_at_rest" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "redshift" + } + ] + }, + { + "Id": "3.5.1.30", + "Description": "Checks if your Amazon S3 bucket either has the Amazon S3 default encryption enabled\n or that the Amazon S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service", + "Name": "s3", + "Checks": [ + "s3_bucket_default_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.31", + "Description": "Checks if the S3 buckets are encrypted with AWS Key Management Service (AWS KMS)", + "Name": "s3", + "Checks": [ + "s3_bucket_kms_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "s3" + } + ] + }, + { + "Id": "3.5.1.32", + "Description": "Checks if AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker endpoint configuration", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "3.5.1.33", + "Description": "Checks if an AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "3.5.1.34", + "Description": "Checks if all secrets in AWS Secrets Manager are encrypted using the AWS managed key (aws/secretsmanager)\n or a customer managed key that was created in AWS Key Management Service (AWS KMS)", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "3.5.1.35", + "Description": "Checks if SNS topics are encrypted with AWS Key Management Service (AWS KMS)", + "Name": "sns", + "Checks": [ + "sns_topics_kms_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "sns" + } + ] + }, + { + "Id": "3.6.1.2.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.2.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.2.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.6.1.2.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.6.1.2.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.2.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.2.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.2.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.2.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.6.1.3.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.3.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.3.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.6.1.3.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.6.1.3.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.3.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.3.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.3.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.3.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.6.1.4.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.4.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.4.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.6.1.4.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.6.1.4.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.4.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.4.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.4.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.4.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.6.1.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.6.1.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.6.1.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.6.1.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.6.1.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.6.1.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.1.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.1.2", + "Description": "Checks if RSA certificates managed by AWS Certificate Manager (ACM) have a key length of at least '2048' bits", + "Name": "acm", + "Checks": [ + "acm_certificates_with_secure_key_algorithms" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.1.3", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.1.4", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.7.1.5", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.7.1.6", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.1.7", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.1.8", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.1.9", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.1.10", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.2.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.2.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.2.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.7.2.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.7.2.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.2.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.2.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.2.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.2.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.4.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.4.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.4.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.7.4.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.7.4.5", + "Description": "Checks if automatic key rotation is enabled for each key and matches to the key ID of the customer created AWS KMS key", + "Name": "kms", + "Checks": [ + "kms_cmk_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.4.6", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.4.7", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.4.8", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.4.9", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.4.10", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.5.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.5.2", + "Description": "Checks if automatic key rotation is enabled for each key and matches to the key ID of the customer created AWS KMS key", + "Name": "kms", + "Checks": [ + "kms_cmk_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.6.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.6.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.6.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.7.6.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.7.6.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.6.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.6.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.6.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.6.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "3.7.7.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.7.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "acm" + } + ] + }, + { + "Id": "3.7.7.3", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "3.7.7.4", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "3.7.7.5", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.7.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "elb" + } + ] + }, + { + "Id": "3.7.7.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.7.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "iam" + } + ] + }, + { + "Id": "3.7.7.9", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "kms" + } + ] + }, + { + "Id": "4.2.1.1.1", + "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days", + "Name": "acm", + "Checks": [ + "acm_certificates_expiration_check" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "acm" + } + ] + }, + { + "Id": "4.2.1.1.2", + "Description": "Checks if AWS Private Certificate Authority (AWS Private CA) has a root CA that is disabled", + "Name": "acm", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "acm" + } + ] + }, + { + "Id": "4.2.1.1.3", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.1.4", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "4.2.1.1.5", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.1.6", + "Description": "Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.1.7", + "Description": "Checks if Amazon CloudFront distributions are encrypting traffic to custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_origin_traffic_encrypted" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.1.8", + "Description": "Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.1.9", + "Description": "Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS", + "Name": "dynamodb", + "Checks": [ + "dynamodb_accelerator_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "4.2.1.1.10", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection", + "Name": "dms", + "Checks": [ + "dms_endpoint_ssl_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "dms" + } + ] + }, + { + "Id": "4.2.1.1.11", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints", + "Name": "dms", + "Checks": [ + "dms_endpoint_redis_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "dms" + } + ] + }, + { + "Id": "4.2.1.1.12", + "Description": "Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "4.2.1.1.13", + "Description": "Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "4.2.1.1.14", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.1.15", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.1.16", + "Description": "Checks whether your Classic Load Balancer SSL listeners are using a custom policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.1.17", + "Description": "Checks if your Classic Load Balancer SSL listeners use a predefined policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.1.18", + "Description": "Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.1.19", + "Description": "Checks if Amazon EMR clusters have Kerberos enabled", + "Name": "emr", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "emr" + } + ] + }, + { + "Id": "4.2.1.1.20", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "iam" + } + ] + }, + { + "Id": "4.2.1.1.21", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "iam" + } + ] + }, + { + "Id": "4.2.1.1.22", + "Description": "Checks if AWS Key Management Service (AWS KMS) keys are not scheduled for deletion in AWS KMS", + "Name": "kms", + "Checks": [ + "kms_cmk_not_deleted_unintentionally" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "kms" + } + ] + }, + { + "Id": "4.2.1.1.23", + "Description": "Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster", + "Name": "kafka", + "Checks": [ + "kafka_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "kafka" + } + ] + }, + { + "Id": "4.2.1.1.24", + "Description": "Checks whether connections to OpenSearch domains are using HTTPS", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_https_communications_enforced" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "4.2.1.1.25", + "Description": "Check if Amazon OpenSearch Service nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "4.2.1.1.26", + "Description": "Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients", + "Name": "redshift", + "Checks": [ + "redshift_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "redshift" + } + ] + }, + { + "Id": "4.2.1.1.27", + "Description": "Checks if S3 buckets have policies that require requests to use SSL/TLS", + "Name": "s3", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "s3" + } + ] + }, + { + "Id": "4.2.1.