diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index bb81edca20..b69a37cfb7 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -14,6 +14,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Changed - Handle some AWS errors as warnings instead of errors [(#8347)](https://github.com/prowler-cloud/prowler/pull/8347) +- Updated policy mapping in ISMS-P compliance file for improved alignment [(#8367)](https://github.com/prowler-cloud/prowler/pull/8367) ### Fixed - False positives in SQS encryption check for ephemeral queues [(#8330)](https://github.com/prowler-cloud/prowler/pull/8330) diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json index 28d1fc4406..ff7f50553e 100644 --- a/prowler/compliance/aws/kisa_isms_p_2023_aws.json +++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json @@ -207,11 +207,9 @@ "Name": "Identification of Information Assets", "Description": "Organizations must establish classification criteria for information assets according to the characteristics of their operations, identify and classify all information assets within the scope of the management system, assess their importance, and maintain an up-to-date list.", "Checks": [ - "organizations_tags_policies_enabled_and_attached", - "organizations_account_part_of_organizations", - "macie_is_enabled", - "config_recorder_all_regions_enabled", - "resourceexplorer2_indexes_found" + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" ], "Attributes": [ { @@ -330,7 +328,7 @@ ], "RelatedRegulations": [], "AuditEvidence": [ - "Information protection and personal information protection implementation plans/risk management plans", + "Information protection and personal information protection implementation plans/risk management plan", "Information protection and personal information protection measures", "Information protection and personal information protection master plan", "Records of management reports and approvals for the information protection and personal information protection implementation plan" @@ -405,7 +403,10 @@ "Id": "1.3.3", "Name": "Operation Status Management", "Description": "According to the management system established by the organization, operational activities that must be performed continuously or periodically must be recorded and managed in a way that allows identification and tracking, and management must regularly review the effectiveness of operational activities and manage them accordingly.", - "Checks": [], + "Checks": [ + "cloudwatch_log_metric_filter_aws_organizations_changes", + "codebuild_project_older_90_days" + ], "Attributes": [ { "Domain": "1. Establishment and Operation of the Management System", @@ -573,7 +574,11 @@ "Id": "2.1.2", "Name": "Organization Maintenance", "Description": "Roles and responsibilities related to information protection and personal information protection must be assigned to all members of the organization, and systems must be established for evaluating these activities and for communication between members and departments.", - "Checks": [], + "Checks": [ + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -612,15 +617,18 @@ "Name": "Management of Information Assets", "Description": "The procedures and protection measures for handling information assets according to their purpose and importance must be established and implemented, and the responsibilities for each asset must be clearly defined and managed.", "Checks": [ - "organizations_tags_policies_enabled_and_attached", + "ec2_elastic_ip_unassigned", + "ec2_instance_older_than_specific_days", + "ecr_repositories_lifecycle_policy_enabled", + "fsx_file_system_copy_tags_to_volumes_enabled", "organizations_account_part_of_organizations", - "macie_is_enabled", - "config_recorder_all_regions_enabled", - "resourceexplorer2_indexes_found", - "account_maintain_current_contact_details", - "account_maintain_different_contact_details_to_security_billing_and_operations", - "account_security_questions_are_registered_in_the_aws_account", - "account_security_contact_information_is_registered" + "organizations_delegated_administrators", + "organizations_scp_check_deny_regions", + "organizations_tags_policies_enabled_and_attached", + "rds_cluster_copy_tags_to_snapshots", + "neptune_cluster_copy_tags_to_snapshots", + "rds_instance_copy_tags_to_snapshots", + "resourceexplorer2_indexes_found" ], "Attributes": [ { @@ -651,9 +659,8 @@ "Name": "Designation and Management of Key Personnel", "Description": "Criteria and management plans for key duties, such as handling personal information and important information or accessing key systems, must be established, and the number of key personnel must be minimized and their list kept up-to-date.", "Checks": [ - "organizations_delegated_administrators", - "account_security_contact_information_is_registered", - "iam_support_role_created" + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" ], "Attributes": [ { @@ -690,7 +697,9 @@ "Id": "2.2.2", "Name": "Separation of Duties", "Description": "Criteria for the separation of duties must be established and applied to prevent potential harm from the misuse or abuse of authority. If separation of duties is unavoidable, supplementary measures must be established and implemented.", - "Checks": [], + "Checks": [ + "account_maintain_different_contact_details_to_security_billing_and_operations" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -1081,7 +1090,7 @@ "Fire Facility Installation and Management Act, Article 12 (Management of Fire Protection Facilities in Specific Fire Protection Objects), Article 16 (Management of Evacuation Facilities, Fire Zones, and Fire Protection Facilities)" ], "AuditEvidence": [ - "Physical security guidelines (related to protective facilities)", + "Physical security guidelines (related to protective facilities", "Data center facility status and inspection checklist", "IDC outsourcing contract, SLA, etc." ], @@ -1190,28 +1199,40 @@ "Name": "User Account Management", "Description": "To control unauthorized access to information systems, personal information, and critical information, organizations must establish and implement procedures for user registration, termination, and granting, changing, or revoking access rights, ensuring that access rights are granted only to the minimum necessary for work purposes. Additionally, when registering or granting user rights, it must be made clear to users that they are responsible for the security of their accounts.", "Checks": [ - "organizations_scp_check_deny_regions", + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "apigateway_restapi_authorizers_enabled", + "autoscaling_group_launch_configuration_requires_imdsv2", + "cognito_user_pool_deletion_protection_enabled", "cognito_user_pool_self_registration_disabled", - "iam_user_administrator_access_policy", + "config_recorder_using_aws_service_role", + "ec2_instance_profile_attached", + "eventbridge_schema_registry_cross_account_access", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges", "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", "iam_inline_policy_allows_privilege_escalation", "iam_inline_policy_no_administrative_privileges", - "iam_aws_attached_policy_no_administrative_privileges", - "iam_policy_allows_privilege_escalation", - "iam_policy_no_full_access_to_kms", - "iam_role_cross_service_confused_deputy_prevention", "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_role_cross_account_readonlyaccess_policy", "iam_inline_policy_no_full_access_to_kms", - "iam_user_accesskey_unused", - "iam_securityaudit_role_created", "iam_no_custom_policy_permissive_role_assumption", - "iam_customer_attached_policy_no_administrative_privileges", - "iam_group_administrator_access_policy", - "iam_user_console_access_unused", + "iam_no_root_access_key", + "iam_policy_allows_privilege_escalation", "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", "iam_policy_no_full_access_to_cloudtrail", - "iam_role_administratoraccess_policy" + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_administrator_access_policy" ], "Attributes": [ { @@ -1245,7 +1266,11 @@ "Id": "2.5.2", "Name": "User Identification", "Description": "User accounts must be assigned unique identifiers that distinguish each user individually, and the use of easily guessable identifiers must be restricted. If the same identifier is shared by multiple users, the reason and justification must be reviewed, supplementary measures such as approval from a responsible party must be established, and accountability must be ensured.", - "Checks": [], + "Checks": [ + "cognito_user_pool_advanced_security_enabled", + "ec2_instance_profile_attached", + "efs_access_point_enforce_user_identity" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -1277,35 +1302,48 @@ "Name": "User Authentication", "Description": "User access to information systems, personal information, and critical information must be secured through safe authentication procedures and, if necessary, enhanced authentication methods. In addition, access control measures such as limiting login attempts and issuing warnings for illegal login attempts must be established and implemented.", "Checks": [ + "account_security_questions_are_registered_in_the_aws_account", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public_with_authorizer", + "apigatewayv2_api_authorizers_enabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "cloudtrail_bucket_requires_mfa_delete", "cloudwatch_log_metric_filter_authentication_failures", "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", "cognito_user_pool_advanced_security_enabled", - "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", "cognito_user_pool_mfa_enabled", - "cognito_user_pool_self_registration_disabled", + "directoryservice_supported_mfa_radius_enabled", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "efs_access_point_enforce_user_identity", + "elasticache_redis_replication_group_auth_enabled", + "iam_administrator_access_with_mfa", + "iam_check_saml_providers_sts", + "iam_no_root_access_key", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_rotate_access_key_90_days", + "iam_user_accesskey_unused", + "iam_user_console_access_unused", + "iam_user_hardware_mfa_enabled", + "iam_user_mfa_enabled_console_access", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "iam_user_with_temporary_credentials", + "neptune_cluster_iam_authentication_enabled", "opensearch_service_domains_internal_user_database_enabled", "opensearch_service_domains_use_cognito_authentication_for_kibana", - "directoryservice_supported_mfa_radius_enabled", - "iam_rotate_access_key_90_days", - "iam_root_hardware_mfa_enabled", - "iam_user_no_setup_initial_access_key", - "iam_root_mfa_enabled", - "iam_user_with_temporary_credentials", - "iam_user_hardware_mfa_enabled", - "iam_check_saml_providers_sts", - "iam_user_two_active_access_key", - "iam_user_accesskey_unused", - "iam_user_mfa_enabled_console_access", - "iam_administrator_access_with_mfa", - "apigatewayv2_api_authorizers_enabled", - "kafka_cluster_unrestricted_access_disabled", + "organizations_account_part_of_organizations", "rds_cluster_iam_authentication_enabled", "rds_instance_iam_authentication_enabled", - "apigateway_restapi_authorizers_enabled" + "s3_bucket_cross_account_access", + "s3_bucket_no_mfa_delete" ], "Attributes": [ { @@ -1338,18 +1376,18 @@ "Name": "Password Management", "Description": "Procedures for managing passwords used by users of information systems, as well as customers and members, must be established and implemented, taking into account legal requirements and external threats.", "Checks": [ - "cognito_user_pool_temporary_password_expiration", - "cognito_user_pool_password_policy_uppercase", - "cognito_user_pool_password_policy_number", "cognito_user_pool_password_policy_lowercase", "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_number", "cognito_user_pool_password_policy_symbol", - "iam_password_policy_number", - "iam_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_temporary_password_expiration", "iam_password_policy_expires_passwords_within_90_days_or_less", - "iam_password_policy_symbol", - "iam_password_policy_reuse_24", "iam_password_policy_lowercase", + "iam_password_policy_minimum_length_14", + "iam_password_policy_number", + "iam_password_policy_reuse_24", + "iam_password_policy_symbol", "iam_password_policy_uppercase" ], "Attributes": [ @@ -1383,17 +1421,41 @@ "Name": "Management of Special Accounts and Privileges", "Description": "Accounts and privileges used for special purposes, such as managing information systems, personal information, and important information, should be granted minimally, separately identified, and controlled.", "Checks": [ - "organizations_delegated_administrators", + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "apigateway_restapi_authorizers_enabled", "cloudwatch_log_metric_filter_root_usage", + "cognito_user_pool_self_registration_disabled", + "config_recorder_using_aws_service_role", + "ecs_task_definitions_no_privileged_containers", + "iam_administrator_access_with_mfa", + "iam_avoid_root_usage", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_no_root_access_key", + "iam_policy_allows_privilege_escalation", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", "iam_root_hardware_mfa_enabled", "iam_root_mfa_enabled", + "iam_securityaudit_role_created", "iam_support_role_created", - "iam_avoid_root_usage", - "iam_no_root_access_key", - "rds_instance_default_admin", + "iam_user_administrator_access_policy", + "organizations_delegated_administrators", "rds_cluster_default_admin", + "rds_instance_default_admin", "sagemaker_notebook_instance_root_access_disabled", - "ec2_instance_profile_attached" + "ses_identity_not_publicly_accessible" ], "Attributes": [ { @@ -1428,20 +1490,59 @@ "Name": "Review of Access Rights", "Description": "The registration, use, and deletion of user accounts accessing information systems, personal information, and important information, as well as the history of granting, changing, and deleting access rights, should be recorded and periodically reviewed to ensure their appropriateness.", "Checks": [ - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_policy_changes", - "accessanalyzer_enabled_without_findings", "accessanalyzer_enabled", - "cloudtrail_insights_exist", - "cloudtrail_multi_region_enabled_logging_management_events", - "cloudtrail_cloudwatch_logging_enabled" + "accessanalyzer_enabled_without_findings", + "apigateway_restapi_authorizers_enabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "autoscaling_group_launch_configuration_requires_imdsv2", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_metric_filter_policy_changes", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_self_registration_disabled", + "config_recorder_using_aws_service_role", + "dynamodb_table_cross_account_access", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_managed_by_ssm", + "ec2_instance_profile_attached", + "eventbridge_bus_cross_account_access", + "eventbridge_schema_registry_cross_account_access", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_policy_allows_privilege_escalation", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_administrator_access_policy", + "s3_bucket_cross_account_access", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "ses_identity_not_publicly_accessible", + "sns_topics_not_publicly_accessible", + "sqs_queues_not_publicly_accessible", + "ssm_documents_set_as_public", + "vpc_endpoint_services_allowed_principals_trust_boundaries" ], "Attributes": [ { @@ -1475,118 +1576,134 @@ "Name": "Network Access", "Description": "In order to control unauthorized access to the network, management procedures such as IP management and device authentication must be established and implemented. Network segmentation (DMZ, server farm, DB zone, development zone, etc.) and access controls must be applied according to the business purpose and importance.", "Checks": [ - "ssm_documents_set_as_public", - "s3_access_point_public_access_block", - "s3_bucket_public_write_acl", - "s3_bucket_acl_prohibited", - "s3_account_level_public_access_blocks", - "s3_bucket_level_public_access_block", - "emr_cluster_account_public_block_enabled", - "emr_cluster_master_nodes_no_public_ip", - "emr_cluster_publicly_accesible", - "documentdb_cluster_public_snapshot", - "sns_topics_not_publicly_accessible", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", - "cloudfront_distributions_geo_restrictions_enabled", - "opensearch_service_domains_not_publicly_accessible", - "glacier_vaults_policy_public_access", - "lightsail_instance_public", - "lightsail_database_public", - "neptune_cluster_uses_public_subnet", - "neptune_cluster_public_snapshot", - "ecr_repositories_not_publicly_accessible", - "workspaces_vpc_2private_1public_subnets_nat", - "elb_internet_facing", - "sqs_queues_not_publicly_accessible", - "redshift_cluster_public_access", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", - "awslambda_function_url_public", - "awslambda_function_url_cors_policy", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_waf_acl_attached", + "appstream_fleet_default_internet_access_disabled", + "autoscaling_group_launch_configuration_no_public_ip", + "awslambda_function_inside_vpc", "awslambda_function_not_publicly_accessible", - "iam_user_administrator_access_policy", - "iam_group_administrator_access_policy", - "iam_user_mfa_enabled_console_access", - "networkfirewall_in_all_vpc", + "cloudfront_distributions_default_root_object", + "cloudfront_distributions_geo_restrictions_enabled", + "cloudfront_distributions_s3_origin_access_control", + "cloudfront_distributions_using_waf", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_security_group_changes", + "cognito_user_pool_waf_acl_attached", + "dms_instance_no_public_access", + "documentdb_cluster_public_snapshot", + "dynamodb_table_cross_account_access", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_public_ip", + "ec2_instance_uses_single_eni", + "ec2_launch_template_no_public_ip", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_default_restrict_traffic", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ecr_repositories_not_publicly_accessible", + "ecs_service_no_assign_public_ip", + "ecs_task_set_no_assign_public_ip", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", "eks_cluster_network_policy_enabled", "eks_cluster_not_publicly_accessible", "eks_cluster_private_nodes_enabled", - "eks_cluster_not_publicly_accessible", - "kafka_cluster_is_public", - "kafka_cluster_unrestricted_access_disabled", - "vpc_peering_routing_tables_with_least_privilege", - "vpc_subnet_no_public_ip_by_default", - "vpc_endpoint_services_allowed_principals_trust_boundaries", - "vpc_endpoint_connections_trust_boundaries", - "vpc_subnet_separate_private_public", - "dms_instance_no_public_access", + "elasticache_cluster_uses_public_subnet", + "elb_internet_facing", "elbv2_internet_facing", "elbv2_listeners_underneath", - "elasticache_cluster_uses_public_subnet", - "appstream_fleet_maximum_session_duration", - "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", - "appstream_fleet_session_disconnect_timeout", + "elbv2_waf_acl_attached", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_exposed", + "glue_data_catalogs_not_publicly_accessible", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "lightsail_database_public", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "neptune_cluster_public_snapshot", + "neptune_cluster_uses_public_subnet", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "opensearch_service_domains_not_publicly_accessible", "rds_snapshots_public_access", - "rds_instance_no_public_access", - "rds_instance_event_subscription_security_groups", - "rds_instance_iam_authentication_enabled", - "apigateway_restapi_public", - "apigateway_restapi_authorizers_enabled", - "apigateway_restapi_public_with_authorizer", - "sagemaker_training_jobs_network_isolation_enabled", - "sagemaker_models_vpc_settings_configured", - "sagemaker_training_jobs_vpc_settings_configured", + "rds_instance_inside_vpc", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_public_access", + "route53_dangling_ip_subdomain_takeover", + "s3_access_point_public_access_block", "sagemaker_models_network_isolation_enabled", - "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_models_vpc_settings_configured", "sagemaker_notebook_instance_vpc_settings_configured", - "ec2_instance_port_ldap_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_securitygroup_not_used", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_elastic_ip_shodan", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_networkacl_allow_ingress_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_ebs_public_snapshot", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_transitgateway_auto_accept_vpc_attachments", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_ami_public", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_instance_imdsv2_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_instance_public_ip", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_training_jobs_vpc_settings_configured", + "sqs_queues_server_side_encryption_enabled", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_with_rules", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { @@ -1624,30 +1741,106 @@ "Name": "Access to Information Systems", "Description": "The users, access restriction methods, and secure access means for accessing information systems such as servers and network systems must be defined and controlled.", "Checks": [ - "lightsail_instance_public", - "lightsail_static_ip_unused", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_elastic_ip_unassigned", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_elastic_ip_shodan", - "ec2_instance_port_rdp_exposed_to_internet", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_waf_acl_attached", + "apigatewayv2_api_authorizers_enabled", + "athena_workgroup_enforce_configuration", + "autoscaling_group_launch_configuration_requires_imdsv2", + "awslambda_function_inside_vpc", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "awslambda_function_not_publicly_accessible", + "cloudfront_distributions_s3_origin_access_control", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_not_publicly_accessible", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_client_token_revocation_enabled", + "dms_instance_no_public_access", + "documentdb_cluster_public_snapshot", + "dynamodb_table_cross_account_access", + "ec2_ami_public", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_imdsv2_enabled", "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", "ec2_instance_managed_by_ssm", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_instance_public_ip", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ecr_repositories_not_publicly_accessible", + "ecs_service_no_assign_public_ip", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_no_privileged_containers", + "ecs_task_set_no_assign_public_ip", + "efs_access_point_enforce_root_directory", + "efs_access_point_enforce_user_identity", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", + "eks_cluster_network_policy_enabled", + "eks_cluster_not_publicly_accessible", + "eks_cluster_private_nodes_enabled", + "elasticache_cluster_uses_public_subnet", + "elasticache_redis_replication_group_auth_enabled", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_exposed", + "glacier_vaults_policy_public_access", + "glue_data_catalogs_not_publicly_accessible", + "guardduty_lambda_protection_enabled", + "guardduty_s3_protection_enabled", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "neptune_cluster_public_snapshot", + "opensearch_service_domains_not_publicly_accessible", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "s3_access_point_public_access_block", + "s3_account_level_public_access_blocks", + "s3_bucket_acl_prohibited", + "s3_bucket_cross_account_access", + "s3_bucket_level_public_access_block", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "s3_multi_region_access_point_public_access_block", + "ssm_documents_set_as_public" ], "Attributes": [ { @@ -1684,7 +1877,26 @@ "Id": "2.6.3", "Name": "Access to Applications", "Description": "Access rights to applications must be restricted according to the user's tasks and the importance of the accessed information, and criteria should be established to minimize exposure of unnecessary or sensitive information.", - "Checks": [], + "Checks": [ + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigatewayv2_api_authorizers_enabled", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "cloudfront_distributions_default_root_object", + "codeartifact_packages_external_public_publishing_disabled", + "cognito_user_pool_waf_acl_attached", + "ec2_ami_public", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ecr_repositories_not_publicly_accessible", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "eks_cluster_network_policy_enabled" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -1729,43 +1941,46 @@ "Name": "Database Access", "Description": "Identify the information stored and managed in the database, such as the table list, and establish and implement access control policies according to the importance of the information and the type of applications and users.", "Checks": [ + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", "documentdb_cluster_public_snapshot", - "opensearch_service_domains_internal_user_database_enabled", - "opensearch_service_domains_use_cognito_authentication_for_kibana", - "opensearch_service_domains_https_communications_enforced", - "opensearch_service_domains_not_publicly_accessible", - "accessanalyzer_enabled_without_findings", - "accessanalyzer_enabled", + "dynamodb_table_cross_account_access", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "guardduty_rds_protection_enabled", "lightsail_database_public", "neptune_cluster_iam_authentication_enabled", "neptune_cluster_uses_public_subnet", - "neptune_cluster_public_snapshot", - "dynamodb_table_cross_account_access", - "redshift_cluster_public_access", - "vpc_subnet_separate_private_public", - "dms_instance_no_public_access", + "opensearch_service_domains_internal_user_database_enabled", "rds_cluster_iam_authentication_enabled", - "rds_snapshots_public_access", - "rds_instance_no_public_access", + "rds_cluster_non_default_port", + "rds_cluster_storage_encrypted", "rds_instance_iam_authentication_enabled", + "rds_instance_no_public_access", + "rds_instance_non_default_port", + "rds_instance_storage_encrypted", "rds_instance_transport_encrypted", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_instance_port_mongodb_exposed_to_internet" + "rds_snapshots_public_access", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_in_transit_encryption_enabled", + "redshift_cluster_non_default_database_name", + "redshift_cluster_non_default_username", + "redshift_cluster_public_access" ], "Attributes": [ { @@ -1800,7 +2015,7 @@ { "Id": "2.6.5", "Name": "Wireless Network Access", - "Description": "When using a wireless network, wireless network protection measures such as user authentication, encryption of transmitted and received data, and AP control must be applied. In addition, protection measures must be established and implemented to prevent unauthorized wireless network access, such as AD Hoc connections and the use of unauthorized APs.", + "Description": "When using a wireless network, wireless network protection measures such as user authentication, encryption of transmitted and received data, and AP control must be applied. In addition, protection measures must be established and implemented to prevent unauthorized wireless network access, such as AD Hoc connections and the use of unauthorized APs", "Checks": [], "Attributes": [ { @@ -1835,32 +2050,25 @@ "Name": "Remote Access Control", "Description": "Managing information systems and handling personal information outside of protected areas is, in principle, prohibited. However, if remote access is allowed for unavoidable reasons such as telecommuting, incident response, or remote collaboration, protective measures must be established and implemented, including approval from responsible personnel, designation of access devices, setting access scope and duration, enhanced authentication, encrypted communication, and securing access devices (e.g., antivirus, patches).", "Checks": [ - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_mfa_enabled", - "cognito_user_pool_self_registration_disabled", - "workspaces_vpc_2private_1public_subnets_nat", - "workspaces_volume_encryption_enabled", - "iam_user_console_access_unused", - "iam_user_mfa_enabled_console_access", - "networkfirewall_in_all_vpc", - "vpc_subnet_no_public_ip_by_default", - "vpc_flow_logs_enabled", - "vpc_subnet_separate_private_public", - "appstream_fleet_maximum_session_duration", "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_maximum_session_duration", "appstream_fleet_session_disconnect_timeout", - "ec2_client_vpn_endpoint_connection_logging_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_ssh_exposed_to_internet", + "appstream_fleet_session_idle_disconnect_timeout", + "autoscaling_group_launch_configuration_requires_imdsv2", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_networkacl_allow_ingress_any_port", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_networkacl_allow_ingress_tcp_port_22" + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "vpc_vpn_connection_tunnels_up", + "workspaces_volume_encryption_enabled", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { @@ -1900,25 +2108,57 @@ "Name": "Internet Access Control", "Description": "To prevent information leaks, malware infections, and intrusions into the internal network through the internet, policies must be established and implemented to restrict internet access or services (e.g., P2P, web hard drives, messengers) on key information systems, devices handling sensitive duties, and terminals processing personal information.", "Checks": [ - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_changes_to_network_acls_alarm_configured", - "workspaces_vpc_2private_1public_subnets_nat", - "workspaces_volume_encryption_enabled", - "networkfirewall_in_all_vpc", - "vpc_subnet_no_public_ip_by_default", - "vpc_flow_logs_enabled", - "vpc_subnet_separate_private_public", - "appstream_fleet_maximum_session_duration", + "apigateway_restapi_waf_acl_attached", "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", - "appstream_fleet_session_disconnect_timeout", - "route53_dangling_ip_subdomain_takeover", - "ec2_elastic_ip_unassigned", + "autoscaling_group_launch_configuration_no_public_ip", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "cloudfront_distributions_using_waf", + "dms_instance_no_public_access", "ec2_elastic_ip_shodan", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_public_ip" + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_public_ip", + "ecs_service_no_assign_public_ip", + "elb_internet_facing", + "elbv2_internet_facing", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_exposed", + "glue_data_catalogs_not_publicly_accessible", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "neptune_cluster_public_snapshot", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_multi_az", + "opensearch_service_domains_not_publicly_accessible", + "route53_dangling_ip_subdomain_takeover", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { @@ -1956,72 +2196,83 @@ "Name": "Application of Encryption Policy", "Description": "To protect personal and important information, encryption policies that reflect legal requirements, such as encryption targets, encryption strength, and encryption usage policies, must be established. Encryption must be applied during the storage, transmission, and transfer of personal and important information.", "Checks": [ - "codebuild_project_no_secrets_in_variables", - "ssm_document_secrets", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_group_no_secrets_in_logs", - "glue_etl_jobs_amazon_s3_encryption_enabled", - "glue_development_endpoints_s3_encryption_enabled", - "glue_data_catalogs_metadata_encryption_enabled", - "glue_data_catalogs_connection_passwords_encryption_enabled", - "glue_development_endpoints_cloudwatch_logs_encryption_enabled", - "glue_database_connections_ssl_enabled", - "glue_etl_jobs_job_bookmark_encryption_enabled", - "glue_development_endpoints_job_bookmark_encryption_enabled", - "glue_etl_jobs_cloudwatch_logs_encryption_enabled", - "s3_bucket_kms_encryption", - "s3_bucket_default_encryption", - "s3_bucket_secure_transport_policy", - "documentdb_cluster_storage_encrypted", - "sns_subscription_not_using_http_endpoints", - "sns_topics_kms_encryption_at_rest_enabled", - "cloudfront_distributions_https_enabled", + "acm_certificates_expiration_check", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_cache_encrypted", + "athena_workgroup_encryption", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "backup_recovery_point_encrypted", + "cloudformation_stack_outputs_find_secrets", + "cloudfront_distributions_custom_ssl_certificate", "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_origin_traffic_encrypted", "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudwatch_log_group_no_secrets_in_logs", + "codebuild_project_no_secrets_in_variables", + "codebuild_project_s3_logs_encrypted", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "codebuild_report_group_export_encrypted", + "directoryservice_ldap_certificate_expiration", + "directoryservice_radius_server_security_protocol", + "dms_endpoint_ssl_enabled", + "documentdb_cluster_storage_encrypted", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_accelerator_cluster_in_transit_encryption_enabled", + "ec2_ebs_default_encryption", + "ec2_ebs_snapshots_encrypted", + "ec2_ebs_volume_encryption", + "ec2_instance_secrets_user_data", + "ec2_launch_template_no_secrets", + "ecs_task_definitions_no_environment_secrets", + "efs_encryption_at_rest_enabled", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "elb_ssl_listeners_use_acm_certificate", + "elbv2_insecure_ssl_ciphers", + "elbv2_nlb_tls_termination_enabled", + "elbv2_ssl_listeners", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_database_connections_ssl_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_ml_transform_encrypted_at_rest", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_in_transit_encryption_enabled", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_connector_in_transit_encryption_enabled", + "kinesis_stream_encrypted_at_rest", + "neptune_cluster_snapshot_encrypted", + "neptune_cluster_storage_encrypted", "opensearch_service_domains_encryption_at_rest_enabled", "opensearch_service_domains_https_communications_enforced", "opensearch_service_domains_node_to_node_encryption_enabled", - "neptune_cluster_storage_encrypted", - "dynamodb_accelerator_cluster_encryption_enabled", - "dynamodb_tables_kms_cmk_encryption_enabled", - "storagegateway_fileshare_encryption_enabled", - "ecs_task_definitions_no_environment_secrets", - "directoryservice_radius_server_security_protocol", - "workspaces_volume_encryption_enabled", - "elb_insecure_ssl_ciphers", - "elb_ssl_listeners", - "sqs_queues_server_side_encryption_enabled", - "cloudtrail_kms_encryption_enabled", - "awslambda_function_no_secrets_in_code", - "awslambda_function_no_secrets_in_variables", - "eks_cluster_kms_cmk_encryption_in_secrets_enabled", - "kafka_cluster_mutual_tls_authentication_enabled", - "kafka_cluster_encryption_at_rest_uses_cmk", - "kafka_cluster_in_transit_encryption_enabled", - "autoscaling_find_secrets_ec2_launch_configuration", - "elbv2_insecure_ssl_ciphers", - "elbv2_ssl_listeners", - "backup_vaults_exist", - "backup_vaults_encrypted", - "cloudformation_stack_outputs_find_secrets", - "elasticache_redis_cluster_in_transit_encryption_enabled", - "elasticache_redis_cluster_rest_encryption_enabled", + "rds_cluster_storage_encrypted", "rds_instance_storage_encrypted", - "rds_snapshots_encrypted", "rds_instance_transport_encrypted", - "apigateway_restapi_client_certificate_enabled", - "efs_encryption_at_rest_enabled", - "sagemaker_training_jobs_volume_and_output_encryption_enabled", - "sagemaker_training_jobs_intercontainer_encryption_enabled", + "rds_snapshots_encrypted", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_in_transit_encryption_enabled", + "s3_bucket_default_encryption", + "s3_bucket_secure_transport_policy", "sagemaker_notebook_instance_encryption_enabled", - "acm_certificates_with_secure_key_algorithms", - "athena_workgroup_enforce_configuration", - "athena_workgroup_encryption", - "ec2_instance_secrets_user_data", - "ec2_ebs_default_encryption", - "ec2_ebs_snapshots_encrypted", - "ec2_launch_template_no_secrets", - "ec2_ebs_volume_encryption" + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sns_subscription_not_using_http_endpoints", + "sqs_queues_server_side_encryption_enabled", + "ssm_document_secrets", + "transfer_server_in_transit_encryption_enabled" ], "Attributes": [ { @@ -2057,15 +2308,40 @@ "Name": "Cryptographic Key Management", "Description": "Establish and implement management procedures for the secure generation, use, storage, distribution, and destruction of cryptographic keys, and prepare recovery methods if necessary.", "Checks": [ - "secretsmanager_automatic_rotation_enabled", - "kms_cmk_are_used", - "kms_key_not_publicly_accessible", - "kms_cmk_rotation_enabled", - "kms_cmk_not_deleted_unintentionally", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "athena_workgroup_encryption", + "backup_vaults_encrypted", + "bedrock_model_invocation_logs_encryption_enabled", + "cloudfront_distributions_custom_ssl_certificate", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_origin_traffic_encrypted", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudtrail_kms_encryption_enabled", + "cloudwatch_log_group_kms_encryption_enabled", "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "directoryservice_ldap_certificate_expiration", + "dms_endpoint_ssl_enabled", + "dynamodb_tables_kms_cmk_encryption_enabled", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "iam_no_expired_server_certificates_stored", + "iam_rotate_access_key_90_days", + "iam_user_accesskey_unused", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", "rds_instance_certificate_expiration", - "acm_certificates_transparency_logs_enabled" + "s3_bucket_kms_encryption", + "secretsmanager_automatic_rotation_enabled", + "secretsmanager_not_publicly_accessible", + "secretsmanager_secret_rotated_periodically", + "secretsmanager_secret_unused", + "sns_topics_kms_encryption_at_rest_enabled", + "storagegateway_fileshare_encryption_enabled", + "workspaces_volume_encryption_enabled" ], "Attributes": [ { @@ -2096,24 +2372,7 @@ "Id": "2.8.1", "Name": "Definition of Security Requirements", "Description": "When introducing, developing, or modifying information systems, security requirements such as legal requirements related to information protection and personal information protection, the latest security vulnerabilities, and secure coding methods must be defined and applied.", - "Checks": [ - "codebuild_project_no_secrets_in_variables", - "codebuild_project_user_controlled_buildspec", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "macie_is_enabled", - "inspector2_is_enabled", - "config_recorder_all_regions_enabled", - "fms_policy_compliant", - "wafv2_webacl_logging_enabled", - "accessanalyzer_enabled", - "wellarchitected_workload_no_high_or_medium_risks", - "cloudtrail_cloudwatch_logging_enabled", - "networkfirewall_in_all_vpc", - "vpc_flow_logs_enabled", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "securityhub_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2144,27 +2403,7 @@ "Id": "2.8.2", "Name": "Review and Testing of Security Requirements", "Description": "To verify that an information system has been introduced or implemented according to predefined security requirements, review standards and procedures must be established and implemented to check compliance with legal requirements, the latest security vulnerabilities, secure coding implementation, and personal information impact assessment, and corrective measures must be taken for any identified issues.", - "Checks": [ - "codebuild_project_no_secrets_in_variables", - "codebuild_project_user_controlled_buildspec", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "macie_is_enabled", - "inspector2_is_enabled", - "inspector2_active_findings_exist", - "config_recorder_all_regions_enabled", - "fms_policy_compliant", - "wafv2_webacl_logging_enabled", - "accessanalyzer_enabled_without_findings", - "accessanalyzer_enabled", - "wellarchitected_workload_no_high_or_medium_risks", - "cloudtrail_cloudwatch_logging_enabled", - "networkfirewall_in_all_vpc", - "vpc_flow_logs_enabled", - "guardduty_no_high_severity_findings", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "securityhub_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2203,9 +2442,7 @@ "Id": "2.8.3", "Name": "Separation of Test and Production Environments", "Description": "Development and test systems must, in principle, be separated from production systems to reduce the risk of unauthorized access and changes to the production system.", - "Checks": [ - "codebuild_project_user_controlled_buildspec" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2232,9 +2469,7 @@ "Id": "2.8.4", "Name": "Test Data Security", "Description": "In order to prevent the leakage of operational data during system testing, procedures for the creation, use, management, disposal, and technical protection measures of test data must be established and implemented.", - "Checks": [ - "codebuild_project_no_secrets_in_variables" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2264,8 +2499,8 @@ "Name": "Source Program Management", "Description": "Source programs must be managed so that only authorized users can access them, and it is a principle that they should not be stored in the operational environment.", "Checks": [ - "ecr_repositories_not_publicly_accessible", - "codeartifact_packages_external_public_publishing_disabled" + "codeartifact_packages_external_public_publishing_disabled", + "ecr_repositories_tag_immutability" ], "Attributes": [ { @@ -2323,22 +2558,7 @@ "Id": "2.9.1", "Name": "Change Management", "Description": "Procedures must be established and implemented to manage all changes to assets related to information systems, and the impact on system performance and security must be analyzed before changes are made.", - "Checks": [ - "codebuild_project_older_90_days", - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "config_recorder_all_regions_enabled", - "cloudtrail_cloudwatch_logging_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2367,45 +2587,70 @@ "Name": "Performance and Fault Management", "Description": "To ensure the availability of information systems, performance and capacity requirements must be defined, and the status must be continuously monitored. Procedures for detecting, recording, analyzing, recovering, and reporting in response to faults must be established and managed effectively.", "Checks": [ - "kms_cmk_not_deleted_unintentionally", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "s3_bucket_no_mfa_delete", - "s3_bucket_cross_region_replication", - "documentdb_cluster_cloudwatch_log_export", - "documentdb_cluster_deletion_protection", - "config_recorder_all_regions_enabled", - "cognito_user_pool_deletion_protection_enabled", - "neptune_cluster_multi_az", - "neptune_cluster_deletion_protection", - "directoryservice_directory_monitor_notifications", - "directoryservice_ldap_certificate_expiration", - "elb_is_in_multiple_az", - "elb_cross_zone_load_balancing_enabled", - "cloudtrail_bucket_requires_mfa_delete", - "cloudtrail_multi_region_enabled_logging_management_events", - "cloudtrail_multi_region_enabled", - "iam_no_expired_server_certificates_stored", - "networkfirewall_deletion_protection", - "kafka_cluster_enhanced_monitoring_enabled", - "vpc_subnet_different_az", - "trustedadvisor_premium_support_plan_subscribed", - "trustedadvisor_errors_and_warnings", - "dms_instance_multi_az_enabled", + "acm_certificates_expiration_check", + "apigateway_restapi_tracing_enabled", + "autoscaling_group_capacity_rebalance_enabled", + "autoscaling_group_elb_health_check_enabled", "autoscaling_group_multiple_az", - "elbv2_is_in_multiple_az", - "elbv2_deletion_protection", + "autoscaling_group_multiple_instance_types", + "awslambda_function_vpc_multi_az", "cloudformation_stacks_termination_protection_enabled", + "cloudfront_distributions_s3_origin_non_existent_bucket", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "dms_instance_multi_az_enabled", + "documentdb_cluster_deletion_protection", + "documentdb_cluster_multi_az_enabled", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_deletion_protection_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ecs_cluster_container_insights_enabled", + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_logging_block_mode", + "elasticache_redis_cluster_automatic_failover_enabled", "elasticache_redis_cluster_multi_az_enabled", - "rds_instance_multi_az", - "rds_cluster_backtrack_enabled", - "rds_instance_enhanced_monitoring_enabled", - "rds_instance_deletion_protection", - "rds_instance_certificate_expiration", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elb_connection_draining_enabled", + "elb_cross_zone_load_balancing_enabled", + "elb_is_in_multiple_az", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_deletion_protection", + "elbv2_is_in_multiple_az", + "fsx_windows_file_system_multi_az_enabled", + "iam_no_expired_server_certificates_stored", + "kafka_cluster_enhanced_monitoring_enabled", + "kms_cmk_not_deleted_unintentionally", + "mq_broker_active_deployment_mode", + "mq_broker_cluster_deployment_mode", + "neptune_cluster_deletion_protection", + "neptune_cluster_multi_az", + "networkfirewall_deletion_protection", + "networkfirewall_multi_az", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", "rds_cluster_deletion_protection", "rds_cluster_multi_az", - "acm_certificates_expiration_check", - "route53_domains_transferlock_enabled", - "ec2_instance_detailed_monitoring_enabled" + "rds_instance_certificate_expiration", + "rds_instance_deletion_protection", + "rds_instance_deprecated_engine_version", + "rds_instance_multi_az", + "redshift_cluster_multi_az_enabled", + "s3_bucket_cross_region_replication", + "s3_bucket_no_mfa_delete", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "sagemaker_endpoint_config_prod_variant_instances", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "trustedadvisor_errors_and_warnings", + "trustedadvisor_premium_support_plan_subscribed", + "vpc_different_regions", + "vpc_endpoint_multi_az_enabled", + "vpc_subnet_different_az", + "vpc_vpn_connection_tunnels_up" ], "Attributes": [ { @@ -2440,43 +2685,36 @@ "Name": "Backup and Recovery Management", "Description": "To maintain the availability and data integrity of the information system, procedures must be established and implemented regarding the backup targets, frequency, methods, storage locations, retention periods, and disaster recovery. Additionally, management must ensure timely recovery in case of incidents.", "Checks": [ - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "s3_access_point_public_access_block", - "s3_bucket_lifecycle_enabled", - "s3_bucket_object_versioning", - "s3_bucket_kms_encryption", - "s3_bucket_public_write_acl", - "s3_bucket_policy_public_write_access", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_cross_region_replication", - "s3_bucket_default_encryption", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_public_snapshot", - "lightsail_instance_automated_snapshots", - "neptune_cluster_backup_enabled", - "neptune_cluster_public_snapshot", - "ecr_repositories_lifecycle_policy_enabled", - "dynamodb_tables_pitr_enabled", - "directoryservice_directory_snapshots_limit", - "redshift_cluster_automated_snapshot", - "dlm_ebs_snapshot_lifecycle_policy_exists", + "backup_plans_exist", + "backup_recovery_point_encrypted", "backup_reportplans_exist", "backup_vaults_exist", - "backup_vaults_encrypted", - "backup_plans_exist", - "elasticache_redis_cluster_backup_enabled", - "rds_cluster_copy_tags_to_snapshots", - "rds_instance_copy_tags_to_snapshots", - "rds_cluster_backtrack_enabled", - "rds_snapshots_public_access", - "rds_instance_backup_enabled", - "efs_have_backup_enabled", - "ec2_ebs_snapshot_account_block_public_access", - "ec2_ebs_public_snapshot", + "cloudfront_distributions_multiple_origin_failover_configured", + "directoryservice_directory_snapshots_limit", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "documentdb_cluster_backup_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_pitr_enabled", + "ec2_ebs_volume_protected_by_backup_plan", "ec2_ebs_volume_snapshots_exists", - "ec2_ebs_snapshots_encrypted", - "ec2_ami_public" + "efs_have_backup_enabled", + "elasticache_redis_cluster_backup_enabled", + "fsx_file_system_copy_tags_to_backups_enabled", + "lightsail_instance_automated_snapshots", + "neptune_cluster_backup_enabled", + "neptune_cluster_copy_tags_to_snapshots", + "neptune_cluster_public_snapshot", + "neptune_cluster_snapshot_encrypted", + "rds_cluster_backtrack_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_cluster_protected_by_backup_plan", + "rds_instance_backup_enabled", + "rds_instance_copy_tags_to_snapshots", + "rds_instance_protected_by_backup_plan", + "rds_snapshots_encrypted", + "rds_snapshots_public_access", + "redshift_cluster_automated_snapshot", + "s3_bucket_lifecycle_enabled" ], "Attributes": [ { @@ -2511,87 +2749,76 @@ "Name": "Log and Access Record Management", "Description": "The organization must define the types of logs, retention periods, and retention methods for user access records, system logs, and privilege grant records for information systems such as servers, applications, security systems, and network systems, and must securely retain and manage them to prevent tampering, theft, or loss.", "Checks": [ - "eventbridge_bus_exposed", - "eventbridge_bus_cross_account_access", - "eventbridge_schema_registry_cross_account_access", - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_group_no_secrets_in_logs", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "glue_development_endpoints_cloudwatch_logs_encryption_enabled", - "glue_etl_jobs_cloudwatch_logs_encryption_enabled", - "s3_access_point_public_access_block", - "s3_bucket_server_access_logging_enabled", - "s3_bucket_kms_encryption", - "s3_bucket_public_write_acl", - "s3_bucket_policy_public_write_access", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_default_encryption", - "s3_account_level_public_access_blocks", - "s3_bucket_level_public_access_block", - "documentdb_cluster_cloudwatch_log_export", - "macie_is_enabled", - "inspector2_is_enabled", - "config_recorder_all_regions_enabled", + "acm_certificates_transparency_logs_enabled", + "apigateway_restapi_logging_enabled", + "apigatewayv2_api_access_logging_enabled", + "athena_workgroup_logging_enabled", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "bedrock_model_invocation_logging_enabled", + "bedrock_model_invocation_logs_encryption_enabled", + "cloudformation_stack_outputs_find_secrets", "cloudfront_distributions_logging_enabled", - "wafv2_webacl_logging_enabled", - "opensearch_service_domains_audit_logging_enabled", - "opensearch_service_domains_cloudwatch_logging_enabled", - "directoryservice_directory_log_forwarding_enabled", - "directoryservice_directory_monitor_notifications", - "elb_logging_enabled", - "redshift_cluster_audit_logging", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", "cloudtrail_insights_exist", + "cloudtrail_log_file_validation_enabled", "cloudtrail_logs_s3_bucket_access_logging_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", "cloudtrail_multi_region_enabled_logging_management_events", "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_log_file_validation_enabled", "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_multi_region_enabled", - "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_securityaudit_role_created", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "codebuild_project_logging_enabled", + "codebuild_project_s3_logs_encrypted", + "config_recorder_all_regions_enabled", + "datasync_task_logging_enabled", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "documentdb_cluster_cloudwatch_log_export", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_enabled", "eks_control_plane_logging_all_types_enabled", - "apigatewayv2_api_access_logging_enabled", - "kafka_cluster_enhanced_monitoring_enabled", - "vpc_flow_logs_enabled", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "trustedadvisor_premium_support_plan_subscribed", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elb_logging_enabled", "elbv2_logging_enabled", - "securityhub_enabled", + "eventbridge_global_endpoint_event_replication_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_logging_enabled", + "kafka_cluster_enhanced_monitoring_enabled", + "mq_broker_logging_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "networkfirewall_logging_enabled", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "rds_cluster_critical_event_subscription", + "rds_cluster_integration_cloudwatch_logs", + "rds_instance_critical_event_subscription", "rds_instance_enhanced_monitoring_enabled", - "rds_snapshots_public_access", - "rds_snapshots_encrypted", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", "rds_instance_integration_cloudwatch_logs", - "apigateway_restapi_logging_enabled", - "efs_not_publicly_accessible", - "acm_certificates_transparency_logs_enabled", + "redshift_cluster_audit_logging", "route53_public_hosted_zones_cloudwatch_logging_enabled", - "ec2_instance_detailed_monitoring_enabled", - "ec2_ebs_snapshot_account_block_public_access", - "ec2_instance_managed_by_ssm", - "ec2_ebs_public_snapshot", - "ec2_ebs_snapshots_encrypted", - "ec2_client_vpn_endpoint_connection_logging_enabled" + "s3_bucket_server_access_logging_enabled", + "vpc_flow_logs_enabled", + "waf_global_webacl_logging_enabled", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled" ], "Attributes": [ { @@ -2628,34 +2855,7 @@ "Id": "2.9.5", "Name": "Log and Access Record Inspection", "Description": "To ensure normal use of the information system and prevent misuse (unauthorized access, excessive queries, etc.) by users, log review criteria for access and usage must be established and inspected periodically, and post-event actions must be taken promptly if issues arise.", - "Checks": [ - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_group_no_secrets_in_logs", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "inspector2_active_findings_exist", - "cognito_user_pool_client_prevent_user_existence_errors", - "accessanalyzer_enabled_without_findings", - "cloudtrail_insights_exist", - "cloudtrail_threat_detection_enumeration", - "guardduty_no_high_severity_findings", - "trustedadvisor_errors_and_warnings" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2698,7 +2898,7 @@ "Section": "2.9.6 Time Synchronization", "AuditChecklist": [ "Is the system time synchronized with the standard time?", - "Is regular inspection conducted to ensure that time synchronization is functioning properly?" + "Is regular inspection conducted to ensure that time synchronization is functioning properly?'" ], "RelatedRegulations": [], "AuditEvidence": [ @@ -2753,81 +2953,101 @@ "Name": "Security System Operation", "Description": "For each type of security system, an administrator must be designated, and operational procedures such as updating to the latest policies, modifying rule sets, and monitoring events must be established and implemented. The status of policy application for each security system must be managed.", "Checks": [ - "organizations_delegated_administrators", + "apigateway_restapi_waf_acl_attached", + "autoscaling_group_multiple_az", + "autoscaling_group_multiple_instance_types", + "cloudfront_distributions_using_waf", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_kms_encryption_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cognito_user_pool_waf_acl_attached", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", + "dms_instance_minor_version_upgrade_enabled", + "dms_instance_multi_az_enabled", + "dms_instance_no_public_access", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_instance_managed_by_ssm", + "elbv2_waf_acl_attached", + "fms_policy_compliant", + "guardduty_centrally_managed", + "guardduty_ec2_malware_protection_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", + "guardduty_is_enabled", + "guardduty_lambda_protection_enabled", + "guardduty_no_high_severity_findings", + "guardduty_rds_protection_enabled", + "guardduty_s3_protection_enabled", + "inspector2_active_findings_exist", + "inspector2_is_enabled", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", + "macie_automated_sensitive_data_discovery_enabled", + "macie_is_enabled", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_logging_enabled", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "securityhub_enabled", + "shield_advanced_protection_in_associated_elastic_ips", "shield_advanced_protection_in_classic_load_balancers", - "shield_advanced_protection_in_route53_hosted_zones", "shield_advanced_protection_in_cloudfront_distributions", "shield_advanced_protection_in_global_accelerators", - "shield_advanced_protection_in_associated_elastic_ips", "shield_advanced_protection_in_internet_facing_load_balancers", - "ssm_managed_compliant_patching", - "secretsmanager_automatic_rotation_enabled", - "kms_cmk_are_used", - "kms_key_not_publicly_accessible", - "kms_cmk_rotation_enabled", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "macie_is_enabled", - "inspector2_is_enabled", - "inspector2_active_findings_exist", - "config_recorder_all_regions_enabled", - "cognito_user_pool_waf_acl_attached", - "fms_policy_compliant", - "ssmincidents_enabled_with_plans", - "cloudfront_distributions_using_waf", - "wafv2_webacl_logging_enabled", - "guardduty_no_high_severity_findings", - "guardduty_is_enabled", - "guardduty_centrally_managed", + "shield_advanced_protection_in_route53_hosted_zones", "trustedadvisor_errors_and_warnings", - "elbv2_waf_acl_attached", - "securityhub_enabled", - "apigateway_restapi_waf_acl_attached", - "ec2_instance_port_ldap_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_securitygroup_from_launch_wizard", - "ec2_securitygroup_not_used", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_networkacl_allow_ingress_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "trustedadvisor_premium_support_plan_subscribed", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_logging_enabled", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled", + "wafv2_webacl_with_rules" ], "Attributes": [ { @@ -2869,7 +3089,559 @@ "Id": "2.10.2", "Name": "Cloud Security", "Description": "When using cloud services, protection measures must be established and implemented for administrator access and security settings to prevent unauthorized access and configuration errors that could lead to the leakage or exposure of critical information and personal data, depending on the service type (SaaS, PaaS, IaaS, etc.).", - "Checks": [], + "Checks": [ + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_cache_encrypted", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_logging_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_tracing_enabled", + "apigateway_restapi_waf_acl_attached", + "apigatewayv2_api_access_logging_enabled", + "apigatewayv2_api_authorizers_enabled", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "athena_workgroup_encryption", + "athena_workgroup_enforce_configuration", + "athena_workgroup_logging_enabled", + "autoscaling_group_capacity_rebalance_enabled", + "autoscaling_group_elb_health_check_enabled", + "autoscaling_group_launch_configuration_no_public_ip", + "autoscaling_group_launch_configuration_requires_imdsv2", + "autoscaling_group_multiple_az", + "autoscaling_group_multiple_instance_types", + "autoscaling_group_using_ec2_launch_template", + "awslambda_function_inside_vpc", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "awslambda_function_using_supported_runtimes", + "awslambda_function_vpc_multi_az", + "backup_plans_exist", + "backup_recovery_point_encrypted", + "backup_reportplans_exist", + "backup_vaults_encrypted", + "backup_vaults_exist", + "bedrock_agent_guardrail_enabled", + "bedrock_guardrail_prompt_attack_filter_enabled", + "bedrock_guardrail_sensitive_information_filter_enabled", + "bedrock_model_invocation_logging_enabled", + "bedrock_model_invocation_logs_encryption_enabled", + "cloudformation_stack_outputs_find_secrets", + "cloudformation_stacks_termination_protection_enabled", + "cloudfront_distributions_custom_ssl_certificate", + "cloudfront_distributions_default_root_object", + "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_geo_restrictions_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_logging_enabled", + "cloudfront_distributions_multiple_origin_failover_configured", + "cloudfront_distributions_origin_traffic_encrypted", + "cloudfront_distributions_s3_origin_access_control", + "cloudfront_distributions_s3_origin_non_existent_bucket", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudfront_distributions_using_waf", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_kms_encryption_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "codeartifact_packages_external_public_publishing_disabled", + "codebuild_project_logging_enabled", + "codebuild_project_no_secrets_in_variables", + "codebuild_project_older_90_days", + "codebuild_project_s3_logs_encrypted", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "codebuild_project_user_controlled_buildspec", + "codebuild_report_group_export_encrypted", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_deletion_protection_enabled", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_password_policy_lowercase", + "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_number", + "cognito_user_pool_password_policy_symbol", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_self_registration_disabled", + "cognito_user_pool_temporary_password_expiration", + "cognito_user_pool_waf_acl_attached", + "config_recorder_all_regions_enabled", + "config_recorder_using_aws_service_role", + "datasync_task_logging_enabled", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "directoryservice_directory_snapshots_limit", + "directoryservice_ldap_certificate_expiration", + "directoryservice_radius_server_security_protocol", + "directoryservice_supported_mfa_radius_enabled", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", + "dms_instance_minor_version_upgrade_enabled", + "dms_instance_multi_az_enabled", + "dms_instance_no_public_access", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "documentdb_cluster_deletion_protection", + "documentdb_cluster_multi_az_enabled", + "documentdb_cluster_public_snapshot", + "documentdb_cluster_storage_encrypted", + "drs_job_exist", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_accelerator_cluster_in_transit_encryption_enabled", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_cross_account_access", + "dynamodb_table_deletion_protection_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_kms_cmk_encryption_enabled", + "dynamodb_tables_pitr_enabled", + "ec2_ami_public", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_ebs_default_encryption", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_ebs_snapshots_encrypted", + "ec2_ebs_volume_encryption", + "ec2_ebs_volume_protected_by_backup_plan", + "ec2_ebs_volume_snapshots_exists", + "ec2_elastic_ip_shodan", + "ec2_elastic_ip_unassigned", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ec2_instance_imdsv2_enabled", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_managed_by_ssm", + "ec2_instance_older_than_specific_days", + "ec2_instance_paravirtual_type", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_profile_attached", + "ec2_instance_public_ip", + "ec2_instance_secrets_user_data", + "ec2_instance_uses_single_eni", + "ec2_launch_template_no_public_ip", + "ec2_launch_template_no_secrets", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_default_restrict_traffic", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ecr_registry_scan_images_on_push_enabled", + "ecr_repositories_lifecycle_policy_enabled", + "ecr_repositories_not_publicly_accessible", + "ecr_repositories_scan_vulnerabilities_in_latest_image", + "ecr_repositories_tag_immutability", + "ecs_cluster_container_insights_enabled", + "ecs_service_fargate_latest_platform_version", + "ecs_service_no_assign_public_ip", + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_enabled", + "ecs_task_definitions_no_environment_secrets", + "ecs_task_definitions_no_privileged_containers", + "ecs_task_set_no_assign_public_ip", + "efs_access_point_enforce_root_directory", + "efs_access_point_enforce_user_identity", + "efs_encryption_at_rest_enabled", + "efs_have_backup_enabled", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "eks_cluster_network_policy_enabled", + "eks_cluster_not_publicly_accessible", + "eks_cluster_private_nodes_enabled", + "eks_cluster_uses_a_supported_version", + "eks_control_plane_logging_all_types_enabled", + "elasticache_cluster_uses_public_subnet", + "elasticache_redis_cluster_auto_minor_version_upgrades", + "elasticache_redis_cluster_automatic_failover_enabled", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "elasticache_redis_replication_group_auth_enabled", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elasticbeanstalk_environment_managed_updates_enabled", + "elb_connection_draining_enabled", + "elb_cross_zone_load_balancing_enabled", + "elb_desync_mitigation_mode", + "elb_insecure_ssl_ciphers", + "elb_internet_facing", + "elb_is_in_multiple_az", + "elb_logging_enabled", + "elb_ssl_listeners", + "elb_ssl_listeners_use_acm_certificate", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_deletion_protection", + "elbv2_desync_mitigation_mode", + "elbv2_insecure_ssl_ciphers", + "elbv2_internet_facing", + "elbv2_is_in_multiple_az", + "elbv2_listeners_underneath", + "elbv2_logging_enabled", + "elbv2_nlb_tls_termination_enabled", + "elbv2_ssl_listeners", + "elbv2_waf_acl_attached", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_cross_account_access", + "eventbridge_bus_exposed", + "eventbridge_global_endpoint_event_replication_enabled", + "eventbridge_schema_registry_cross_account_access", + "fms_policy_compliant", + "fsx_file_system_copy_tags_to_backups_enabled", + "fsx_file_system_copy_tags_to_volumes_enabled", + "fsx_windows_file_system_multi_az_enabled", + "glacier_vaults_policy_public_access", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_data_catalogs_not_publicly_accessible", + "glue_database_connections_ssl_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_etl_jobs_logging_enabled", + "glue_ml_transform_encrypted_at_rest", + "guardduty_centrally_managed", + "guardduty_ec2_malware_protection_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", + "guardduty_is_enabled", + "guardduty_lambda_protection_enabled", + "guardduty_no_high_severity_findings", + "guardduty_rds_protection_enabled", + "guardduty_s3_protection_enabled", + "iam_administrator_access_with_mfa", + "iam_avoid_root_usage", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_check_saml_providers_sts", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_no_expired_server_certificates_stored", + "iam_no_root_access_key", + "iam_password_policy_expires_passwords_within_90_days_or_less", + "iam_password_policy_lowercase", + "iam_password_policy_minimum_length_14", + "iam_password_policy_number", + "iam_password_policy_reuse_24", + "iam_password_policy_symbol", + "iam_password_policy_uppercase", + "iam_policy_allows_privilege_escalation", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_rotate_access_key_90_days", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_accesskey_unused", + "iam_user_administrator_access_policy", + "iam_user_console_access_unused", + "iam_user_hardware_mfa_enabled", + "iam_user_mfa_enabled_console_access", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "iam_user_with_temporary_credentials", + "inspector2_active_findings_exist", + "inspector2_is_enabled", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_enhanced_monitoring_enabled", + "kafka_cluster_in_transit_encryption_enabled", + "kafka_cluster_is_public", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_unrestricted_access_disabled", + "kafka_cluster_uses_latest_version", + "kafka_connector_in_transit_encryption_enabled", + "kinesis_stream_encrypted_at_rest", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", + "lightsail_database_public", + "lightsail_instance_automated_snapshots", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "macie_automated_sensitive_data_discovery_enabled", + "macie_is_enabled", + "mq_broker_active_deployment_mode", + "mq_broker_auto_minor_version_upgrades", + "mq_broker_cluster_deployment_mode", + "mq_broker_logging_enabled", + "neptune_cluster_backup_enabled", + "neptune_cluster_copy_tags_to_snapshots", + "neptune_cluster_deletion_protection", + "neptune_cluster_iam_authentication_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "neptune_cluster_multi_az", + "neptune_cluster_public_snapshot", + "neptune_cluster_snapshot_encrypted", + "neptune_cluster_storage_encrypted", + "neptune_cluster_uses_public_subnet", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_logging_enabled", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "opensearch_service_domains_encryption_at_rest_enabled", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_node_to_node_encryption_enabled", + "opensearch_service_domains_not_publicly_accessible", + "opensearch_service_domains_updated_to_the_latest_service_software_version", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "organizations_account_part_of_organizations", + "organizations_delegated_administrators", + "organizations_opt_out_ai_services_policy", + "organizations_scp_check_deny_regions", + "organizations_tags_policies_enabled_and_attached", + "rds_cluster_backtrack_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_cluster_critical_event_subscription", + "rds_cluster_default_admin", + "rds_cluster_deletion_protection", + "rds_cluster