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.2", + "Description": "Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.3", + "Description": "Checks if Amazon CloudFront distributions are encrypting traffic to custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_origin_traffic_encrypted" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.4", + "Description": "Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "4.2.1.5", + "Description": "Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS", + "Name": "dynamodb", + "Checks": [ + "dynamodb_accelerator_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "4.2.1.6", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection", + "Name": "dms", + "Checks": [ + "dms_endpoint_ssl_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "dms" + } + ] + }, + { + "Id": "4.2.1.7", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints", + "Name": "dms", + "Checks": [ + "dms_endpoint_redis_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "dms" + } + ] + }, + { + "Id": "4.2.1.8", + "Description": "Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "4.2.1.9", + "Description": "Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "4.2.1.10", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.11", + "Description": "Checks whether your Classic Load Balancer SSL listeners are using a custom policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.12", + "Description": "Checks if your Classic Load Balancer SSL listeners use a predefined policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.13", + "Description": "Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "elb" + } + ] + }, + { + "Id": "4.2.1.14", + "Description": "Checks if Amazon EMR clusters have Kerberos enabled", + "Name": "emr", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "emr" + } + ] + }, + { + "Id": "4.2.1.15", + "Description": "Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster", + "Name": "kafka", + "Checks": [ + "kafka_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "kafka" + } + ] + }, + { + "Id": "4.2.1.16", + "Description": "Checks whether connections to OpenSearch domains are using HTTPS", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_https_communications_enforced" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "4.2.1.17", + "Description": "Check if Amazon OpenSearch Service nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "4.2.1.18", + "Description": "Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients", + "Name": "redshift", + "Checks": [ + "redshift_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "redshift" + } + ] + }, + { + "Id": "4.2.1.19", + "Description": "Checks if S3 buckets have policies that require requests to use SSL/TLS", + "Name": "s3", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "s3" + } + ] + }, + { + "Id": "5.3.4.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "5.3.4.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "5.3.4.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "5.3.4.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "appsync" + } + ] + }, + { + "Id": "5.3.4.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "elb" + } + ] + }, + { + "Id": "5.3.4.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "5.3.4.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "5.3.4.8", + "Description": "Checks that there is at least one AWS CloudTrail trail defined with security best practices", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_insights_exist" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "5.3.4.9", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "5.3.4.10", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "5.3.4.11", + "Description": "Checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "5.3.4.12", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "dms" + } + ] + }, + { + "Id": "5.3.4.13", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "5.3.4.14", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "ec2" + } + ] + }, + { + "Id": "5.3.4.15", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "ecs" + } + ] + }, + { + "Id": "5.3.4.16", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "eks" + } + ] + }, + { + "Id": "5.3.4.17", + "Description": "Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "5.3.4.18", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "5.3.4.19", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "elb" + } + ] + }, + { + "Id": "5.3.4.20", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "mq" + } + ] + }, + { + "Id": "5.3.4.21", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "mq" + } + ] + }, + { + "Id": "5.3.4.22", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "5.3.4.23", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "neptune" + } + ] + }, + { + "Id": "5.3.4.24", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "5.3.4.25", + "Description": "Checks if Amazon OpenSearch Service domains have audit logging enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_audit_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "5.3.4.26", + "Description": "Checks if Amazon OpenSearch Service domains are configured to send logs to Amazon CloudWatch Logs", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "5.3.4.27", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "rds" + } + ] + }, + { + "Id": "5.3.4.28", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "rds" + } + ] + }, + { + "Id": "5.3.4.29", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "redshift" + } + ] + }, + { + "Id": "5.3.4.30", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "redshift" + } + ] + }, + { + "Id": "5.3.4.31", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "route53" + } + ] + }, + { + "Id": "5.3.4.32", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "s3" + } + ] + }, + { + "Id": "5.3.4.33", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "5.3.4.34", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "vpc" + } + ] + }, + { + "Id": "5.3.4.35", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "5.3.4.36", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.3.3.1", + "Description": "Checks if all of the specified applications are installed on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "6.3.3.2", + "Description": "Checks if the compliance status of the AWS Systems Manager patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance", + "Name": "ssm", + "Checks": [ + "ssm_managed_compliant_patching" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "ssm" + } + ] + }, + { + "Id": "6.3.3.3", + "Description": "Checks if ECS Fargate services is set to the latest platform version", + "Name": "ecs", + "Checks": [ + "ecs_service_fargate_latest_platform_version" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "ecs" + } + ] + }, + { + "Id": "6.3.3.4", + "Description": "Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running the oldest supported version", + "Name": "eks", + "Checks": [ + "eks_cluster_uses_a_supported_version" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "eks" + } + ] + }, + { + "Id": "6.3.3.5", + "Description": "Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running a supported Kubernetes version", + "Name": "eks", + "Checks": [ + "eks_cluster_uses_a_supported_version" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "eks" + } + ] + }, + { + "Id": "6.3.3.6", + "Description": "Checks if Amazon ElastiCache for Redis clusters have auto minor version upgrades enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_auto_minor_version_upgrades" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "6.3.3.7", + "Description": "Checks if managed platform updates in an AWS Elastic Beanstalk environment is enabled", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_managed_updates_enabled" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "6.3.3.8", + "Description": "Checks if the AWS Lambda function settings for runtime, role, timeout, and memory size match the expected values", + "Name": "awslambda", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "6.3.3.9", + "Description": "Checks if Amazon OpenSearch Service version updates are available but not installed", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_updated_to_the_latest_service_software_version" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "6.3.3.10", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) database instances are configured for automatic minor version upgrades", + "Name": "rds", + "Checks": [ + "rds_instance_minor_version_upgrade_enabled" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "rds" + } + ] + }, + { + "Id": "6.3.3.11", + "Description": "Checks if Amazon Redshift clusters have the specified maintenance settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "redshift" + } + ] + }, + { + "Id": "6.4.1.1", + "Description": "Checks if AWS WAF is enabled on Application Load Balancers (ALBs)", + "Name": "elbv2", + "Checks": [ + "elbv2_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "elbv2" + } + ] + }, + { + "Id": "6.4.1.2", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "6.4.1.3", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "6.4.1.4", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "6.4.1.5", + "Description": "Checks if the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "6.4.1.6", + "Description": "Checks if the rule groups associate with the web ACL at the correct priority", + "Name": "fms", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "fms" + } + ] + }, + { + "Id": "6.4.1.7", + "Description": "Checks if WAFv2 Rule Groups contain rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.1.8", + "Description": "Checks if a WAFv2 Web ACL contains any WAF rules or WAF rule groups", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "6.4.1.9", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.1.10", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.1.11", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.1.12", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.1.13", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.1.14", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.1", + "Description": "Checks if AWS WAF is enabled on Application Load Balancers (ALBs)", + "Name": "elbv2", + "Checks": [ + "elbv2_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "elbv2" + } + ] + }, + { + "Id": "6.4.2.2", + "Description": "Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "6.4.2.3", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "6.4.2.4", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "6.4.2.5", + "Description": "Checks if the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "6.4.2.6", + "Description": "Checks if the rule groups associate with the web ACL at the correct priority", + "Name": "fms", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "fms" + } + ] + }, + { + "Id": "6.4.2.7", + "Description": "Checks if WAFv2 Rule Groups contain rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.8", + "Description": "Checks if a WAFv2 Web ACL contains any WAF rules or WAF rule groups", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "6.4.2.9", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.10", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.11", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.12", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.13", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.4.2.14", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "waf" + } + ] + }, + { + "Id": "6.5.5.1", + "Description": "Checks if the deployment group for Lambda Compute Platform is not using the default deployment configuration", + "Name": "codebuild", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.5: Changes to all system components are managed securely. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "6.5.5.2", + "Description": "Checks if the first deployment stage of AWS CodePipeline performs more than one deployment", + "Name": "codepipeline", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.5: Changes to all system components are managed securely. ", + "Service": "codepipeline" + } + ] + }, + { + "Id": "6.5.6.1", + "Description": "Checks if the deployment group for Lambda Compute Platform is not using the default deployment configuration", + "Name": "codebuild", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.6: Changes to all system components are managed securely. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "6.5.6.2", + "Description": "Checks if the first deployment stage of AWS CodePipeline performs more than one deployment", + "Name": "codepipeline", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.6: Changes to all system components are managed securely. ", + "Service": "codepipeline" + } + ] + }, + { + "Id": "7.2.1.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "organizations" + } + ] + }, + { + "Id": "7.2.1.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "backup" + } + ] + }, + { + "Id": "7.2.1.3", + "Description": "Checks if an AWS CodeBuild project environment has privileged mode enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "7.2.1.4", + "Description": "Checks if custom Amazon EventBridge schema registries have a resource policy attached", + "Name": "eventbridge", + "Checks": [ + "eventbridge_schema_registry_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "eventbridge" + } + ] + }, + { + "Id": "7.2.1.5", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "ec2" + } + ] + }, + { + "Id": "7.2.1.6", + "Description": "Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_no_privileged_containers" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.1.7", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.1.8", + "Description": "Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_host_networking_mode_users" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.1.9", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.10", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.11", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.12", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.13", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.14", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.15", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.16", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.17", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.18", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.19", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.1.20", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "neptune" + } + ] + }, + { + "Id": "7.2.1.21", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.2.1.22", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "rds" + } + ] + }, + { + "Id": "7.2.1.23", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "rds" + } + ] + }, + { + "Id": "7.2.1.24", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.1.25", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.1.26", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.1.27", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.1.28", + "Description": "Checks if the Amazon SageMaker RootAccess setting is enabled for Amazon SageMaker notebook instances", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_root_access_disabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "7.2.1.29", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "shield" + } + ] + }, + { + "Id": "7.2.2.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "organizations" + } + ] + }, + { + "Id": "7.2.2.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "backup" + } + ] + }, + { + "Id": "7.2.2.3", + "Description": "Checks if an AWS CodeBuild project environment has privileged mode enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "7.2.2.4", + "Description": "Checks if custom Amazon EventBridge schema registries have a resource policy attached", + "Name": "eventbridge", + "Checks": [ + "eventbridge_schema_registry_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "eventbridge" + } + ] + }, + { + "Id": "7.2.2.5", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "ec2" + } + ] + }, + { + "Id": "7.2.2.6", + "Description": "Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_no_privileged_containers" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.2.7", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.2.8", + "Description": "Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_host_networking_mode_users" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.2.9", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.10", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.11", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.12", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.13", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.14", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.15", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.16", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.17", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.18", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.19", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.2.20", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "neptune" + } + ] + }, + { + "Id": "7.2.2.21", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.2.2.22", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "rds" + } + ] + }, + { + "Id": "7.2.2.23", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "rds" + } + ] + }, + { + "Id": "7.2.2.24", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.2.25", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.2.26", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.2.27", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.2.28", + "Description": "Checks if the Amazon SageMaker RootAccess setting is enabled for Amazon SageMaker notebook instances", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_root_access_disabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "7.2.2.29", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "shield" + } + ] + }, + { + "Id": "7.2.3.1", + "Description": "Checks if an AWS CodeBuild project environment has privileged mode enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "7.2.3.2", + "Description": "Checks if custom Amazon EventBridge schema registries have a resource policy attached", + "Name": "eventbridge", + "Checks": [ + "eventbridge_schema_registry_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "eventbridge" + } + ] + }, + { + "Id": "7.2.3.3", + "Description": "Checks if the privileged parameter in the container definition of ECSTaskDefinitions is set to ‘true’", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_no_privileged_containers" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.3.4", + "Description": "Checks if ECSTaskDefinitions specify a user for Amazon Elastic Container Service (Amazon ECS) EC2 launch type containers to run on", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_host_networking_mode_users" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.3.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.3.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.3.7", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.3.8", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.3.9", + "Description": "Checks if the Amazon SageMaker RootAccess setting is enabled for Amazon SageMaker notebook instances", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_root_access_disabled" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "7.2.4.1", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.4.2", + "Description": "Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided", + "Name": "iam", + "Checks": [ + "iam_user_accesskey_unused" + ], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.4.3", + "Description": "Checks if AWS Secrets Manager secrets have been accessed within a specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_secret_unused" + ], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "7.2.5.1.1", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.1.2", + "Description": "Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided", + "Name": "iam", + "Checks": [ + "iam_user_accesskey_unused" + ], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.1.3", + "Description": "Checks if AWS Secrets Manager secrets have been accessed within a specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_secret_unused" + ], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "7.2.5.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "organizations" + } + ] + }, + { + "Id": "7.2.5.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "backup" + } + ] + }, + { + "Id": "7.2.5.3", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "ec2" + } + ] + }, + { + "Id": "7.2.5.4", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.5.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.7", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.8", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.9", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.10", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.11", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.12", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.13", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.5.14", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "neptune" + } + ] + }, + { + "Id": "7.2.5.15", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.2.5.16", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "rds" + } + ] + }, + { + "Id": "7.2.5.17", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "rds" + } + ] + }, + { + "Id": "7.2.5.18", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.5.19", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.5.20", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.5.21", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.5.22", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "shield" + } + ] + }, + { + "Id": "7.2.6.1", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.2.6.2", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "iam" + } + ] + }, + { + "Id": "7.2.6.3", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.2.6.4", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.2.6.5", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.1.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "organizations" + } + ] + }, + { + "Id": "7.3.1.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "backup" + } + ] + }, + { + "Id": "7.3.1.3", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "ec2" + } + ] + }, + { + "Id": "7.3.1.4", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.3.1.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.7", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.8", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.9", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.10", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.11", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.12", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.13", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.1.14", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "neptune" + } + ] + }, + { + "Id": "7.3.1.15", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.3.1.16", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "rds" + } + ] + }, + { + "Id": "7.3.1.17", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "rds" + } + ] + }, + { + "Id": "7.3.1.18", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.1.19", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.1.20", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.1.21", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.1.22", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "shield" + } + ] + }, + { + "Id": "7.3.2.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "organizations" + } + ] + }, + { + "Id": "7.3.2.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "backup" + } + ] + }, + { + "Id": "7.3.2.3", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "ec2" + } + ] + }, + { + "Id": "7.3.2.4", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.3.2.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.7", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.8", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.9", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.10", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.11", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.12", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.13", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.2.14", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "neptune" + } + ] + }, + { + "Id": "7.3.2.15", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.3.2.16", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "rds" + } + ] + }, + { + "Id": "7.3.2.17", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "rds" + } + ] + }, + { + "Id": "7.3.2.18", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.2.19", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.2.20", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.2.21", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.2.22", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "shield" + } + ] + }, + { + "Id": "7.3.3.