_iam_authentication_enabled", + "rds_cluster_integration_cloudwatch_logs", + "rds_cluster_minor_version_upgrade_enabled", + "rds_cluster_multi_az", + "rds_cluster_non_default_port", + "rds_cluster_protected_by_backup_plan", + "rds_cluster_storage_encrypted", + "rds_instance_backup_enabled", + "rds_instance_certificate_expiration", + "rds_instance_copy_tags_to_snapshots", + "rds_instance_critical_event_subscription", + "rds_instance_default_admin", + "rds_instance_deletion_protection", + "rds_instance_deprecated_engine_version", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", + "rds_instance_iam_authentication_enabled", + "rds_instance_inside_vpc", + "rds_instance_integration_cloudwatch_logs", + "rds_instance_minor_version_upgrade_enabled", + "rds_instance_multi_az", + "rds_instance_no_public_access", + "rds_instance_non_default_port", + "rds_instance_protected_by_backup_plan", + "rds_instance_storage_encrypted", + "rds_instance_transport_encrypted", + "rds_snapshots_encrypted", + "rds_snapshots_public_access", + "redshift_cluster_audit_logging", + "redshift_cluster_automated_snapshot", + "redshift_cluster_automatic_upgrades", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_in_transit_encryption_enabled", + "redshift_cluster_multi_az_enabled", + "redshift_cluster_non_default_database_name", + "redshift_cluster_non_default_username", + "redshift_cluster_public_access", + "resourceexplorer2_indexes_found", + "route53_dangling_ip_subdomain_takeover", + "route53_domains_privacy_protection_enabled", + "route53_domains_transferlock_enabled", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "s3_access_point_public_access_block", + "s3_account_level_public_access_blocks", + "s3_bucket_acl_prohibited", + "s3_bucket_cross_account_access", + "s3_bucket_cross_region_replication", + "s3_bucket_default_encryption", + "s3_bucket_event_notifications_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_level_public_access_block", + "s3_bucket_lifecycle_enabled", + "s3_bucket_no_mfa_delete", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "s3_bucket_secure_transport_policy", + "s3_bucket_server_access_logging_enabled", + "s3_multi_region_access_point_public_access_block", + "sagemaker_endpoint_config_prod_variant_instances", + "sagemaker_models_network_isolation_enabled", + "sagemaker_models_vpc_settings_configured", + "sagemaker_notebook_instance_encryption_enabled", + "sagemaker_notebook_instance_root_access_disabled", + "sagemaker_notebook_instance_vpc_settings_configured", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sagemaker_training_jobs_vpc_settings_configured", + "secretsmanager_automatic_rotation_enabled", + "secretsmanager_not_publicly_accessible", + "secretsmanager_secret_rotated_periodically", + "secretsmanager_secret_unused", + "securityhub_enabled", + "ses_identity_not_publicly_accessible", + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones", + "sns_subscription_not_using_http_endpoints", + "sns_topics_kms_encryption_at_rest_enabled", + "sns_topics_not_publicly_accessible", + "sqs_queues_not_publicly_accessible", + "sqs_queues_server_side_encryption_enabled", + "ssm_document_secrets", + "ssm_documents_set_as_public", + "ssm_managed_compliant_patching", + "ssmincidents_enabled_with_plans", + "storagegateway_fileshare_encryption_enabled", + "transfer_server_in_transit_encryption_enabled", + "trustedadvisor_errors_and_warnings", + "trustedadvisor_premium_support_plan_subscribed", + "vpc_different_regions", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_endpoint_multi_az_enabled", + "vpc_endpoint_services_allowed_principals_trust_boundaries", + "vpc_flow_logs_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_different_az", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_logging_enabled", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled", + "wafv2_webacl_with_rules", + "wellarchitected_workload_no_high_or_medium_risks", + "workspaces_volume_encryption_enabled", + "workspaces_vpc_2private_1public_subnets_nat" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -2905,82 +3677,39 @@ "Name": "Public Server Security", "Description": "For servers exposed to external networks, protective measures must be established and implemented, including separating them from internal networks, conducting vulnerability assessments, access control, authentication, and establishing procedures for information collection, storage, and disclosure.", "Checks": [ - "ssm_document_secrets", - "ssm_managed_compliant_patching", - "inspector2_active_findings_exist", - "cloudfront_distributions_https_enabled", - "cloudfront_distributions_using_deprecated_ssl_protocols", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_waf_acl_attached", + "cloudfront_distributions_s3_origin_non_existent_bucket", "cloudfront_distributions_using_waf", - "lightsail_instance_public", - "lightsail_database_public", - "lightsail_static_ip_unused", + "cognito_user_pool_waf_acl_attached", + "elb_desync_mitigation_mode", "elb_insecure_ssl_ciphers", + "elb_internet_facing", "elb_ssl_listeners", - "awslambda_function_no_secrets_in_code", - "awslambda_function_no_secrets_in_variables", - "awslambda_function_url_public", - "awslambda_function_url_cors_policy", - "awslambda_function_inside_vpc", - "awslambda_function_not_publicly_accessible", - "networkfirewall_in_all_vpc", - "apigatewayv2_api_authorizers_enabled", - "kafka_cluster_mutual_tls_authentication_enabled", - "vpc_subnet_separate_private_public", - "autoscaling_find_secrets_ec2_launch_configuration", - "elbv2_waf_acl_attached", + "elb_ssl_listeners_use_acm_certificate", "elbv2_desync_mitigation_mode", "elbv2_insecure_ssl_ciphers", + "elbv2_internet_facing", + "elbv2_listeners_underneath", + "elbv2_nlb_tls_termination_enabled", "elbv2_ssl_listeners", - "apigateway_restapi_public", - "apigateway_restapi_waf_acl_attached", - "apigateway_restapi_client_certificate_enabled", - "apigateway_restapi_authorizers_enabled", - "apigateway_restapi_public_with_authorizer", - "acm_certificates_expiration_check", + "elbv2_waf_acl_attached", + "lightsail_database_public", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "route53_dangling_ip_subdomain_takeover", "route53_domains_privacy_protection_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_instance_secrets_user_data", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_networkacl_allow_ingress_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_launch_template_no_secrets", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_instance_imdsv2_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones" ], "Attributes": [ { @@ -3038,25 +3767,7 @@ "Id": "2.10.5", "Name": "Secure Information Transmission", "Description": "When transmitting personal or critical information to other organizations, a secure transmission policy must be established, and agreements must be made between organizations regarding management responsibilities, transmission methods, and technical protection measures for personal and critical information.", - "Checks": [ - "glue_database_connections_ssl_enabled", - "s3_bucket_secure_transport_policy", - "sns_subscription_not_using_http_endpoints", - "cloudfront_distributions_https_enabled", - "cloudfront_distributions_using_deprecated_ssl_protocols", - "opensearch_service_domains_https_communications_enforced", - "opensearch_service_domains_node_to_node_encryption_enabled", - "directoryservice_radius_server_security_protocol", - "elb_insecure_ssl_ciphers", - "elb_ssl_listeners", - "kafka_cluster_mutual_tls_authentication_enabled", - "kafka_cluster_in_transit_encryption_enabled", - "elbv2_insecure_ssl_ciphers", - "elbv2_ssl_listeners", - "elasticache_redis_cluster_in_transit_encryption_enabled", - "rds_instance_transport_encrypted", - "apigateway_restapi_client_certificate_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -3083,14 +3794,7 @@ "Id": "2.10.6", "Name": "Security for Business Devices", "Description": "When connecting devices such as PCs and mobile devices to the network for business purposes, access control measures such as device authentication, approval, access scope, and security settings must be established and periodically checked.", - "Checks": [ - "workspaces_vpc_2private_1public_subnets_nat", - "workspaces_volume_encryption_enabled", - "appstream_fleet_maximum_session_duration", - "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", - "appstream_fleet_session_disconnect_timeout" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -3162,20 +3866,20 @@ "Name": "Patch Management", "Description": "To prevent security incidents due to vulnerabilities in software, operating systems, or security systems, the latest patches must be applied. However, if the application of the latest patches is difficult due to service impact considerations, alternative measures must be implemented.", "Checks": [ - "ssm_managed_compliant_patching", - "cloudfront_distributions_using_deprecated_ssl_protocols", - "opensearch_service_domains_updated_to_the_latest_service_software_version", - "redshift_cluster_automatic_upgrades", "awslambda_function_using_supported_runtimes", - "eks_cluster_uses_a_supported_version", - "kafka_cluster_uses_latest_version", "dms_instance_minor_version_upgrade_enabled", + "ecs_service_fargate_latest_platform_version", + "eks_cluster_uses_a_supported_version", "elasticache_redis_cluster_auto_minor_version_upgrades", - "rds_instance_deprecated_engine_version", + "elasticbeanstalk_environment_managed_updates_enabled", + "kafka_cluster_uses_latest_version", + "mq_broker_auto_minor_version_upgrades", + "opensearch_service_domains_updated_to_the_latest_service_software_version", "rds_cluster_minor_version_upgrade_enabled", + "rds_instance_deprecated_engine_version", "rds_instance_minor_version_upgrade_enabled", - "ec2_instance_account_imdsv2_enabled", - "ec2_instance_older_than_specific_days" + "redshift_cluster_automatic_upgrades", + "ssm_managed_compliant_patching" ], "Attributes": [ { @@ -3210,7 +3914,9 @@ "Id": "2.10.9", "Name": "Malware Control", "Description": "To protect personal and important information, information systems, and business terminals from malware such as viruses, worms, Trojans, and ransomware, prevention, detection, and response measures must be established and implemented.", - "Checks": [], + "Checks": [ + "guardduty_ec2_malware_protection_enabled" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -3245,7 +3951,16 @@ "Id": "2.11.1", "Name": "Establishment of Incident Prevention and Response System", "Description": "To prevent incidents such as security breaches and personal information leaks, and to respond quickly and effectively in the event of an incident, the organization must establish procedures for detecting, responding to, analyzing, and sharing internal and external intrusion attempts. In addition, the organization must establish a cooperative system with relevant external institutions and experts.", - "Checks": [], + "Checks": [ + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "acm_certificates_with_secure_key_algorithms", + "guardduty_centrally_managed", + "iam_support_role_created", + "ssmincidents_enabled_with_plans" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -3281,29 +3996,557 @@ "Name": "Vulnerability Inspection and Remediation", "Description": "Regular vulnerability inspections must be conducted to verify whether information systems have exposed vulnerabilities, and any identified vulnerabilities must be promptly addressed. In addition, the organization must continuously monitor for new security vulnerabilities, assess their impact on the information systems, and take necessary actions.", "Checks": [ - "codebuild_project_no_secrets_in_variables", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "ssm_document_secrets", - "cloudwatch_log_group_no_secrets_in_logs", - "inspector2_is_enabled", - "inspector2_active_findings_exist", - "ecr_registry_scan_images_on_push_enabled", - "ecr_repositories_scan_images_on_push_enabled", - "ecr_repositories_scan_vulnerabilities_in_latest_image", - "ecs_task_definitions_no_environment_secrets", + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_cache_encrypted", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_logging_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_tracing_enabled", + "apigateway_restapi_waf_acl_attached", + "apigatewayv2_api_access_logging_enabled", + "apigatewayv2_api_authorizers_enabled", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "athena_workgroup_encryption", + "athena_workgroup_enforce_configuration", + "athena_workgroup_logging_enabled", + "autoscaling_group_capacity_rebalance_enabled", + "autoscaling_group_elb_health_check_enabled", + "autoscaling_group_launch_configuration_no_public_ip", + "autoscaling_group_launch_configuration_requires_imdsv2", + "autoscaling_group_multiple_az", + "autoscaling_group_multiple_instance_types", + "autoscaling_group_using_ec2_launch_template", + "awslambda_function_inside_vpc", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", "awslambda_function_no_secrets_in_code", "awslambda_function_no_secrets_in_variables", - "autoscaling_find_secrets_ec2_launch_configuration", - "guardduty_no_high_severity_findings", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "trustedadvisor_premium_support_plan_subscribed", - "trustedadvisor_errors_and_warnings", - "securityhub_enabled", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "awslambda_function_using_supported_runtimes", + "awslambda_function_vpc_multi_az", + "backup_plans_exist", + "backup_recovery_point_encrypted", + "backup_reportplans_exist", + "backup_vaults_encrypted", + "backup_vaults_exist", + "bedrock_agent_guardrail_enabled", + "bedrock_guardrail_prompt_attack_filter_enabled", + "bedrock_guardrail_sensitive_information_filter_enabled", + "bedrock_model_invocation_logging_enabled", + "bedrock_model_invocation_logs_encryption_enabled", "cloudformation_stack_outputs_find_secrets", + "cloudformation_stacks_termination_protection_enabled", + "cloudfront_distributions_custom_ssl_certificate", + "cloudfront_distributions_default_root_object", + "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_geo_restrictions_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_logging_enabled", + "cloudfront_distributions_multiple_origin_failover_configured", + "cloudfront_distributions_origin_traffic_encrypted", + "cloudfront_distributions_s3_origin_access_control", + "cloudfront_distributions_s3_origin_non_existent_bucket", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudfront_distributions_using_waf", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_kms_encryption_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "codeartifact_packages_external_public_publishing_disabled", + "codebuild_project_logging_enabled", + "codebuild_project_no_secrets_in_variables", + "codebuild_project_older_90_days", + "codebuild_project_s3_logs_encrypted", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "codebuild_project_user_controlled_buildspec", + "codebuild_report_group_export_encrypted", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_deletion_protection_enabled", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_password_policy_lowercase", + "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_number", + "cognito_user_pool_password_policy_symbol", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_self_registration_disabled", + "cognito_user_pool_temporary_password_expiration", + "cognito_user_pool_waf_acl_attached", + "config_recorder_all_regions_enabled", + "config_recorder_using_aws_service_role", + "datasync_task_logging_enabled", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "directoryservice_directory_snapshots_limit", + "directoryservice_ldap_certificate_expiration", + "directoryservice_radius_server_security_protocol", + "directoryservice_supported_mfa_radius_enabled", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", + "dms_instance_minor_version_upgrade_enabled", + "dms_instance_multi_az_enabled", + "dms_instance_no_public_access", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "documentdb_cluster_deletion_protection", + "documentdb_cluster_multi_az_enabled", + "documentdb_cluster_public_snapshot", + "documentdb_cluster_storage_encrypted", + "drs_job_exist", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_accelerator_cluster_in_transit_encryption_enabled", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_cross_account_access", + "dynamodb_table_deletion_protection_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_kms_cmk_encryption_enabled", + "dynamodb_tables_pitr_enabled", + "ec2_ami_public", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_ebs_default_encryption", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_ebs_snapshots_encrypted", + "ec2_ebs_volume_encryption", + "ec2_ebs_volume_protected_by_backup_plan", + "ec2_ebs_volume_snapshots_exists", + "ec2_elastic_ip_shodan", + "ec2_elastic_ip_unassigned", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ec2_instance_imdsv2_enabled", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_managed_by_ssm", + "ec2_instance_older_than_specific_days", + "ec2_instance_paravirtual_type", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_profile_attached", + "ec2_instance_public_ip", "ec2_instance_secrets_user_data", + "ec2_instance_uses_single_eni", + "ec2_launch_template_no_public_ip", "ec2_launch_template_no_secrets", - "ec2_instance_imdsv2_enabled" + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_default_restrict_traffic", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ecr_registry_scan_images_on_push_enabled", + "ecr_repositories_lifecycle_policy_enabled", + "ecr_repositories_not_publicly_accessible", + "ecr_repositories_scan_vulnerabilities_in_latest_image", + "ecr_repositories_tag_immutability", + "ecs_cluster_container_insights_enabled", + "ecs_service_fargate_latest_platform_version", + "ecs_service_no_assign_public_ip", + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_enabled", + "ecs_task_definitions_no_environment_secrets", + "ecs_task_definitions_no_privileged_containers", + "ecs_task_set_no_assign_public_ip", + "efs_access_point_enforce_root_directory", + "efs_access_point_enforce_user_identity", + "efs_encryption_at_rest_enabled", + "efs_have_backup_enabled", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "eks_cluster_network_policy_enabled", + "eks_cluster_not_publicly_accessible", + "eks_cluster_private_nodes_enabled", + "eks_cluster_uses_a_supported_version", + "eks_control_plane_logging_all_types_enabled", + "elasticache_cluster_uses_public_subnet", + "elasticache_redis_cluster_auto_minor_version_upgrades", + "elasticache_redis_cluster_automatic_failover_enabled", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "elasticache_redis_replication_group_auth_enabled", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elasticbeanstalk_environment_managed_updates_enabled", + "elb_connection_draining_enabled", + "elb_cross_zone_load_balancing_enabled", + "elb_desync_mitigation_mode", + "elb_insecure_ssl_ciphers", + "elb_internet_facing", + "elb_is_in_multiple_az", + "elb_logging_enabled", + "elb_ssl_listeners", + "elb_ssl_listeners_use_acm_certificate", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_deletion_protection", + "elbv2_desync_mitigation_mode", + "elbv2_insecure_ssl_ciphers", + "elbv2_internet_facing", + "elbv2_is_in_multiple_az", + "elbv2_listeners_underneath", + "elbv2_logging_enabled", + "elbv2_nlb_tls_termination_enabled", + "elbv2_ssl_listeners", + "elbv2_waf_acl_attached", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_cross_account_access", + "eventbridge_bus_exposed", + "eventbridge_global_endpoint_event_replication_enabled", + "eventbridge_schema_registry_cross_account_access", + "fms_policy_compliant", + "fsx_file_system_copy_tags_to_backups_enabled", + "fsx_file_system_copy_tags_to_volumes_enabled", + "fsx_windows_file_system_multi_az_enabled", + "glacier_vaults_policy_public_access", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_data_catalogs_not_publicly_accessible", + "glue_database_connections_ssl_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_etl_jobs_logging_enabled", + "glue_ml_transform_encrypted_at_rest", + "guardduty_centrally_managed", + "guardduty_ec2_malware_protection_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", + "guardduty_is_enabled", + "guardduty_lambda_protection_enabled", + "guardduty_no_high_severity_findings", + "guardduty_rds_protection_enabled", + "guardduty_s3_protection_enabled", + "iam_administrator_access_with_mfa", + "iam_avoid_root_usage", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_check_saml_providers_sts", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_no_expired_server_certificates_stored", + "iam_no_root_access_key", + "iam_password_policy_expires_passwords_within_90_days_or_less", + "iam_password_policy_lowercase", + "iam_password_policy_minimum_length_14", + "iam_password_policy_number", + "iam_password_policy_reuse_24", + "iam_password_policy_symbol", + "iam_password_policy_uppercase", + "iam_policy_allows_privilege_escalation", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_rotate_access_key_90_days", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_accesskey_unused", + "iam_user_administrator_access_policy", + "iam_user_console_access_unused", + "iam_user_hardware_mfa_enabled", + "iam_user_mfa_enabled_console_access", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "iam_user_with_temporary_credentials", + "inspector2_active_findings_exist", + "inspector2_is_enabled", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_enhanced_monitoring_enabled", + "kafka_cluster_in_transit_encryption_enabled", + "kafka_cluster_is_public", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_unrestricted_access_disabled", + "kafka_cluster_uses_latest_version", + "kafka_connector_in_transit_encryption_enabled", + "kinesis_stream_encrypted_at_rest", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", + "lightsail_database_public", + "lightsail_instance_automated_snapshots", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "macie_automated_sensitive_data_discovery_enabled", + "macie_is_enabled", + "mq_broker_active_deployment_mode", + "mq_broker_auto_minor_version_upgrades", + "mq_broker_cluster_deployment_mode", + "mq_broker_logging_enabled", + "neptune_cluster_backup_enabled", + "neptune_cluster_copy_tags_to_snapshots", + "neptune_cluster_deletion_protection", + "neptune_cluster_iam_authentication_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "neptune_cluster_multi_az", + "neptune_cluster_public_snapshot", + "neptune_cluster_snapshot_encrypted", + "neptune_cluster_storage_encrypted", + "neptune_cluster_uses_public_subnet", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_logging_enabled", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "opensearch_service_domains_encryption_at_rest_enabled", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_node_to_node_encryption_enabled", + "opensearch_service_domains_not_publicly_accessible", + "opensearch_service_domains_updated_to_the_latest_service_software_version", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "organizations_account_part_of_organizations", + "organizations_delegated_administrators", + "organizations_opt_out_ai_services_policy", + "organizations_scp_check_deny_regions", + "organizations_tags_policies_enabled_and_attached", + "rds_cluster_backtrack_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_cluster_critical_event_subscription", + "rds_cluster_default_admin", + "rds_cluster_deletion_protection", + "rds_cluster_iam_authentication_enabled", + "rds_cluster_integration_cloudwatch_logs", + "rds_cluster_minor_version_upgrade_enabled", + "rds_cluster_multi_az", + "rds_cluster_non_default_port", + "rds_cluster_protected_by_backup_plan", + "rds_cluster_storage_encrypted", + "rds_instance_backup_enabled", + "rds_instance_certificate_expiration", + "rds_instance_copy_tags_to_snapshots", + "rds_instance_critical_event_subscription", + "rds_instance_default_admin", + "rds_instance_deletion_protection", + "rds_instance_deprecated_engine_version", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", + "rds_instance_iam_authentication_enabled", + "rds_instance_inside_vpc", + "rds_instance_integration_cloudwatch_logs", + "rds_instance_minor_version_upgrade_enabled", + "rds_instance_multi_az", + "rds_instance_no_public_access", + "rds_instance_non_default_port", + "rds_instance_protected_by_backup_plan", + "rds_instance_storage_encrypted", + "rds_instance_transport_encrypted", + "rds_snapshots_encrypted", + "rds_snapshots_public_access", + "redshift_cluster_audit_logging", + "redshift_cluster_automated_snapshot", + "redshift_cluster_automatic_upgrades", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_in_transit_encryption_enabled", + "redshift_cluster_multi_az_enabled", + "redshift_cluster_non_default_database_name", + "redshift_cluster_non_default_username", + "redshift_cluster_public_access", + "resourceexplorer2_indexes_found", + "route53_dangling_ip_subdomain_takeover", + "route53_domains_privacy_protection_enabled", + "route53_domains_transferlock_enabled", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "s3_access_point_public_access_block", + "s3_account_level_public_access_blocks", + "s3_bucket_acl_prohibited", + "s3_bucket_cross_account_access", + "s3_bucket_cross_region_replication", + "s3_bucket_default_encryption", + "s3_bucket_event_notifications_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_level_public_access_block", + "s3_bucket_lifecycle_enabled", + "s3_bucket_no_mfa_delete", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "s3_bucket_secure_transport_policy", + "s3_bucket_server_access_logging_enabled", + "s3_multi_region_access_point_public_access_block", + "sagemaker_endpoint_config_prod_variant_instances", + "sagemaker_models_network_isolation_enabled", + "sagemaker_models_vpc_settings_configured", + "sagemaker_notebook_instance_encryption_enabled", + "sagemaker_notebook_instance_root_access_disabled", + "sagemaker_notebook_instance_vpc_settings_configured", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sagemaker_training_jobs_vpc_settings_configured", + "secretsmanager_automatic_rotation_enabled", + "secretsmanager_not_publicly_accessible", + "secretsmanager_secret_rotated_periodically", + "secretsmanager_secret_unused", + "securityhub_enabled", + "ses_identity_not_publicly_accessible", + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones", + "sns_subscription_not_using_http_endpoints", + "sns_topics_kms_encryption_at_rest_enabled", + "sns_topics_not_publicly_accessible", + "sqs_queues_not_publicly_accessible", + "sqs_queues_server_side_encryption_enabled", + "ssm_document_secrets", + "ssm_documents_set_as_public", + "ssm_managed_compliant_patching", + "ssmincidents_enabled_with_plans", + "storagegateway_fileshare_encryption_enabled", + "transfer_server_in_transit_encryption_enabled", + "trustedadvisor_errors_and_warnings", + "trustedadvisor_premium_support_plan_subscribed", + "vpc_different_regions", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_endpoint_multi_az_enabled", + "vpc_endpoint_services_allowed_principals_trust_boundaries", + "vpc_flow_logs_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_different_az", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_logging_enabled", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled", + "wafv2_webacl_with_rules", + "wellarchitected_workload_no_high_or_medium_risks", + "workspaces_volume_encryption_enabled", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { @@ -3340,34 +4583,82 @@ "Name": "Abnormal Behavior Analysis and Monitoring", "Description": "To quickly detect and respond to intrusion attempts, personal information leakage attempts, and fraudulent activities from internal or external sources, the organization must collect and analyze network and data flows. Post-monitoring and inspection actions must be timely.", "Checks": [ - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", + "apigateway_restapi_logging_enabled", + "apigateway_restapi_public", + "apigateway_restapi_tracing_enabled", + "apigatewayv2_api_access_logging_enabled", + "athena_workgroup_logging_enabled", + "bedrock_model_invocation_logging_enabled", + "cloudfront_distributions_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_network_route_tables_alarm_configured", "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", "cloudwatch_log_metric_filter_aws_organizations_changes", "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "cognito_user_pool_client_prevent_user_existence_errors", - "fms_policy_compliant", - "cloudtrail_insights_exist", - "cloudtrail_threat_detection_enumeration", - "networkfirewall_in_all_vpc", - "vpc_flow_logs_enabled", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "codebuild_project_logging_enabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "config_recorder_all_regions_enabled", + "datasync_task_logging_enabled", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "documentdb_cluster_cloudwatch_log_export", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_elastic_ip_shodan", + "ec2_instance_detailed_monitoring_enabled", + "ecs_cluster_container_insights_enabled", + "ecs_task_definitions_logging_enabled", + "eks_control_plane_logging_all_types_enabled", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elb_logging_enabled", + "elbv2_logging_enabled", + "glue_etl_jobs_logging_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", "guardduty_no_high_severity_findings", + "kafka_cluster_enhanced_monitoring_enabled", + "mq_broker_logging_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "networkfirewall_logging_enabled", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "rds_cluster_critical_event_subscription", + "rds_cluster_integration_cloudwatch_logs", + "rds_instance_critical_event_subscription", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", + "rds_instance_integration_cloudwatch_logs", + "redshift_cluster_audit_logging", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "s3_bucket_event_notifications_enabled", + "s3_bucket_server_access_logging_enabled", "trustedadvisor_errors_and_warnings", - "securityhub_enabled" + "vpc_flow_logs_enabled", + "waf_global_webacl_logging_enabled", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled" ], "Attributes": [ { @@ -3398,9 +4689,7 @@ "Id": "2.11.4", "Name": "Incident Response Training and Improvement", "Description": "The organization must conduct at least one simulation training per year based on scenarios to ensure that employees and stakeholders are familiar with the procedures for responding to security incidents and personal information leakage incidents. The response system must be improved based on the training results.", - "Checks": [ - "ssmincidents_enabled_with_plans" - ], + "Checks": [], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -3428,7 +4717,11 @@ "Id": "2.11.5", "Name": "Incident Response and Recovery", "Description": "When signs of or actual incidents of security breaches or personal information leakage are detected, the organization must comply with legal notification and reporting obligations, respond and recover promptly according to established procedures, and analyze the incident to establish preventive measures to reflect in the response system.", - "Checks": [], + "Checks": [ + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" + ], "Attributes": [ { "Domain": "2. Control Measures Requirements", @@ -3465,39 +4758,62 @@ "Name": "Safety Measures for Disaster Preparedness", "Description": "Identify types of disasters that could threaten the operational continuity of the organization's core services and systems, such as natural disasters, communication or power failures, and hacking. Analyze the expected scale of damage and impact for each type, define the recovery time objective (RTO) and recovery point objective (RPO), and establish a disaster recovery system including recovery strategies, emergency recovery teams, emergency contact networks, and recovery procedures.", "Checks": [ - "kms_cmk_not_deleted_unintentionally", - "s3_bucket_lifecycle_enabled", - "s3_bucket_object_versioning", - "s3_bucket_cross_region_replication", - "s3_bucket_object_lock", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_cloudwatch_log_export", - "lightsail_instance_automated_snapshots", - "neptune_cluster_multi_az", - "neptune_cluster_deletion_protection", - "dynamodb_tables_pitr_enabled", - "elb_is_in_multiple_az", - "elb_cross_zone_load_balancing_enabled", - "redshift_cluster_automated_snapshot", - "drs_job_exist", - "dlm_ebs_snapshot_lifecycle_policy_exists", - "vpc_subnet_different_az", - "vpc_different_regions", - "dms_instance_multi_az_enabled", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "autoscaling_group_capacity_rebalance_enabled", "autoscaling_group_multiple_az", - "elbv2_is_in_multiple_az", - "elbv2_deletion_protection", - "backup_reportplans_exist", + "autoscaling_group_multiple_instance_types", + "awslambda_function_vpc_multi_az", "backup_plans_exist", + "cloudfront_distributions_multiple_origin_failover_configured", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "directoryservice_directory_snapshots_limit", + "dms_instance_multi_az_enabled", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_multi_az_enabled", + "drs_job_exist", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_pitr_enabled", + "ec2_ebs_volume_protected_by_backup_plan", + "ec2_ebs_volume_snapshots_exists", + "efs_have_backup_enabled", + "elasticache_redis_cluster_automatic_failover_enabled", "elasticache_redis_cluster_backup_enabled", "elasticache_redis_cluster_multi_az_enabled", - "rds_instance_multi_az", - "rds_instance_deletion_protection", - "rds_cluster_deletion_protection", + "elb_cross_zone_load_balancing_enabled", + "elb_is_in_multiple_az", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_is_in_multiple_az", + "eventbridge_global_endpoint_event_replication_enabled", + "fsx_file_system_copy_tags_to_backups_enabled", + "fsx_windows_file_system_multi_az_enabled", + "lightsail_instance_automated_snapshots", + "mq_broker_active_deployment_mode", + "mq_broker_cluster_deployment_mode", + "neptune_cluster_backup_enabled", + "neptune_cluster_multi_az", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", + "rds_cluster_backtrack_enabled", "rds_cluster_multi_az", + "rds_cluster_protected_by_backup_plan", "rds_instance_backup_enabled", - "efs_have_backup_enabled", - "ec2_ebs_volume_snapshots_exists" + "rds_instance_multi_az", + "rds_instance_protected_by_backup_plan", + "redshift_cluster_automated_snapshot", + "redshift_cluster_multi_az_enabled", + "s3_bucket_cross_region_replication", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "sagemaker_endpoint_config_prod_variant_instances", + "vpc_different_regions", + "vpc_endpoint_multi_az_enabled", + "vpc_subnet_different_az" ], "Attributes": [ { @@ -3534,39 +4850,7 @@ "Name": "Disaster Recovery Testing and Improvement", "Description": "Regularly test the adequacy of the disaster recovery strategies and plans, and supplement the recovery strategies and plans based on test results, changes in the information system environment, and legal requirements.", "Checks": [ - "kms_cmk_not_deleted_unintentionally", - "s3_bucket_lifecycle_enabled", - "s3_bucket_object_versioning", - "s3_bucket_cross_region_replication", - "s3_bucket_object_lock", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_cloudwatch_log_export", - "lightsail_instance_automated_snapshots", - "neptune_cluster_multi_az", - "neptune_cluster_deletion_protection", - "dynamodb_tables_pitr_enabled", - "elb_is_in_multiple_az", - "elb_cross_zone_load_balancing_enabled", - "redshift_cluster_automated_snapshot", - "drs_job_exist", - "dlm_ebs_snapshot_lifecycle_policy_exists", - "vpc_subnet_different_az", - "vpc_different_regions", - "dms_instance_multi_az_enabled", - "autoscaling_group_multiple_az", - "elbv2_is_in_multiple_az", - "elbv2_deletion_protection", - "backup_reportplans_exist", - "backup_plans_exist", - "elasticache_redis_cluster_backup_enabled", - "elasticache_redis_cluster_multi_az_enabled", - "rds_instance_multi_az", - "rds_instance_deletion_protection", - "rds_cluster_deletion_protection", - "rds_cluster_multi_az", - "rds_instance_backup_enabled", - "efs_have_backup_enabled", - "ec2_ebs_volume_snapshots_exists" + "drs_job_exist" ], "Attributes": [ { @@ -3625,7 +4909,7 @@ ], "NonComplianceCases": [ "Case 1: A personal information processor subject to the Personal Information Protection Act failed to include the 'right to refuse consent and the consequences of refusal' in the notifications when obtaining consent to collect personal information.", - "Case 2: During the process of obtaining consent for the collection of personal information, the items of personal information to be collected were not specified in detail, and were instead described in general terms like 'etc.'", + "Case 2: During the process of obtaining consent for the collection of personal information, the items of personal information to be collected were not specified in detail, and were instead described in general terms like 'etc.'