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "organizations" + } + ] + }, + { + "Id": "7.3.3.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "backup" + } + ] + }, + { + "Id": "7.3.3.3", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "ec2" + } + ] + }, + { + "Id": "7.3.3.4", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "ecs" + } + ] + }, + { + "Id": "7.3.3.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.7", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.8", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.9", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.10", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.11", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.12", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.13", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "iam" + } + ] + }, + { + "Id": "7.3.3.14", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "neptune" + } + ] + }, + { + "Id": "7.3.3.15", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "opensearch" + } + ] + }, + { + "Id": "7.3.3.16", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "rds" + } + ] + }, + { + "Id": "7.3.3.17", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "rds" + } + ] + }, + { + "Id": "7.3.3.18", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.3.19", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.3.20", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.3.21", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "s3" + } + ] + }, + { + "Id": "7.3.3.22", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "shield" + } + ] + }, + { + "Id": "8.2.1.1", + "Description": "Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.1.2", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.1.3", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.1.4", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.1.5", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.2.1", + "Description": "Checks if the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY", + "Name": "codebuild", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "8.2.2.2", + "Description": "Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.2.3", + "Description": "Checks if secrets are passed as container environment variables", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_no_environment_secrets" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ecs" + } + ] + }, + { + "Id": "8.2.2.4", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.2.5", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.2.6", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.2.7", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.2.8", + "Description": "Checks if AWS Secrets Manager secret has rotation enabled", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.2.2.9", + "Description": "Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.2.2.10", + "Description": "Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.2.2.11", + "Description": "Checks if AWS Secrets Manager secrets have been accessed within a specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_secret_unused" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.2.4.1", + "Description": "Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.4.2", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.4.3", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.4.4", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.4.5", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.5.1", + "Description": "Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.5.2", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.5.3", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.5.4", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.5.5", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.6.1", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.6.2", + "Description": "Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided", + "Name": "iam", + "Checks": [ + "iam_user_accesskey_unused" + ], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.6.3", + "Description": "Checks if AWS Secrets Manager secrets have been accessed within a specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_secret_unused" + ], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.2.7.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "organizations" + } + ] + }, + { + "Id": "8.2.7.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "backup" + } + ] + }, + { + "Id": "8.2.7.3", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.7.4", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ecs" + } + ] + }, + { + "Id": "8.2.7.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.7", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.8", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.9", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.10", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.11", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.12", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.13", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.7.14", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "neptune" + } + ] + }, + { + "Id": "8.2.7.15", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.2.7.16", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.2.7.17", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.2.7.18", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.7.19", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.7.20", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.7.21", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.7.22", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "shield" + } + ] + }, + { + "Id": "8.2.8.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "organizations" + } + ] + }, + { + "Id": "8.2.8.2", + "Description": "Checks whether only IMDSv2 is enabled", + "Name": "autoscaling", + "Checks": [ + "autoscaling_group_launch_configuration_requires_imdsv2" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "autoscaling" + } + ] + }, + { + "Id": "8.2.8.3", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "backup" + } + ] + }, + { + "Id": "8.2.8.4", + "Description": "Checks if your Amazon Elastic Compute Cloud (Amazon EC2) instance metadata version is configured with Instance Metadata Service Version 2 (IMDSv2)", + "Name": "ec2", + "Checks": [ + "ec2_instance_imdsv2_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.8.5", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.2.8.6", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "ecs" + } + ] + }, + { + "Id": "8.2.8.7", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.8", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.9", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.10", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.11", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.12", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.13", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.14", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.15", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.2.8.16", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "neptune" + } + ] + }, + { + "Id": "8.2.8.17", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.2.8.18", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.2.8.19", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.2.8.20", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.8.21", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.8.22", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.8.23", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.2.8.24", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "shield" + } + ] + }, + { + "Id": "8.3.10.1.1", + "Description": "Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge", + "Name": "iam", + "Checks": [ + "iam_rotate_access_key_90_days" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.10.1.2", + "Description": "Checks if AWS Secrets Manager secret has rotation enabled", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.10.1.3", + "Description": "Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.10.1.4", + "Description": "Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.11.1", + "Description": "Checks if running Amazon Elastic Compute Cloud (EC2) instances are launched using amazon key pairs", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.3.11.2", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.11.3", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.11.4", + "Description": "Checks if the root user access key is available", + "Name": "iam", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.11.5", + "Description": "Checks whether IAM users are members of at least one IAM group", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.2.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Application Load Balancers", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elb" + } + ] + }, + { + "Id": "8.3.2.2", + "Description": "Checks if all methods in Amazon API Gateway stages have cache enabled and cache encrypted", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_cache_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "8.3.2.3", + "Description": "Checks if an Amazon Athena workgroup is encrypted at rest", + "Name": "athena", + "Checks": [ + "athena_workgroup_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "athena" + } + ] + }, + { + "Id": "8.3.2.4", + "Description": "Checks if a recovery point is encrypted", + "Name": "backup", + "Checks": [ + "backup_recovery_point_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "backup" + } + ] + }, + { + "Id": "8.3.2.5", + "Description": "Checks if CloudFront distributions are using deprecated SSL protocols for HTTPS communication between CloudFront edge locations and custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_deprecated_ssl_protocols" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "8.3.2.6", + "Description": "Checks if Amazon CloudFront distributions are encrypting traffic to custom origins", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_origin_traffic_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "8.3.2.7", + "Description": "Checks if your Amazon CloudFront distributions use HTTPS (directly or via a redirection)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_https_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "8.3.2.8", + "Description": "Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "8.3.2.9", + "Description": "Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "8.3.2.10", + "Description": "Checks if an AWS CodeBuild project has encryption enabled for all of its artifacts", + "Name": "codebuild", + "Checks": [ + "codebuild_project_s3_logs_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "8.3.2.11", + "Description": "Checks if the project contains environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY", + "Name": "codebuild", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "8.3.2.12", + "Description": "Checks if a AWS CodeBuild project configured with Amazon S3 Logs has encryption enabled for its logs", + "Name": "codebuild", + "Checks": [ + "codebuild_project_s3_logs_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "8.3.2.13", + "Description": "Checks if Amazon DynamoDB Accelerator (DAX) clusters are encrypted", + "Name": "dynamodb", + "Checks": [ + "dynamodb_accelerator_cluster_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "8.3.2.14", + "Description": "Checks if your Amazon DynamoDB Accelerator (DAX) cluster has ClusterEndpointEncryptionType set to TLS", + "Name": "dynamodb", + "Checks": [ + "dynamodb_accelerator_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "8.3.2.15", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints are configured with an SSL connection", + "Name": "dms", + "Checks": [ + "dms_endpoint_ssl_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "dms" + } + ] + }, + { + "Id": "8.3.2.16", + "Description": "Checks if AWS Database Migration Service (AWS DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints", + "Name": "dms", + "Checks": [ + "dms_endpoint_redis_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "dms" + } + ] + }, + { + "Id": "8.3.2.17", + "Description": "Checks if storage encryption is enabled for your Amazon DocumentDB (with MongoDB compatibility) clusters", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_storage_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "8.3.2.18", + "Description": "Checks if Amazon DynamoDB table is encrypted with AWS Key Management Service (KMS)", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_kms_cmk_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "8.3.2.19", + "Description": "Checks if the Amazon DynamoDB tables are encrypted and checks their status", + "Name": "dynamodb", + "Checks": [ + "dynamodb_tables_kms_cmk_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "dynamodb" + } + ] + }, + { + "Id": "8.3.2.20", + "Description": "Checks if Amazon Elastic Block Store (EBS) encryption is enabled by default", + "Name": "ec2", + "Checks": [ + "ec2_ebs_snapshots_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.3.2.21", + "Description": "Checks if secrets are passed as container environment variables", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_no_environment_secrets" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "ecs" + } + ] + }, + { + "Id": "8.3.2.22", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) is configured to encrypt the file data using AWS Key Management Service (AWS KMS)", + "Name": "efs", + "Checks": [ + "efs_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "efs" + } + ] + }, + { + "Id": "8.3.2.23", + "Description": "Checks if Amazon EKS clusters are configured to have Kubernetes secrets encrypted using AWS KMS", + "Name": "eks", + "Checks": [ + "eks_cluster_kms_cmk_encryption_in_secrets_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "eks" + } + ] + }, + { + "Id": "8.3.2.24", + "Description": "Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys", + "Name": "eks", + "Checks": [ + "eks_cluster_kms_cmk_encryption_in_secrets_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "eks" + } + ] + }, + { + "Id": "8.3.2.25", + "Description": "Checks if Amazon ElastiCache replication groups have encryption-at-rest enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_rest_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "8.3.2.26", + "Description": "Checks if Amazon ElastiCache replication groups have encryption-in-transit enabled", + "Name": "elasticache", + "Checks": [ + "elasticache_redis_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elasticache" + } + ] + }, + { + "Id": "8.3.2.27", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains have encryption at rest configuration enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.3.2.28", + "Description": "Check if OpenSearch Service (previously called Elasticsearch) nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.3.2.29", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elb" + } + ] + }, + { + "Id": "8.3.2.30", + "Description": "Checks whether your Classic Load Balancer SSL listeners are using a custom policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elb" + } + ] + }, + { + "Id": "8.3.2.31", + "Description": "Checks if your Classic Load Balancer SSL listeners use a predefined policy", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elb" + } + ] + }, + { + "Id": "8.3.2.32", + "Description": "Checks if your Classic Load Balancer is configured with SSL or HTTPS listeners", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "elb" + } + ] + }, + { + "Id": "8.3.2.33", + "Description": "Checks if Amazon EMR clusters have Kerberos enabled", + "Name": "emr", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "emr" + } + ] + }, + { + "Id": "8.3.2.34", + "Description": "Checks if attached Amazon EBS volumes are encrypted and optionally are encrypted with a specified KMS key", + "Name": "ec2", + "Checks": [ + "ec2_ebs_volume_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.3.2.35", + "Description": "Checks if Amazon Kinesis streams are encrypted at rest with server-side encryption", + "Name": "kinesis", + "Checks": [ + "kinesis_stream_encrypted_at_rest" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "kinesis" + } + ] + }, + { + "Id": "8.3.2.36", + "Description": "Checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster", + "Name": "kafka", + "Checks": [ + "kafka_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "kafka" + } + ] + }, + { + "Id": "8.3.2.37", + "Description": "Checks if storage encryption is enabled for your Amazon Neptune DB clusters", + "Name": "neptune", + "Checks": [ + "neptune_cluster_storage_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "neptune" + } + ] + }, + { + "Id": "8.3.2.38", + "Description": "Checks if an Amazon Neptune DB cluster has snapshots encrypted", + "Name": "neptune", + "Checks": [ + "neptune_cluster_snapshot_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "neptune" + } + ] + }, + { + "Id": "8.3.2.39", + "Description": "Checks if Amazon OpenSearch Service domains have encryption at rest configuration enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.3.2.40", + "Description": "Checks whether connections to OpenSearch domains are using HTTPS", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_https_communications_enforced" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.3.2.41", + "Description": "Check if Amazon OpenSearch Service nodes are encrypted end to end", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_node_to_node_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.3.2.42", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster is encrypted at rest", + "Name": "rds", + "Checks": [ + "rds_cluster_storage_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.3.2.43", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) DB snapshots are encrypted", + "Name": "rds", + "Checks": [ + "rds_snapshots_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.3.2.44", + "Description": "Checks if storage encryption is enabled for your Amazon Relational Database Service (Amazon RDS) DB instances", + "Name": "rds", + "Checks": [ + "rds_instance_storage_encrypted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.3.2.45", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "redshift" + } + ] + }, + { + "Id": "8.3.2.46", + "Description": "Checks if Amazon Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption", + "Name": "redshift", + "Checks": [ + "redshift_cluster_encrypted_at_rest" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "redshift" + } + ] + }, + { + "Id": "8.3.2.47", + "Description": "Checks if Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients", + "Name": "redshift", + "Checks": [ + "redshift_cluster_in_transit_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "redshift" + } + ] + }, + { + "Id": "8.3.2.48", + "Description": "Checks if your Amazon S3 bucket either has the Amazon S3 default encryption enabled\n or that the Amazon S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service", + "Name": "s3", + "Checks": [ + "s3_bucket_default_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.2.49", + "Description": "Checks if S3 buckets have policies that require requests to use SSL/TLS", + "Name": "s3", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.2.50", + "Description": "Checks if the S3 buckets are encrypted with AWS Key Management Service (AWS KMS)", + "Name": "s3", + "Checks": [ + "s3_bucket_kms_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.2.51", + "Description": "Checks if AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker endpoint configuration", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "8.3.2.52", + "Description": "Checks if an AWS Key Management Service (AWS KMS) key is configured for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "8.3.2.53", + "Description": "Checks if all secrets in AWS Secrets Manager are encrypted using the AWS managed key (aws/secretsmanager)\n or a customer managed key that was created in AWS Key Management Service (AWS KMS)", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.2.54", + "Description": "Checks if SNS topics are encrypted with AWS Key Management Service (AWS KMS)", + "Name": "sns", + "Checks": [ + "sns_topics_kms_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "sns" + } + ] + }, + { + "Id": "8.3.4.1", + "Description": "Checks if an AWS account is part of AWS Organizations", + "Name": "organizations", + "Checks": [ + "organizations_account_part_of_organizations" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "organizations" + } + ] + }, + { + "Id": "8.3.4.2", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "backup" + } + ] + }, + { + "Id": "8.3.4.3", + "Description": "Checks if an EC2 instance has an AWS Identity and Access Management (IAM) profile attached to it", + "Name": "ec2", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "8.3.4.4", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "ecs" + } + ] + }, + { + "Id": "8.3.4.5", + "Description": "Checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.6", + "Description": "Checks if the inline policies attached to your IAM users, roles, and groups do not allow blocked actions on all AWS KMS keys", + "Name": "iam", + "Checks": [ + "iam_inline_policy_no_full_access_to_kms" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.7", + "Description": "Checks if the inline policy feature is not in use", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.8", + "Description": "Checks in each AWS Identity and Access Management (IAM) resource, if a policy Amazon Resource Name (ARN) in the input parameter is attached to the IAM resource", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.9", + "Description": "Checks whether the IAM policy ARN is attached to an IAM user, or a group with one or more IAM users, or an IAM role with one or more trusted entity", + "Name": "iam", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.10", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.11", + "Description": "Checks if AWS Identity and Access Management (IAM) policies that you create grant permissions to all actions on individual AWS resources", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.12", + "Description": "Checks if all managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role", + "Name": "iam", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.13", + "Description": "Checks if none of your AWS Identity and Access Management (IAM) users have policies attached", + "Name": "iam", + "Checks": [ + "iam_user_administrator_access_policy" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.4.14", + "Description": "Checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled", + "Name": "neptune", + "Checks": [ + "neptune_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "neptune" + } + ] + }, + { + "Id": "8.3.4.15", + "Description": "Checks if Amazon OpenSearch Service domains have fine-grained access control enabled", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_access_control_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "8.3.4.16", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) cluster has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_cluster_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.3.4.17", + "Description": "Checks if an Amazon Relational Database Service (Amazon RDS) instance has AWS Identity and Access Management (IAM) authentication enabled", + "Name": "rds", + "Checks": [ + "rds_instance_iam_authentication_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "8.3.4.18", + "Description": "Checks if Amazon Simple Storage Service (Amazon S3) Buckets allow user permissions through access control lists (ACLs)", + "Name": "s3", + "Checks": [ + "s3_bucket_acl_prohibited" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.4.19", + "Description": "Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.4.20", + "Description": "Checks that the access granted by the Amazon S3 bucket is restricted by any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.4.21", + "Description": "Checks if your Amazon Simple Storage Service bucket policies do not allow other inter-account permissions than the control Amazon S3 bucket policy that you provide", + "Name": "s3", + "Checks": [ + "s3_bucket_cross_account_access" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.3.4.22", + "Description": "Checks if the Shield Response Team (SRT) can access your AWS account", + "Name": "shield", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "shield" + } + ] + }, + { + "Id": "8.3.5.1", + "Description": "Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge", + "Name": "iam", + "Checks": [ + "iam_rotate_access_key_90_days" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.5.2", + "Description": "Checks if AWS Secrets Manager secret has rotation enabled", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.5.3", + "Description": "Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.5.4", + "Description": "Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.6.1", + "Description": "Checks if the account password policy for AWS Identity and Access Management (IAM) users meets the specified requirements indicated in the parameters", + "Name": "iam", + "Checks": [ + "iam_password_policy_expires_passwords_within_90_days_or_less" + ], + "Attributes": [ + { + "Section": "8.3.6: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.7.1", + "Description": "Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge", + "Name": "iam", + "Checks": [ + "iam_rotate_access_key_90_days" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.7.2", + "Description": "Checks if AWS Secrets Manager secret has rotation enabled", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.7.3", + "Description": "Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.7.4", + "Description": "Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.9.1", + "Description": "Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge", + "Name": "iam", + "Checks": [ + "iam_rotate_access_key_90_days" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.3.9.2", + "Description": "Checks if AWS Secrets Manager secret has rotation enabled", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.9.3", + "Description": "Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.3.9.4", + "Description": "Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.4.1.1", + "Description": "Checks if the AWS Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled", + "Name": "iam", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.1.2", + "Description": "Checks if AWS multi-factor authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password", + "Name": "iam", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.1.3", + "Description": "Checks if your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials", + "Name": "iam", + "Checks": [ + "iam_root_hardware_mfa_enabled" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.1.4", + "Description": "Checks if the root user of your AWS account requires multi-factor authentication for console sign-in", + "Name": "iam", + "Checks": [ + "iam_root_mfa_enabled" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.1.5", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.4.2.1", + "Description": "Checks if the AWS Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled", + "Name": "iam", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.2.2", + "Description": "Checks if AWS multi-factor authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password", + "Name": "iam", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.2.3", + "Description": "Checks if your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials", + "Name": "iam", + "Checks": [ + "iam_root_hardware_mfa_enabled" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.2.4", + "Description": "Checks if the root user of your AWS account requires multi-factor authentication for console sign-in", + "Name": "iam", + "Checks": [ + "iam_root_mfa_enabled" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.2.5", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.4.3.1", + "Description": "Checks if the AWS Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled", + "Name": "iam", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.3.2", + "Description": "Checks if AWS multi-factor authentication (MFA) is enabled for all AWS Identity and Access Management (IAM) users that use a console password", + "Name": "iam", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.3.3", + "Description": "Checks if your AWS account is enabled to use multi-factor authentication (MFA) hardware device to sign in with root credentials", + "Name": "iam", + "Checks": [ + "iam_root_hardware_mfa_enabled" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.3.4", + "Description": "Checks if the root user of your AWS account requires multi-factor authentication for console sign-in", + "Name": "iam", + "Checks": [ + "iam_root_mfa_enabled" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.4.3.5", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "s3" + } + ] + }, + { + "Id": "8.6.3.1", + "Description": "Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge", + "Name": "iam", + "Checks": [ + "iam_rotate_access_key_90_days" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.6.3.2", + "Description": "Checks if the account password policy for AWS Identity and Access Management (IAM) users meets the specified requirements indicated in the parameters", + "Name": "iam", + "Checks": [ + "iam_password_policy_expires_passwords_within_90_days_or_less" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "8.6.3.3", + "Description": "Checks if AWS Secrets Manager secret has rotation enabled", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.6.3.4", + "Description": "Checks if AWS Secrets Manager secrets rotated successfully according to the rotation schedule", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "8.6.3.5", + "Description": "Checks if AWS Secrets Manager secrets have been rotated in the past specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_automatic_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "A1.1.2.1", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "backup" + } + ] + }, + { + "Id": "A1.1.2.2", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "dms" + } + ] + }, + { + "Id": "A1.1.2.3", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "A1.1.2.4", + "Description": "Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable", + "Name": "ec2", + "Checks": [ + "ec2_ebs_snapshot_account_block_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.2.5", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ecs" + } + ] + }, + { + "Id": "A1.1.2.6", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_root_directory" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "efs" + } + ] + }, + { + "Id": "A1.1.2.7", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_user_identity" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "efs" + } + ] + }, + { + "Id": "A1.1.2.8", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "emr" + } + ] + }, + { + "Id": "A1.1.2.9", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "A1.1.2.10", + "Description": "Checks if an Amazon Neptune manual DB cluster snapshot is public", + "Name": "neptune", + "Checks": [ + "neptune_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "neptune" + } + ] + }, + { + "Id": "A1.1.2.11", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "rds" + } + ] + }, + { + "Id": "A1.1.2.12", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public", + "Name": "rds", + "Checks": [ + "rds_snapshots_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "rds" + } + ] + }, + { + "Id": "A1.1.2.13", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "redshift" + } + ] + }, + { + "Id": "A1.1.2.14", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.15", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.16", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.17", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.18", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.19", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.20", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.2.21", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "A1.1.2.22", + "Description": "Checks if AWS Systems Manager documents owned by the account are public", + "Name": "ssm", + "Checks": [ + "ssm_documents_set_as_public" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ssm" + } + ] + }, + { + "Id": "A1.1.3.1", + "Description": "Checks if Amazon API Gateway APIs are of the type specified in the rule parameter endpointConfigurationType", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A1.1.3.2", + "Description": "Checks if a REST API stage uses an SSL certificate", + "Name": "apigateway", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A1.1.3.3", + "Description": "Checks if AWS AppSync APIs are associated with AWS WAFv2 web access control lists (ACLs)", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_waf_acl_attached" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A1.1.3.4", + "Description": "Checks if Amazon CloudFront distributions are associated with either web application firewall (WAF) or WAFv2 web access control lists (ACLs)", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_using_waf" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "A1.1.3.5", + "Description": "Checks if the certificate associated with an Amazon CloudFront distribution is the default SSL certificate", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_custom_ssl_certificate" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "A1.1.3.6", + "Description": "Checks if the Bitbucket source repository URL contains sign-in credentials or not", + "Name": "codebuild", + "Checks": [ + "codebuild_project_source_repo_url_no_sensitive_credentials" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "A1.1.3.7", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "dms" + } + ] + }, + { + "Id": "A1.1.3.8", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "A1.1.3.9", + "Description": "Checks if the AWS Client VPN authorization rules authorizes connection access for all clients", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.10", + "Description": "Checks if the status of the AWS Systems Manager association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance", + "Name": "ec2", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.11", + "Description": "Checks if Amazon Elastic Compute Cloud (Amazon EC2) Transit Gateways have 'AutoAcceptSharedAttachments' enabled", + "Name": "ec2", + "Checks": [ + "ec2_transitgateway_auto_accept_vpc_attachments" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.12", + "Description": "Checks if the Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible", + "Name": "eks", + "Checks": [ + "eks_cluster_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "eks" + } + ] + }, + { + "Id": "A1.1.3.13", + "Description": "Checks if Amazon OpenSearch Service (previously called Elasticsearch) domains are in Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "opensearch", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "A1.1.3.14", + "Description": "Checks if Application Load Balancers and Network Load Balancers have listeners that are configured to use certificates from AWS Certificate Manager (ACM)", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "elb" + } + ] + }, + { + "Id": "A1.1.3.15", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager", + "Name": "elb", + "Checks": [ + "elb_ssl_listeners_use_acm_certificate" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "elb" + } + ] + }, + { + "Id": "A1.1.3.16", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "emr" + } + ] + }, + { + "Id": "A1.1.3.17", + "Description": "For this rule, the rule identifier (INCOMING_SSH_DISABLED) and rule name (restricted-ssh) are different", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.18", + "Description": "Checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "vpc" + } + ] + }, + { + "Id": "A1.1.3.19", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "A1.1.3.20", + "Description": "Checks if a Lambda function is allowed access to a virtual private cloud (VPC)", + "Name": "awslambda", + "Checks": [ + "awslambda_function_inside_vpc" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "A1.1.3.21", + "Description": "Checks if default ports for SSH/RDP ingress traffic for network access control lists (NACLs) is unrestricted", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_allow_ingress_tcp_port_3389" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.22", + "Description": "Checks if an AWS Network Firewall policy is configured with a user defined stateless default action for fragmented packets", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_default_action_fragmented_packets" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "A1.1.3.23", + "Description": "Check AWS Network Firewall policy is associated with stateful OR stateless rule groups", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "A1.1.3.24", + "Description": "Checks if a Stateless Network Firewall Rule Group contains rules", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_policy_rule_group_associated" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "A1.1.3.25", + "Description": "Checks if there are public routes in the route table to an Internet gateway (IGW)", + "Name": "vpc", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "vpc" + } + ] + }, + { + "Id": "A1.1.3.26", + "Description": "Checks if Amazon OpenSearch Service domains are in an Amazon Virtual Private Cloud (VPC)", + "Name": "opensearch", + "Checks": [ + "opensearch_service_domains_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "opensearch" + } + ] + }, + { + "Id": "A1.1.3.27", + "Description": "Checks if there are any Amazon Relational Database Service (Amazon RDS)\n DB security groups that are not the default DB security group", + "Name": "rds", + "Checks": [ + "rds_instance_event_subscription_security_groups" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "rds" + } + ] + }, + { + "Id": "A1.1.3.28", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "rds" + } + ] + }, + { + "Id": "A1.1.3.29", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "redshift" + } + ] + }, + { + "Id": "A1.1.3.30", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.3.31", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.3.32", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.3.33", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.3.34", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.3.35", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.1.3.36", + "Description": "Checks if an Amazon SageMaker notebook instance is launched within a VPC or within a list of approved subnets", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_vpc_settings_configured" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "A1.1.3.37", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "A1.1.3.38", + "Description": "Checks if Service Endpoint for the service provided in rule parameter is created for each Amazon Virtual Private Cloud (Amazon VPC)", + "Name": "vpc", + "Checks": [ + "vpc_endpoint_for_ec2_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "vpc" + } + ] + }, + { + "Id": "A1.1.3.39", + "Description": "Checks if there are unused network access control lists (network ACLs)", + "Name": "ec2", + "Checks": [ + "ec2_networkacl_unused" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.40", + "Description": "Checks if security groups allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports", + "Name": "ec2", + "Checks": [ + "ec2_securitygroup_allow_ingress_from_internet_to_any_port" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.1.3.41", + "Description": "Checks if an AWS WAF Classic rule group contains any rules", + "Name": "waf", + "Checks": [ + "waf_global_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.1.3.42", + "Description": "Checks if an AWS WAF global rule contains any conditions", + "Name": "waf", + "Checks": [ + "waf_global_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.1.3.43", + "Description": "Checks whether a WAF Global Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_global_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.1.3.44", + "Description": "Checks if WAF Regional rule groups contain any rules", + "Name": "waf", + "Checks": [ + "waf_regional_rulegroup_not_empty" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.1.3.45", + "Description": "Checks whether WAF regional rule contains conditions", + "Name": "waf", + "Checks": [ + "waf_regional_rule_with_conditions" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.1.3.46", + "Description": "Checks if a WAF regional Web ACL contains any WAF rules or rule groups", + "Name": "waf", + "Checks": [ + "waf_regional_webacl_with_rules" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.2.1.1", + "Description": "Checks if Amazon API Gateway V2 stages have access logging enabled", + "Name": "apigatewayv2", + "Checks": [ + "apigatewayv2_api_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "apigatewayv2" + } + ] + }, + { + "Id": "A1.2.1.2", + "Description": "Checks if all methods in Amazon API Gateway stages have logging enabled", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A1.2.1.3", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A1.2.1.4", + "Description": "Checks if an AWS AppSync API has logging enabled", + "Name": "appsync", + "Checks": [ + "appsync_field_level_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "appsync" + } + ] + }, + { + "Id": "A1.2.1.5", + "Description": "Checks if Classic Load Balancers (CLB) are configured with a user defined Desync mitigation mode", + "Name": "elb", + "Checks": [ + "elb_desync_mitigation_mode" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "elb" + } + ] + }, + { + "Id": "A1.2.1.6", + "Description": "Checks if Amazon CloudFront distributions are configured to deliver access logs to an Amazon S3 bucket", + "Name": "cloudfront", + "Checks": [ + "cloudfront_distributions_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudfront" + } + ] + }, + { + "Id": "A1.2.1.7", + "Description": "Checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_s3_dataevents_write_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A1.2.1.8", + "Description": "Checks that there is at least one AWS CloudTrail trail defined with security best practices", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_insights_exist" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A1.2.1.9", + "Description": "Checks if Amazon CloudWatch Log Groups are encrypted with any AWS KMS key or a specified AWS KMS key Id", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_log_group_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A1.2.1.10", + "Description": "For this rule, the rule identifier (CLOUD_TRAIL_ENABLED) and rule name (cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A1.2.1.11", + "Description": "Checks if AWS CloudTrail is configured to use the server side encryption (SSE) AWS Key Management Service (AWS KMS) encryption", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A1.2.1.12", + "Description": "Checks if AWS CloudTrail creates a signed digest file with logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_log_file_validation_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A1.2.1.13", + "Description": "Checks if an AWS CodeBuild project environment has at least one log option enabled", + "Name": "codebuild", + "Checks": [ + "codebuild_project_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "codebuild" + } + ] + }, + { + "Id": "A1.2.1.14", + "Description": "Checks if logging is enabled with a valid severity level for AWS DMS replication task events of a target database", + "Name": "dms", + "Checks": [ + "dms_replication_task_target_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "dms" + } + ] + }, + { + "Id": "A1.2.1.15", + "Description": "Checks if an Amazon DocumentDB (with MongoDB compatibility) instance cluster has CloudWatch log export enabled for audit logs", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_cloudwatch_log_export" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "A1.2.1.16", + "Description": "Checks if AWS Client VPN endpoint has client connection logging enabled", + "Name": "ec2", + "Checks": [ + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A1.2.1.17", + "Description": "Checks if logConfiguration is set on active ECS Task Definitions", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "ecs" + } + ] + }, + { + "Id": "A1.2.1.18", + "Description": "Checks if an Amazon Elastic Kubernetes Service (Amazon EKS) cluster is configured with logging enabled", + "Name": "eks", + "Checks": [ + "eks_control_plane_logging_all_types_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "eks" + } + ] + }, + { + "Id": "A1.2.1.19", + "Description": "Checks if AWS Elastic Beanstalk environments are configured to send logs to Amazon CloudWatch Logs", + "Name": "elasticbeanstalk", + "Checks": [ + "elasticbeanstalk_environment_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "elasticbeanstalk" + } + ] + }, + { + "Id": "A1.2.1.20", + "Description": "Checks if the Application Load Balancer and the Classic Load Balancer have logging enabled", + "Name": "elb", + "Checks": [ + "elb_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "elb" + } + ] + }, + { + "Id": "A1.2.1.21", + "Description": "Checks if Amazon MQ brokers have Amazon CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "mq" + } + ] + }, + { + "Id": "A1.2.1.22", + "Description": "Checks if an Amazon MQ broker has CloudWatch audit logging enabled", + "Name": "mq", + "Checks": [ + "mq_broker_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "mq" + } + ] + }, + { + "Id": "A1.2.1.23", + "Description": "For this rule, the rule identifier (MULTI_REGION_CLOUD_TRAIL_ENABLED) and rule name (multi-region-cloudtrail-enabled) are different", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A1.2.1.24", + "Description": "Checks if an Amazon Neptune cluster has CloudWatch log export enabled for audit logs", + "Name": "neptune", + "Checks": [ + "neptune_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "neptune" + } + ] + }, + { + "Id": "A1.2.1.25", + "Description": "Checks if AWS Network Firewall firewalls have logging enabled", + "Name": "networkfirewall", + "Checks": [ + "networkfirewall_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "networkfirewall" + } + ] + }, + { + "Id": "A1.2.1.26", + "Description": "Checks if Amazon Aurora MySQL-Compatible Edition clusters are configured to publish audit logs to Amazon CloudWatch Logs", + "Name": "rds", + "Checks": [ + "rds_cluster_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "rds" + } + ] + }, + { + "Id": "A1.2.1.27", + "Description": "Checks if respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "Name": "rds", + "Checks": [ + "rds_instance_integration_cloudwatch_logs" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "rds" + } + ] + }, + { + "Id": "A1.2.1.28", + "Description": "Checks if Amazon Redshift clusters are logging audits to a specific bucket", + "Name": "redshift", + "Checks": [ + "redshift_cluster_audit_logging" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "redshift" + } + ] + }, + { + "Id": "A1.2.1.29", + "Description": "Checks if Amazon Redshift clusters have the specified settings", + "Name": "redshift", + "Checks": [ + "redshift_cluster_multi_az_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "redshift" + } + ] + }, + { + "Id": "A1.2.1.30", + "Description": "Checks if DNS query logging is enabled for your Amazon Route 53 public hosted zones", + "Name": "route53", + "Checks": [ + "route53_public_hosted_zones_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "route53" + } + ] + }, + { + "Id": "A1.2.1.31", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.2.1.32", + "Description": "Checks if logging is enabled for your S3 buckets", + "Name": "s3", + "Checks": [ + "s3_bucket_server_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "s3" + } + ] + }, + { + "Id": "A1.2.1.33", + "Description": "Checks if AWS Step Functions machine has logging enabled", + "Name": "stepfunctions", + "Checks": [ + "stepfunctions_statemachine_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "stepfunctions" + } + ] + }, + { + "Id": "A1.2.1.34", + "Description": "Checks if Amazon Virtual Private Cloud (Amazon VPC) flow logs are found and enabled for all Amazon VPCs", + "Name": "vpc", + "Checks": [ + "vpc_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "vpc" + } + ] + }, + { + "Id": "A1.2.1.35", + "Description": "Checks if logging is enabled on AWS WAFv2 regional and global web access control lists (web ACLs)", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "A1.2.1.36", + "Description": "Checks if logging is enabled on AWS WAF classic global web access control lists (web ACLs)", + "Name": "waf", + "Checks": [ + "waf_global_webacl_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "waf" + } + ] + }, + { + "Id": "A1.2.3.1", + "Description": "Checks if you have provided security contact information for your AWS account contacts", + "Name": "account", + "Checks": [ + "account_security_contact_information_is_registered" + ], + "Attributes": [ + { + "Section": "A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "account" + } + ] + }, + { + "Id": "A3.2.5.1.1", + "Description": "Checks if automated sensitive data discovery is enabled for Amazon Macie", + "Name": "macie", + "Checks": [ + "macie_automated_sensitive_data_discovery_enabled" + ], + "Attributes": [ + { + "Section": "A3.2.5.1: PCI DSS scope is documented and validated. ", + "Service": "macie" + } + ] + }, + { + "Id": "A3.2.5.1.2", + "Description": "Checks if Amazon Macie is enabled in your account per region", + "Name": "macie", + "Checks": [ + "macie_is_enabled" + ], + "Attributes": [ + { + "Section": "A3.2.5.1: PCI DSS scope is documented and validated. ", + "Service": "macie" + } + ] + }, + { + "Id": "A3.2.5.1.3", + "Description": "Checks if automated sensitive data discovery is enabled for Amazon Macie", + "Name": "macie", + "Checks": [ + "macie_automated_sensitive_data_discovery_enabled" + ], + "Attributes": [ + { + "Section": "A3.2.5.2: PCI DSS scope is documented and validated. ", + "Service": "macie" + } + ] + }, + { + "Id": "A3.2.5.1.4", + "Description": "Checks if Amazon Macie is enabled in your account per region", + "Name": "macie", + "Checks": [ + "macie_is_enabled" + ], + "Attributes": [ + { + "Section": "A3.2.5.2: PCI DSS scope is documented and validated. ", + "Service": "macie" + } + ] + }, + { + "Id": "A3.3.1.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A3.3.1.2", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "A3.3.1.3", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A3.3.1.4", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A3.3.1.5", + "Description": "Checks whether CloudWatch alarms with the given metric name have the specified settings", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A3.3.1.6", + "Description": "Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A3.3.1.7", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A3.3.1.8", + "Description": "Checks if Amazon S3 Events Notifications are enabled on an S3 bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_event_notifications_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.3.1.9", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "A3.3.1.10", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "sns" + } + ] + }, + { + "Id": "A3.3.1.11", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "wafv2" + } + ] + }, + { + "Id": "A3.4.1.1", + "Description": "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points", + "Name": "backup", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "backup" + } + ] + }, + { + "Id": "A3.4.1.2", + "Description": "Checks if AWS Database Migration Service (AWS DMS) replication instances are public", + "Name": "dms", + "Checks": [ + "dms_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "dms" + } + ] + }, + { + "Id": "A3.4.1.3", + "Description": "Checks if Amazon DocumentDB manual cluster snapshots are public", + "Name": "documentdb", + "Checks": [ + "documentdb_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "documentdb" + } + ] + }, + { + "Id": "A3.4.1.4", + "Description": "Checks if Amazon Elastic Block Store (Amazon EBS) snapshots are not publicly restorable", + "Name": "ec2", + "Checks": [ + "ec2_ebs_snapshot_account_block_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A3.4.1.5", + "Description": "Checks if Amazon Elastic Container Service (Amazon ECS) Containers only have read-only access to its root filesystems", + "Name": "ecs", + "Checks": [ + "ecs_task_definitions_containers_readonly_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "ecs" + } + ] + }, + { + "Id": "A3.4.1.6", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a root directory", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_root_directory" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "efs" + } + ] + }, + { + "Id": "A3.4.1.7", + "Description": "Checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity", + "Name": "efs", + "Checks": [ + "efs_access_point_enforce_user_identity" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "efs" + } + ] + }, + { + "Id": "A3.4.1.8", + "Description": "Checks if an account with Amazon EMR has block public access settings enabled", + "Name": "emr", + "Checks": [ + "emr_cluster_account_public_block_enabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "emr" + } + ] + }, + { + "Id": "A3.4.1.9", + "Description": "Checks whether IAM groups have at least one IAM user", + "Name": "iam", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "A3.4.1.10", + "Description": "Checks if your AWS Identity and Access Management (IAM) users have passwords or active access keys that have not been used within the specified number of days you provided", + "Name": "iam", + "Checks": [ + "iam_user_accesskey_unused" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "iam" + } + ] + }, + { + "Id": "A3.4.1.11", + "Description": "Checks if the AWS Lambda function policy attached to the Lambda resource prohibits public access", + "Name": "awslambda", + "Checks": [ + "awslambda_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "awslambda" + } + ] + }, + { + "Id": "A3.4.1.12", + "Description": "Checks if an Amazon Neptune manual DB cluster snapshot is public", + "Name": "neptune", + "Checks": [ + "neptune_cluster_public_snapshot" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "neptune" + } + ] + }, + { + "Id": "A3.4.1.13", + "Description": "Checks if the Amazon Relational Database Service (Amazon RDS) instances are not publicly accessible", + "Name": "rds", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "A3.4.1.14", + "Description": "Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public", + "Name": "rds", + "Checks": [ + "rds_snapshots_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "rds" + } + ] + }, + { + "Id": "A3.4.1.15", + "Description": "Checks if Amazon Redshift clusters are not publicly accessible", + "Name": "redshift", + "Checks": [ + "redshift_cluster_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "redshift" + } + ] + }, + { + "Id": "A3.4.1.16", + "Description": "Checks if Amazon S3 access points have block public access settings enabled", + "Name": "s3", + "Checks": [ + "s3_access_point_public_access_block" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.17", + "Description": "Checks if the required public access block settings are configured from account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.18", + "Description": "Checks if the required public access block settings are configured at the account level", + "Name": "s3", + "Checks": [ + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.19", + "Description": "Checks if S3 buckets are publicly accessible", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.20", + "Description": "Checks if MFA Delete is enabled in the Amazon Simple Storage Service (Amazon S3) bucket versioning configuration", + "Name": "s3", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.21", + "Description": "Checks if your Amazon S3 buckets do not allow public read access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.22", + "Description": "Checks if your Amazon S3 buckets do not allow public write access", + "Name": "s3", + "Checks": [ + "s3_bucket_public_write_acl" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.4.1.23", + "Description": "Checks if direct internet access is disabled for an Amazon SageMaker notebook instance", + "Name": "sagemaker", + "Checks": [ + "sagemaker_notebook_instance_without_direct_internet_access_configured" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "sagemaker" + } + ] + }, + { + "Id": "A3.4.1.24", + "Description": "Checks if AWS Secrets Manager secrets have been accessed within a specified number of days", + "Name": "secretsmanager", + "Checks": [ + "secretsmanager_secret_unused" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "secretsmanager" + } + ] + }, + { + "Id": "A3.4.1.25", + "Description": "Checks if AWS Systems Manager documents owned by the account are public", + "Name": "ssm", + "Checks": [ + "ssm_documents_set_as_public" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "ssm" + } + ] + }, + { + "Id": "A3.5.1.1", + "Description": "Checks if AWS X-Ray tracing is enabled on Amazon API Gateway REST APIs", + "Name": "apigateway", + "Checks": [ + "apigateway_restapi_tracing_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "apigateway" + } + ] + }, + { + "Id": "A3.5.1.2", + "Description": "Checks if your CloudFormation stacks send event notifications to an Amazon SNS topic", + "Name": "cloudformation", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "cloudformation" + } + ] + }, + { + "Id": "A3.5.1.3", + "Description": "Checks if CloudWatch alarms have an action configured for the ALARM, INSUFFICIENT_DATA, or OK state", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A3.5.1.4", + "Description": "Checks if a resource type has a CloudWatch alarm for the named metric", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A3.5.1.5", + "Description": "Checks whether CloudWatch alarms with the given metric name have the specified settings", + "Name": "cloudwatch", + "Checks": [ + "cloudwatch_alarm_actions_alarm_state_configured" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "cloudwatch" + } + ] + }, + { + "Id": "A3.5.1.6", + "Description": "Checks if AWS CloudTrail trails are configured to send logs to CloudWatch logs", + "Name": "cloudtrail", + "Checks": [ + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "cloudtrail" + } + ] + }, + { + "Id": "A3.5.1.7", + "Description": "Checks if detailed monitoring is enabled for EC2 instances", + "Name": "ec2", + "Checks": [ + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "ec2" + } + ] + }, + { + "Id": "A3.5.1.8", + "Description": "Checks if Amazon S3 Events Notifications are enabled on an S3 bucket", + "Name": "s3", + "Checks": [ + "s3_bucket_event_notifications_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "s3" + } + ] + }, + { + "Id": "A3.5.1.9", + "Description": "Checks if AWS Security Hub is enabled for an AWS Account", + "Name": "securityhub", + "Checks": [ + "securityhub_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "securityhub" + } + ] + }, + { + "Id": "A3.5.1.10", + "Description": "Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints", + "Name": "sns", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "sns" + } + ] + }, + { + "Id": "A3.5.1.11", + "Description": "Checks if Amazon CloudWatch security metrics collection on AWS WAFv2 rule groups is enabled", + "Name": "wafv2", + "Checks": [ + "wafv2_webacl_rule_logging_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "wafv2" + } + ] + } + ] +}