.", "Case 3: On a shopping mall website, personal information necessary for membership registration was collected alongside payment and delivery information required for future purchases, even though such information was not necessary at the time of registration.", "Case 4: Personal information (e.g., name, email, phone number) was collected through Q&A boards without obtaining the data subject's consent.", "Case 5: Personal information of children under the age of 14 was collected without obtaining the consent of their legal guardians.", @@ -3854,10 +5138,7 @@ "Id": "3.2.1", "Name": "Management of Personal Information Status", "Description": "The items, volume, purpose and method of processing, and retention period of collected and retained personal information must be regularly managed. In the case of public institutions, such information must be registered with the head of the relevant agency as stipulated by law.", - "Checks": [ - "s3_bucket_lifecycle_enabled", - "macie_is_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "3. Requirements for Each Stage of Personal Information Processing", @@ -4113,7 +5394,7 @@ "When receiving personal information, does the recipient notify the data subjects without delay regarding the fact that personal information has been received and other necessary matters, if legally required?", "Does the recipient of the personal information use the information only for its original purpose at the time of transfer, or provide it to third parties in compliance with the original purpose?" ], - "RelatedRegulations": [ + "RelatedRegulations": [ "Personal Information Protection Act, Article 27 (Restrictions on the Transfer of Personal Information Due to Business Transfers)" ], "AuditEvidence": [ @@ -4131,9 +5412,7 @@ "Id": "3.3.4", "Name": "Transfer of Personal Information Abroad", "Description": "When transferring personal information abroad, appropriate protective measures such as obtaining consent and disclosing relevant details about the transfer must be established and implemented.", - "Checks": [ - "s3_bucket_cross_region_replication" - ], + "Checks": [], "Attributes": [ { "Domain": "3. Requirements for Each Stage of Personal Information Processing", @@ -4217,7 +5496,7 @@ "Personal Information Protection Act, Article 21 (Destruction of Personal Information)" ], "AuditEvidence": [ - "Regulations regarding the retention period and destruction of personal information", + "Regulations regarding the retention period and destruction of personal information',", "Current status of separated databases (table structure, etc.)", "Access permissions for separated databases" ], diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json index e8999d02d6..91b37cbc41 100644 --- a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json +++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json @@ -12,7 +12,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Subdomain": "1.1 ๊ด€๋ฆฌ์ฒด๊ณ„", "Section": "1.1.1 ๊ฒฝ์˜์ง„์˜ ์ฐธ์—ฌ", "AuditChecklist": [ "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„์˜ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜ํ™œ๋™ ์ „๋ฐ˜์— ๊ฒฝ์˜์ง„์˜ ์ฐธ์—ฌ๊ฐ€ ์ด๋ฃจ์–ด์งˆ ์ˆ˜ ์žˆ๋„๋ก ๋ณด๊ณ  ๋ฐ ์˜์‚ฌ๊ฒฐ์ • ๋“ฑ์˜ ์ฑ…์ž„๊ณผ ์—ญํ• ์„ ๋ฌธ์„œํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -41,7 +41,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Subdomain": "1.1 ๊ด€๋ฆฌ์ฒด๊ณ„", "Section": "1.1.2 ์ตœ๊ณ ์ฑ…์ž„์ž์˜ ์ง€์ •", "AuditChecklist": [ "์ตœ๊ณ ๊ฒฝ์˜์ž๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฒ˜๋ฆฌ์— ๊ด€ํ•œ ์—…๋ฌด๋ฅผ ์ด๊ด„ํ•˜์—ฌ ์ฑ…์ž„์งˆ ์ตœ๊ณ ์ฑ…์ž„์ž๋ฅผ ๊ณต์‹์ ์œผ๋กœ ์ง€์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -77,7 +77,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Subdomain": "1.1 ๊ด€๋ฆฌ์ฒด๊ณ„", "Section": "1.1.3 ์กฐ์ง ๊ตฌ์„ฑ", "AuditChecklist": [ "์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์—…๋ฌด๋ฅผ ์ง€์›ํ•˜๊ณ  ์กฐ์ง์˜ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์„ ์ฒด๊ณ„์ ์œผ๋กœ ์ดํ–‰ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ „๋ฌธ์„ฑ์„ ๊ฐ–์ถ˜ ์‹ค๋ฌด์กฐ์ง์„ ๊ตฌ์„ฑํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -112,7 +112,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Subdomain": "1.1 ๊ด€๋ฆฌ์ฒด๊ณ„", "Section": "1.1.4 ๋ฒ”์œ„ ์„ค์ •", "AuditChecklist": [ "์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์— ์˜ํ–ฅ์„ ์ค„ ์ˆ˜ ์žˆ๋Š” ํ•ต์‹ฌ์ž์‚ฐ์„ ํฌํ•จํ•˜๋„๋ก ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„๋ฅผ ์„ค์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -121,7 +121,6 @@ ], "RelatedRegulations": [], "AuditEvidence": [ - "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ์ •์˜์„œ", "์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ชฉ๋ก", "๋ฌธ์„œ ๋ชฉ๋ก", "์„œ๋น„์Šค ํ๋ฆ„๋„", @@ -145,7 +144,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Subdomain": "1.1 ๊ด€๋ฆฌ์ฒด๊ณ„", "Section": "1.1.5 ์ •์ฑ… ์ˆ˜๋ฆฝ", "AuditChecklist": [ "์กฐ์ง์ด ์ˆ˜ํ–‰ํ•˜๋Š” ๋ชจ๋“  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์˜ ๊ทผ๊ฑฐ๋ฅผ ํฌํ•จํ•˜๋Š” ์ตœ์ƒ์œ„ ์ˆ˜์ค€์˜ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -180,7 +179,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Subdomain": "1.1 ๊ด€๋ฆฌ์ฒด๊ณ„", "Section": "1.1.6 ์ž์› ํ• ๋‹น", "AuditChecklist": [ "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ถ„์•ผ๋ณ„ ์ „๋ฌธ์„ฑ์„ ๊ฐ–์ถ˜ ์ธ๋ ฅ์„ ํ™•๋ณดํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -207,16 +206,14 @@ "Name": "์ •๋ณด์ž์‚ฐ ์‹๋ณ„", "Description": "์กฐ์ง์˜ ์—…๋ฌดํŠน์„ฑ์— ๋”ฐ๋ผ ์ •๋ณด์ž์‚ฐ ๋ถ„๋ฅ˜๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด ๋ชจ๋“  ์ •๋ณด์ž์‚ฐ์„ ์‹๋ณ„ยท๋ถ„๋ฅ˜ํ•˜๊ณ , ์ค‘์š”๋„๋ฅผ ์‚ฐ์ •ํ•œ ํ›„ ๊ทธ ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "organizations_tags_policies_enabled_and_attached", - "organizations_account_part_of_organizations", - "macie_is_enabled", - "config_recorder_all_regions_enabled", - "resourceexplorer2_indexes_found" + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" ], "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Subdomain": "1.2 ์œ„ํ—˜ ๊ด€๋ฆฌ", "Section": "1.2.1 ์ •๋ณด์ž์‚ฐ ์‹๋ณ„", "AuditChecklist": [ "์ •๋ณด์ž์‚ฐ์˜ ๋ถ„๋ฅ˜๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด์˜ ๋ชจ๋“  ์ž์‚ฐ์„ ์‹๋ณ„ํ•˜์—ฌ ๋ชฉ๋ก์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -249,7 +246,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Subdomain": "1.2 ์œ„ํ—˜ ๊ด€๋ฆฌ", "Section": "1.2.2 ํ˜„ํ™ฉ ๋ฐ ํ๋ฆ„๋ถ„์„", "AuditChecklist": [ "๊ด€๋ฆฌ์ฒด๊ณ„ ์ „ ์˜์—ญ์— ๋Œ€ํ•œ ์ •๋ณด์„œ๋น„์Šค ํ˜„ํ™ฉ์„ ์‹๋ณ„ํ•˜๊ณ  ์—…๋ฌด ์ ˆ์ฐจ์™€ ํ๋ฆ„์„ ํŒŒ์•…ํ•˜์—ฌ ๋ฌธ์„œํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -279,7 +276,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Subdomain": "1.2 ์œ„ํ—˜ ๊ด€๋ฆฌ", "Section": "1.2.3 ์œ„ํ—˜ ํ‰๊ฐ€", "AuditChecklist": [ "์กฐ์ง ๋˜๋Š” ์„œ๋น„์Šค์˜ ํŠน์„ฑ์— ๋”ฐ๋ผ ๋‹ค์–‘ํ•œ ์ธก๋ฉด์—์„œ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ๋Š” ์œ„ํ—˜์„ ์‹๋ณ„ํ•˜๊ณ  ํ‰๊ฐ€ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -322,7 +319,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Subdomain": "1.2 ์œ„ํ—˜ ๊ด€๋ฆฌ", "Section": "1.2.4 ๋ณดํ˜ธ๋Œ€์ฑ… ์„ ์ •", "AuditChecklist": [ "์‹๋ณ„๋œ ์œ„ํ—˜์— ๋Œ€ํ•œ ์ฒ˜๋ฆฌ ์ „๋žต(๊ฐ์†Œ, ํšŒํ”ผ, ์ „๊ฐ€, ์ˆ˜์šฉ ๋“ฑ)์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์œ„ํ—˜์ฒ˜๋ฆฌ๋ฅผ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์„ ์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -352,7 +349,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.3. ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", + "Subdomain": "1.3 ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", "Section": "1.3.1 ๋ณดํ˜ธ๋Œ€์ฑ… ๊ตฌํ˜„", "AuditChecklist": [ "์ดํ–‰๊ณ„ํš์— ๋”ฐ๋ผ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ํšจ๊ณผ์ ์œผ๋กœ ๊ตฌํ˜„ํ•˜๊ณ  ์ดํ–‰๊ฒฐ๊ณผ์˜ ์ •ํ™•์„ฑ ๋ฐ ํšจ๊ณผ์„ฑ ์—ฌ๋ถ€๋ฅผ ๊ฒฝ์˜์ง„์ด ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ณด๊ณ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -384,7 +381,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.3. ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", + "Subdomain": "1.3 ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", "Section": "1.3.2 ๋ณดํ˜ธ๋Œ€์ฑ… ๊ณต์œ ", "AuditChecklist": [ "๊ตฌํ˜„๋œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์šด์˜ ๋˜๋Š” ์‹œํ–‰ํ•  ๋ถ€์„œ ๋ฐ ๋‹ด๋‹น์ž๋ฅผ ๋ช…ํ™•ํ•˜๊ฒŒ ํŒŒ์•…ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -405,11 +402,14 @@ "Id": "1.3.3", "Name": "์šด์˜ํ˜„ํ™ฉ ๊ด€๋ฆฌ", "Description": "์กฐ์ง์ด ์ˆ˜๋ฆฝํ•œ ๊ด€๋ฆฌ์ฒด๊ณ„์— ๋”ฐ๋ผ ์ƒ์‹œ์  ๋˜๋Š” ์ฃผ๊ธฐ์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•˜๋Š” ์šด์˜ํ™œ๋™ ๋ฐ ์ˆ˜ํ–‰ ๋‚ด์—ญ์€ ์‹๋ณ„ ๋ฐ ์ถ”์ ์ด ๊ฐ€๋Šฅํ•˜๋„๋ก ๊ธฐ๋กํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๊ณ , ๊ฒฝ์˜์ง„์€ ์ฃผ๊ธฐ์ ์œผ๋กœ ์šด์˜ํ™œ๋™์˜ ํšจ๊ณผ์„ฑ์„ ํ™•์ธํ•˜์—ฌ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "cloudwatch_log_metric_filter_aws_organizations_changes", + "codebuild_project_older_90_days" + ], "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.3. ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", + "Subdomain": "1.3 ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", "Section": "1.3.3 ์šด์˜ํ˜„ํ™ฉ ๊ด€๋ฆฌ", "AuditChecklist": [ "๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜์„ ์œ„ํ•˜์—ฌ ์ฃผ๊ธฐ์  ๋˜๋Š” ์ƒ์‹œ์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•˜๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์„ ๋ฌธ์„œํ™”ํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -439,7 +439,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.4. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", + "Subdomain": "1.4 ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", "Section": "1.4.1 ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜ ๊ฒ€ํ† ", "AuditChecklist": [ "์กฐ์ง์ด ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•˜๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ํŒŒ์•…ํ•˜์—ฌ ์ตœ์‹ ์„ฑ์„ ์œ ์ง€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -477,7 +477,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.4. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", + "Subdomain": "1.4 ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", "Section": "1.4.2 ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€", "AuditChecklist": [ "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ๋ฐ ์ˆ˜๋ฆฝ๋œ ์ •์ฑ…์— ๋”ฐ๋ผ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„๊ฐ€ ํšจ๊ณผ์ ์œผ๋กœ ์šด์˜๋˜๋Š”์ง€๋ฅผ ์ ๊ฒ€ํ•˜๊ธฐ ์œ„ํ•œ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€๊ธฐ์ค€, ๋ฒ”์œ„, ์ฃผ๊ธฐ, ์ ๊ฒ€์ธ๋ ฅ ์ž๊ฒฉ์š”๊ฑด ๋“ฑ์„ ํฌํ•จํ•œ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -508,7 +508,7 @@ "Attributes": [ { "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", - "Subdomain": "1.4. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", + "Subdomain": "1.4 ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", "Section": "1.4.3 ๊ด€๋ฆฌ์ฒด๊ณ„ ๊ฐœ์„ ", "AuditChecklist": [ "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜๊ฒ€ํ†  ๋ฐ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€์„ ํ†ตํ•˜์—ฌ ์‹๋ณ„๋œ ๊ด€๋ฆฌ์ฒด๊ณ„์ƒ์˜ ๋ฌธ์ œ์ ์— ๋Œ€ํ•œ ๊ทผ๋ณธ ์›์ธ์„ ๋ถ„์„ํ•˜์—ฌ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋ฐ ๊ฐœ์„  ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -541,7 +541,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.1. ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", + "Subdomain": "2.1 ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", "Section": "2.1.1 ์ •์ฑ…์˜ ์œ ์ง€๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ์— ๋Œ€ํ•œ ์ •๊ธฐ์ ์ธ ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -573,11 +573,15 @@ "Id": "2.1.2", "Name": "์กฐ์ง์˜ ์œ ์ง€๊ด€๋ฆฌ", "Description": "์กฐ์ง์˜ ๊ฐ ๊ตฌ์„ฑ์›์—๊ฒŒ ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์—ญํ•  ๋ฐ ์ฑ…์ž„์„ ํ• ๋‹นํ•˜๊ณ , ๊ทธ ํ™œ๋™์„ ํ‰๊ฐ€ํ•  ์ˆ˜ ์žˆ๋Š” ์ฒด๊ณ„์™€ ์กฐ์ง ๋ฐ ์กฐ์ง์˜ ๊ตฌ์„ฑ์› ๊ฐ„ ์ƒํ˜ธ ์˜์‚ฌ์†Œํ†ตํ•  ์ˆ˜ ์žˆ๋Š” ์ฒด๊ณ„๋ฅผ ์ˆ˜๋ฆฝํ•˜์—ฌ ์šด์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.1. ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", + "Subdomain": "2.1 ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", "Section": "2.1.2 ์กฐ์ง์˜ ์œ ์ง€๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ฑ…์ž„์ž์™€ ๋‹ด๋‹น์ž์˜ ์—ญํ•  ๋ฐ ์ฑ…์ž„์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -612,20 +616,23 @@ "Name": "์ •๋ณด์ž์‚ฐ ๊ด€๋ฆฌ", "Description": "์ •๋ณด์ž์‚ฐ์˜ ์šฉ๋„์™€ ์ค‘์š”๋„์— ๋”ฐ๋ฅธ ์ทจ๊ธ‰ ์ ˆ์ฐจ ๋ฐ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ์ž์‚ฐ๋ณ„ ์ฑ…์ž„์†Œ์žฌ๋ฅผ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜์—ฌ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "organizations_tags_policies_enabled_and_attached", + "ec2_elastic_ip_unassigned", + "ec2_instance_older_than_specific_days", + "ecr_repositories_lifecycle_policy_enabled", + "fsx_file_system_copy_tags_to_volumes_enabled", + "neptune_cluster_copy_tags_to_snapshots", "organizations_account_part_of_organizations", - "macie_is_enabled", - "config_recorder_all_regions_enabled", - "resourceexplorer2_indexes_found", - "account_maintain_current_contact_details", - "account_maintain_different_contact_details_to_security_billing_and_operations", - "account_security_questions_are_registered_in_the_aws_account", - "account_security_contact_information_is_registered" + "organizations_delegated_administrators", + "organizations_scp_check_deny_regions", + "organizations_tags_policies_enabled_and_attached", + "rds_cluster_copy_tags_to_snapshots", + "rds_instance_copy_tags_to_snapshots", + "resourceexplorer2_indexes_found" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.1. ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", + "Subdomain": "2.1 ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", "Section": "2.1.3 ์ •๋ณด์ž์‚ฐ ๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด์ž์‚ฐ์˜ ๋ณด์•ˆ๋“ฑ๊ธ‰์— ๋”ฐ๋ฅธ ์ทจ๊ธ‰์ ˆ์ฐจ(์ƒ์„ฑยท๋„์ž…, ์ €์žฅ, ์ด์šฉ, ํŒŒ๊ธฐ) ๋ฐ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ •์˜ํ•˜๊ณ  ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -651,14 +658,13 @@ "Name": "์ฃผ์š” ์ง๋ฌด์ž ์ง€์ • ๋ฐ ๊ด€๋ฆฌ", "Description": "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ์ทจ๊ธ‰์ด๋‚˜ ์ฃผ์š” ์‹œ์Šคํ…œ ์ ‘๊ทผ ๋“ฑ ์ฃผ์š” ์ง๋ฌด์˜ ๊ธฐ์ค€๊ณผ ๊ด€๋ฆฌ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝํ•˜๊ณ , ์ฃผ์š” ์ง๋ฌด์ž๋ฅผ ์ตœ์†Œํ•œ์œผ๋กœ ์ง€์ •ํ•˜์—ฌ ๊ทธ ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "organizations_delegated_administrators", - "account_security_contact_information_is_registered", - "iam_support_role_created" + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Subdomain": "2.2 ์ธ์  ๋ณด์•ˆ", "Section": "2.2.1 ์ฃผ์š” ์ง๋ฌด์ž ์ง€์ • ๋ฐ ๊ด€๋ฆฌ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ์ทจ๊ธ‰, ์ฃผ์š” ์‹œ์Šคํ…œ ์ ‘๊ทผ ๋“ฑ ์ฃผ์š” ์ง๋ฌด์˜ ๊ธฐ์ค€์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -690,11 +696,13 @@ "Id": "2.2.2", "Name": "์ง๋ฌด ๋ถ„๋ฆฌ", "Description": "๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์œผ๋กœ ์ธํ•œ ์ž ์žฌ์ ์ธ ํ”ผํ•ด ์˜ˆ๋ฐฉ์„ ์œ„ํ•˜์—ฌ ์ง๋ฌด ๋ถ„๋ฆฌ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋‹ค๋งŒ ๋ถˆ๊ฐ€ํ”ผํ•˜๊ฒŒ ์ง๋ฌด ๋ถ„๋ฆฌ๊ฐ€ ์–ด๋ ค์šด ๊ฒฝ์šฐ ๋ณ„๋„์˜ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "account_maintain_different_contact_details_to_security_billing_and_operations" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Subdomain": "2.2 ์ธ์  ๋ณด์•ˆ", "Section": "2.2.2 ์ง๋ฌด ๋ถ„๋ฆฌ", "AuditChecklist": [ "๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์œผ๋กœ ์ธํ•œ ์ž ์žฌ์ ์ธ ํ”ผํ•ด ์˜ˆ๋ฐฉ์„ ์œ„ํ•˜์—ฌ ์ง๋ฌด ๋ถ„๋ฆฌ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -716,12 +724,12 @@ { "Id": "2.2.3", "Name": "๋ณด์•ˆ ์„œ์•ฝ", - "Description": "์ •๋ณด์ž์‚ฐ์„ ์ทจ๊ธ‰ํ•˜๊ฑฐ๋‚˜ ์ ‘๊ทผ๊ถŒํ•œ์ด ๋ถ€์—ฌ๋œ ์ž„์ง์›ยท์ž„์‹œ์ง์›ยท์™ธ๋ถ€์ž ๋“ฑ์ด ๋‚ด๋ถ€ ์ •์ฑ… ๋ฐ", + "Description": "์ •๋ณด์ž์‚ฐ์„ ์ทจ๊ธ‰ํ•˜๊ฑฐ๋‚˜ ์ ‘๊ทผ๊ถŒํ•œ์ด ๋ถ€์—ฌ๋œ ์ž„์ง์›ยท์ž„์‹œ์ง์›ยท์™ธ๋ถ€์ž ๋“ฑ์ด ๋‚ด๋ถ€ ์ •์ฑ… ๋ฐ ๊ด€๋ จ ๋ฒ•๊ทœ, ๋น„๋ฐ€์œ ์ง€ ์˜๋ฌด ๋“ฑ ์ค€์ˆ˜์‚ฌํ•ญ์„ ๋ช…ํ™•ํžˆ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์—…๋ฌด ํŠน์„ฑ์— ๋”ฐ๋ฅธ ์ •๋ณด๋ณดํ˜ธ ์„œ์•ฝ์„ ๋ฐ›์•„์•ผ ํ•œ๋‹ค.", "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Subdomain": "2.2 ์ธ์  ๋ณด์•ˆ", "Section": "2.2.3 ๋ณด์•ˆ ์„œ์•ฝ", "AuditChecklist": [ "์‹ ๊ทœ ์ธ๋ ฅ ์ฑ„์šฉ ์‹œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฑ…์ž„์ด ๋ช…์‹œ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -751,7 +759,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Subdomain": "2.2 ์ธ์  ๋ณด์•ˆ", "Section": "2.2.4 ์ธ์‹์ œ๊ณ  ๋ฐ ๊ต์œกํ›ˆ๋ จ", "AuditChecklist": [ "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก์˜ ์‹œ๊ธฐ, ๊ธฐ๊ฐ„, ๋Œ€์ƒ, ๋‚ด์šฉ, ๋ฐฉ๋ฒ• ๋“ฑ์˜ ๋‚ด์šฉ์ด ํฌํ•จ๋œ ์—ฐ๊ฐ„ ๊ต์œก ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ๊ฒฝ์˜์ง„์˜ ์Šน์ธ์„ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -789,7 +797,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Subdomain": "2.2 ์ธ์  ๋ณด์•ˆ", "Section": "2.2.5 ํ‡ด์ง ๋ฐ ์ง๋ฌด๋ณ€๊ฒฝ ๊ด€๋ฆฌ", "AuditChecklist": [ "ํ‡ด์ง, ์ง๋ฌด๋ณ€๊ฒฝ, ๋ถ€์„œ์ด๋™, ํœด์ง ๋“ฑ์œผ๋กœ ์ธํ•œ ์ธ์‚ฌ๋ณ€๊ฒฝ ๋‚ด์šฉ์ด ์ธ์‚ฌ๋ถ€์„œ, ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ถ€์„œ, ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ์šด์˜๋ถ€์„œ ๊ฐ„ ๊ณต์œ ๋˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -821,7 +829,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Subdomain": "2.2 ์ธ์  ๋ณด์•ˆ", "Section": "2.2.6 ๋ณด์•ˆ ์œ„๋ฐ˜ ์‹œ ์กฐ์น˜", "AuditChecklist": [ "์ž„์ง์› ๋ฐ ๊ด€๋ จ ์™ธ๋ถ€์ž๊ฐ€ ๋ฒ•๋ น๊ณผ ๊ทœ์ œ ๋ฐ ๋‚ด๋ถ€์ •์ฑ…์— ๋”ฐ๋ฅธ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฑ…์ž„๊ณผ ์˜๋ฌด๋ฅผ ์œ„๋ฐ˜ํ•œ ๊ฒฝ์šฐ์— ๋Œ€ํ•œ ์ฒ˜๋ฒŒ ๊ทœ์ •์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -848,7 +856,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Subdomain": "2.3 ์™ธ๋ถ€์ž ๋ณด์•ˆ", "Section": "2.3.1 ์™ธ๋ถ€์ž ํ˜„ํ™ฉ ๊ด€๋ฆฌ", "AuditChecklist": [ "๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด์—์„œ ๋ฐœ์ƒํ•˜๊ณ  ์žˆ๋Š” ์—…๋ฌด ์œ„ํƒ ๋ฐ ์™ธ๋ถ€ ์‹œ์„คยท์„œ๋น„์Šค์˜ ์ด์šฉ ํ˜„ํ™ฉ์„ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -879,7 +887,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Subdomain": "2.3 ์™ธ๋ถ€์ž ๋ณด์•ˆ", "Section": "2.3.2 ์™ธ๋ถ€์ž ๊ณ„์•ฝ ์‹œ ๋ณด์•ˆ", "AuditChecklist": [ "์ค‘์š”์ •๋ณด ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์™€ ๊ด€๋ จ๋œ ์™ธ๋ถ€ ์„œ๋น„์Šค ๋ฐ ์œ„ํƒ ์—…์ฒด๋ฅผ ์„ ์ •ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ์—ญ๋Ÿ‰์„ ๊ณ ๋ คํ•˜๋„๋ก ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -911,7 +919,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Subdomain": "2.3 ์™ธ๋ถ€์ž ๋ณด์•ˆ", "Section": "2.3.3 ์™ธ๋ถ€์ž ๋ณด์•ˆ ์ดํ–‰ ๊ด€๋ฆฌ", "AuditChecklist": [ "์™ธ๋ถ€์ž๊ฐ€ ๊ณ„์•ฝ์„œ, ํ˜‘์ •์„œ, ๋‚ด๋ถ€์ •์ฑ…์— ๋ช…์‹œ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์š”๊ตฌ์‚ฌํ•ญ์„ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ๋Š”์ง€ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ ๋˜๋Š” ๊ฐ์‚ฌ๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -946,7 +954,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Subdomain": "2.3 ์™ธ๋ถ€์ž ๋ณด์•ˆ", "Section": "2.3.4 ์™ธ๋ถ€์ž ๊ณ„์•ฝ ๋ณ€๊ฒฝ ๋ฐ ๋งŒ๋ฃŒ ์‹œ ๋ณด์•ˆ", "AuditChecklist": [ "์™ธ๋ถ€์ž ๊ณ„์•ฝ๋งŒ๋ฃŒ, ์—…๋ฌด ์ข…๋ฃŒ, ๋‹ด๋‹น์ž ๋ณ€๊ฒฝ ์‹œ ๊ณต์‹์ ์ธ ์ ˆ์ฐจ์— ๋”ฐ๋ฅธ ์ •๋ณด์ž์‚ฐ ๋ฐ˜๋‚ฉ, ์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ๊ณ„์ • ์‚ญ์ œ, ๋น„๋ฐ€์œ ์ง€ ํ™•์•ฝ์„œ ์ง•๊ตฌ ๋“ฑ์ด ์ด๋ฃจ์–ด์งˆ ์ˆ˜ ์žˆ๋„๋ก ๋ณด์•ˆ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -978,7 +986,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.1 ๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ •", "AuditChecklist": [ "๋ฌผ๋ฆฌ์ ยทํ™˜๊ฒฝ์  ์œ„ํ˜‘์œผ๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด, ๋ฌธ์„œ, ์ €์žฅ๋งค์ฒด, ์ฃผ์š” ์„ค๋น„ ๋ฐ ์‹œ์Šคํ…œ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ํ†ต์ œ๊ตฌ์—ญ, ์ œํ•œ๊ตฌ์—ญ, ์ ‘๊ฒฌ๊ตฌ์—ญ ๋“ฑ ๋ฌผ๋ฆฌ์  ๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ •๊ธฐ์ค€์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1009,7 +1017,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.2 ์ถœ์ž…ํ†ต์ œ", "AuditChecklist": [ "๋ณดํ˜ธ๊ตฌ์—ญ์€ ์ถœ์ž…์ ˆ์ฐจ์— ๋”ฐ๋ผ ์ถœ์ž…์ด ํ—ˆ๊ฐ€๋œ ์ž๋งŒ ์ถœ์ž…ํ•˜๋„๋ก ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1041,7 +1049,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.3 ์ •๋ณด์‹œ์Šคํ…œ ๋ณดํ˜ธ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์˜ ์ค‘์š”๋„, ์šฉ๋„, ํŠน์„ฑ ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ๋ฐฐ์น˜ ์žฅ์†Œ๋ฅผ ๋ถ„๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1069,7 +1077,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.4 ๋ณดํ˜ธ์„ค๋น„ ์šด์˜", "AuditChecklist": [ "๊ฐ ๋ณดํ˜ธ๊ตฌ์—ญ์˜ ์ค‘์š”๋„ ๋ฐ ํŠน์„ฑ์— ๋”ฐ๋ผ ํ™”์žฌ, ์ˆ˜ํ•ด, ์ „๋ ฅ ์ด์ƒ ๋“ฑ ์ธ์žฌ ๋ฐ ์ž์—ฐ์žฌํ•ด ๋“ฑ์— ๋Œ€๋น„ํ•˜์—ฌ ํ•„์š”ํ•œ ์„ค๋น„๋ฅผ ๊ฐ–์ถ”๊ณ  ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1094,14 +1102,14 @@ ] }, { - "Id": "2.4.5", + "Id": "2.4.5 ", "Name": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…", "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด์—์„œ์˜ ๋น„์ธ๊ฐ€ํ–‰์œ„ ๋ฐ ๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•œ ์ž‘์—… ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ์ดํ–‰ํ•˜๊ณ , ์ž‘์—… ๊ธฐ๋ก์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.5 ๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ ๋„์ž…, ์œ ์ง€๋ณด์ˆ˜ ๋“ฑ์œผ๋กœ ๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…์ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ์— ๋Œ€ํ•œ ๊ณต์‹์ ์ธ ์ž‘์—…์‹ ์ฒญ ๋ฐ ์ˆ˜ํ–‰ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1123,12 +1131,12 @@ { "Id": "2.4.6", "Name": "๋ฐ˜์ถœ์ž… ๊ธฐ๊ธฐ ํ†ต์ œ", - "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ •๋ณด์‹œ์Šคํ…œ, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ, ์ €์žฅ๋งค์ฒด ๋“ฑ์— ๋Œ€ํ•œ ๋ฐ˜์ถœ์ž… ํ†ต์ œ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ์ดํ–‰ํ•˜๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ •๋ณด์‹œ์Šคํ…œ, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ, ์ €์žฅ๋งค์ฒด ๋“ฑ์— ๋Œ€ํ•œ ๋ฐ˜์ถœ์ž… ํ†ต์ œ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.6 ๋ฐ˜์ถœ์ž… ๊ธฐ๊ธฐ ํ†ต์ œ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ, ์ €์žฅ๋งค์ฒด ๋“ฑ์„ ๋ณดํ˜ธ๊ตฌ์—ญ์— ๋ฐ˜์ž…ํ•˜๊ฑฐ๋‚˜ ๋ฐ˜์ถœํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์œ ์ถœ, ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ ๋“ฑ ๋ณด์•ˆ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ์„ ์œ„ํ•œ ํ†ต์ œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1158,7 +1166,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Subdomain": "2.4 ๋ฌผ๋ฆฌ ๋ณด์•ˆ", "Section": "2.4.7 ์—…๋ฌดํ™˜๊ฒฝ ๋ณด์•ˆ", "AuditChecklist": [ "๋ฌธ์„œ๊ณ , ๊ณต์šฉ PC, ๋ณตํ•ฉ๊ธฐ, ํŒŒ์ผ์„œ๋ฒ„ ๋“ฑ ๊ณต์šฉ์œผ๋กœ ์‚ฌ์šฉํ•˜๋Š” ์‹œ์„ค ๋ฐ ์‚ฌ๋ฌด์šฉ ๊ธฐ๊ธฐ์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1190,37 +1198,49 @@ "Name": "์‚ฌ์šฉ์ž ๊ณ„์ • ๊ด€๋ฆฌ", "Description": "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ณ  ์—…๋ฌด ๋ชฉ์ ์— ๋”ฐ๋ฅธ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ตœ์†Œํ•œ์œผ๋กœ ๋ถ€์—ฌํ•  ์ˆ˜ ์žˆ๋„๋ก ์‚ฌ์šฉ์ž ๋“ฑ๋กยทํ•ด์ง€ ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ€์—ฌยท๋ณ€๊ฒฝยท๋ง์†Œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ์‚ฌ์šฉ์ž ๋“ฑ๋ก ๋ฐ ๊ถŒํ•œ๋ถ€์—ฌ ์‹œ ์‚ฌ์šฉ์ž์—๊ฒŒ ๋ณด์•ˆ์ฑ…์ž„์ด ์žˆ์Œ์„ ๊ทœ์ •ํ™”ํ•˜๊ณ  ์ธ์‹์‹œ์ผœ์•ผ ํ•œ๋‹ค.", "Checks": [ - "organizations_scp_check_deny_regions", + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "apigateway_restapi_authorizers_enabled", + "autoscaling_group_launch_configuration_requires_imdsv2", + "cognito_user_pool_deletion_protection_enabled", "cognito_user_pool_self_registration_disabled", - "iam_user_administrator_access_policy", + "config_recorder_using_aws_service_role", + "ec2_instance_profile_attached", + "eventbridge_schema_registry_cross_account_access", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges", "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", "iam_inline_policy_allows_privilege_escalation", "iam_inline_policy_no_administrative_privileges", - "iam_aws_attached_policy_no_administrative_privileges", - "iam_policy_allows_privilege_escalation", - "iam_policy_no_full_access_to_kms", - "iam_role_cross_service_confused_deputy_prevention", "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_role_cross_account_readonlyaccess_policy", "iam_inline_policy_no_full_access_to_kms", - "iam_user_accesskey_unused", - "iam_securityaudit_role_created", "iam_no_custom_policy_permissive_role_assumption", - "iam_customer_attached_policy_no_administrative_privileges", - "iam_group_administrator_access_policy", - "iam_user_console_access_unused", + "iam_no_root_access_key", + "iam_policy_allows_privilege_escalation", "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", "iam_policy_no_full_access_to_cloudtrail", - "iam_role_administratoraccess_policy" + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_administrator_access_policy" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Subdomain": "2.5 ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", "Section": "2.5.1 ์‚ฌ์šฉ์ž ๊ณ„์ • ๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์˜ ๋“ฑ๋กยท๋ณ€๊ฒฝยท์‚ญ์ œ์— ๊ด€ํ•œ ๊ณต์‹์ ์ธ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", - "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ์ƒ์„ฑ ๋ฐ ๋“ฑ๋กยท๋ณ€๊ฒฝ ์‹œ ์ง๋ฌด๋ณ„ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ„๋ฅ˜ ์ฒด๊ณ„์— ๋”ฐ๋ผ ์—…๋ฌด์ƒ ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ๊ถŒํ•œ๋งŒ์„ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ์ƒ์„ฑยท๋“ฑ๋กยท๋ณ€๊ฒฝ ์‹œ ์ง๋ฌด๋ณ„ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ„๋ฅ˜ ์ฒด๊ณ„์— ๋”ฐ๋ผ ์—…๋ฌด์ƒ ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ๊ถŒํ•œ๋งŒ์„ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", "์‚ฌ์šฉ์ž์—๊ฒŒ ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•˜๋Š” ๊ฒฝ์šฐ ํ•ด๋‹น ๊ณ„์ •์— ๋Œ€ํ•œ ๋ณด์•ˆ์ฑ…์ž„์ด ๋ณธ์ธ์—๊ฒŒ ์žˆ์Œ์„ ๋ช…ํ™•ํžˆ ์ธ์‹์‹œํ‚ค๊ณ  ์žˆ๋Š”๊ฐ€?" ], "RelatedRegulations": [ @@ -1245,11 +1265,15 @@ "Id": "2.5.2", "Name": "์‚ฌ์šฉ์ž ์‹๋ณ„", "Description": "์‚ฌ์šฉ์ž ๊ณ„์ •์€ ์‚ฌ์šฉ์ž๋ณ„๋กœ ์œ ์ผํ•˜๊ฒŒ ๊ตฌ๋ถ„ํ•  ์ˆ˜ ์žˆ๋„๋ก ์‹๋ณ„์ž๋ฅผ ํ• ๋‹นํ•˜๊ณ  ์ถ”์ธก ๊ฐ€๋Šฅํ•œ ์‹๋ณ„์ž ์‚ฌ์šฉ์„ ์ œํ•œํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ๋™์ผํ•œ ์‹๋ณ„์ž๋ฅผ ๊ณต์œ ํ•˜์—ฌ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ์‚ฌ์œ ์™€ ํƒ€๋‹น์„ฑ์„ ๊ฒ€ํ† ํ•˜์—ฌ ์ฑ…์ž„์ž์˜ ์Šน์ธ ๋ฐ ์ฑ…์ž„์ถ”์ ์„ฑ ํ™•๋ณด ๋“ฑ ๋ณด์™„๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "cognito_user_pool_advanced_security_enabled", + "ec2_instance_profile_attached", + "efs_access_point_enforce_user_identity" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Subdomain": "2.5 ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", "Section": "2.5.2 ์‚ฌ์šฉ์ž ์‹๋ณ„", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์—์„œ ์‚ฌ์šฉ์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๋ฅผ ์œ ์ผํ•˜๊ฒŒ ๊ตฌ๋ถ„ํ•  ์ˆ˜ ์žˆ๋Š” ์‹๋ณ„์ž๋ฅผ ํ• ๋‹นํ•˜๊ณ  ์ถ”์ธก ๊ฐ€๋Šฅํ•œ ์‹๋ณ„์ž์˜ ์‚ฌ์šฉ์„ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1277,40 +1301,53 @@ "Name": "์‚ฌ์šฉ์ž ์ธ์ฆ", "Description": "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž์˜ ์ ‘๊ทผ์€ ์•ˆ์ „ํ•œ ์ธ์ฆ์ ˆ์ฐจ์™€ ํ•„์š”์— ๋”ฐ๋ผ ๊ฐ•ํ™”๋œ ์ธ์ฆ๋ฐฉ์‹์„ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ๋กœ๊ทธ์ธ ํšŸ์ˆ˜ ์ œํ•œ, ๋ถˆ๋ฒ• ๋กœ๊ทธ์ธ ์‹œ๋„ ๊ฒฝ๊ณ  ๋“ฑ ๋น„์ธ๊ฐ€์ž ์ ‘๊ทผ ํ†ต์ œ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ + "account_security_questions_are_registered_in_the_aws_account", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public_with_authorizer", + "apigatewayv2_api_authorizers_enabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "cloudtrail_bucket_requires_mfa_delete", "cloudwatch_log_metric_filter_authentication_failures", "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", "cognito_user_pool_advanced_security_enabled", - "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", "cognito_user_pool_mfa_enabled", - "cognito_user_pool_self_registration_disabled", + "directoryservice_supported_mfa_radius_enabled", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "efs_access_point_enforce_user_identity", + "elasticache_redis_replication_group_auth_enabled", + "iam_administrator_access_with_mfa", + "iam_check_saml_providers_sts", + "iam_no_root_access_key", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_rotate_access_key_90_days", + "iam_user_accesskey_unused", + "iam_user_console_access_unused", + "iam_user_hardware_mfa_enabled", + "iam_user_mfa_enabled_console_access", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "iam_user_with_temporary_credentials", + "neptune_cluster_iam_authentication_enabled", "opensearch_service_domains_internal_user_database_enabled", "opensearch_service_domains_use_cognito_authentication_for_kibana", - "directoryservice_supported_mfa_radius_enabled", - "iam_rotate_access_key_90_days", - "iam_root_hardware_mfa_enabled", - "iam_user_no_setup_initial_access_key", - "iam_root_mfa_enabled", - "iam_user_with_temporary_credentials", - "iam_user_hardware_mfa_enabled", - "iam_check_saml_providers_sts", - "iam_user_two_active_access_key", - "iam_user_accesskey_unused", - "iam_user_mfa_enabled_console_access", - "iam_administrator_access_with_mfa", - "apigatewayv2_api_authorizers_enabled", - "kafka_cluster_unrestricted_access_disabled", + "organizations_account_part_of_organizations", "rds_cluster_iam_authentication_enabled", "rds_instance_iam_authentication_enabled", - "apigateway_restapi_authorizers_enabled" + "s3_bucket_cross_account_access", + "s3_bucket_no_mfa_delete" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Subdomain": "2.5 ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", "Section": "2.5.3 ์‚ฌ์šฉ์ž ์ธ์ฆ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์ ‘๊ทผ์€ ์‚ฌ์šฉ์ž ์ธ์ฆ, ๋กœ๊ทธ์ธ ํšŸ์ˆ˜ ์ œํ•œ, ๋ถˆ๋ฒ• ๋กœ๊ทธ์ธ ์‹œ๋„ ๊ฒฝ๊ณ  ๋“ฑ ์•ˆ์ „ํ•œ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1338,28 +1375,28 @@ "Name": "๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ", "Description": "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ, ์™ธ๋ถ€ ์œ„ํ˜‘์š”์ธ ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ์ •๋ณด์‹œ์Šคํ…œ ์‚ฌ์šฉ์ž ๋ฐ ๊ณ ๊ฐ, ํšŒ์› ๋“ฑ ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "cognito_user_pool_temporary_password_expiration", - "cognito_user_pool_password_policy_uppercase", - "cognito_user_pool_password_policy_number", "cognito_user_pool_password_policy_lowercase", "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_number", "cognito_user_pool_password_policy_symbol", - "iam_password_policy_number", - "iam_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_temporary_password_expiration", "iam_password_policy_expires_passwords_within_90_days_or_less", - "iam_password_policy_symbol", - "iam_password_policy_reuse_24", "iam_password_policy_lowercase", + "iam_password_policy_minimum_length_14", + "iam_password_policy_number", + "iam_password_policy_reuse_24", + "iam_password_policy_symbol", "iam_password_policy_uppercase" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Subdomain": "2.5 ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", "Section": "2.5.4 ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์•ˆ์ „ํ•œ ์‚ฌ์šฉ์ž ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ์ ˆ์ฐจ ๋ฐ ์ž‘์„ฑ๊ทœ์น™์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", - "์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)๊ฐ€ ์•ˆ์ „ํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ด์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ๋น„๋ฐ€๋ฒˆํ˜ธ ์ž‘์„ฑ๊ทœ์น™์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)๊ฐ€ ์•ˆ์ „ํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ด์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ๋น„๋ฐ€๋ฒˆํ˜ธ ์ž‘์„ฑ๊ทœ์น™์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", "๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋˜๋Š” ์ •๋ณด์ฃผ์ฒด์˜ ์ธ์ฆ์ˆ˜๋‹จ์„ ์•ˆ์ „ํ•˜๊ฒŒ ์ ์šฉํ•˜๊ณ  ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" ], "RelatedRegulations": [ @@ -1383,22 +1420,46 @@ "Name": "ํŠน์ˆ˜ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ๊ด€๋ฆฌ", "Description": "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ฆฌ, ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด ๊ด€๋ฆฌ ๋“ฑ ํŠน์ˆ˜ ๋ชฉ์ ์„ ์œ„ํ•˜์—ฌ ์‚ฌ์šฉํ•˜๋Š” ๊ณ„์ • ๋ฐ ๊ถŒํ•œ์€ ์ตœ์†Œํ•œ์œผ๋กœ ๋ถ€์—ฌํ•˜๊ณ  ๋ณ„๋„๋กœ ์‹๋ณ„ํ•˜์—ฌ ํ†ต์ œํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "organizations_delegated_administrators", + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "apigateway_restapi_authorizers_enabled", "cloudwatch_log_metric_filter_root_usage", + "cognito_user_pool_self_registration_disabled", + "config_recorder_using_aws_service_role", + "ecs_task_definitions_no_privileged_containers", + "iam_administrator_access_with_mfa", + "iam_avoid_root_usage", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_no_root_access_key", + "iam_policy_allows_privilege_escalation", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", "iam_root_hardware_mfa_enabled", "iam_root_mfa_enabled", + "iam_securityaudit_role_created", "iam_support_role_created", - "iam_avoid_root_usage", - "iam_no_root_access_key", - "rds_instance_default_admin", + "iam_user_administrator_access_policy", + "organizations_delegated_administrators", "rds_cluster_default_admin", + "rds_instance_default_admin", "sagemaker_notebook_instance_root_access_disabled", - "ec2_instance_profile_attached" + "ses_identity_not_publicly_accessible" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Subdomain": "2.5 ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", "Section": "2.5.5 ํŠน์ˆ˜ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ๊ด€๋ฆฌ", "AuditChecklist": [ "๊ด€๋ฆฌ์ž ๊ถŒํ•œ ๋“ฑ ํŠน์ˆ˜๊ถŒํ•œ์€ ์ตœ์†Œํ•œ์˜ ์ธ์›์—๊ฒŒ๋งŒ ๋ถ€์—ฌ๋  ์ˆ˜ ์žˆ๋„๋ก ๊ณต์‹์ ์ธ ๊ถŒํ•œ ์‹ ์ฒญ ๋ฐ ์Šน์ธ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1411,7 +1472,6 @@ "AuditEvidence": [ "ํŠน์ˆ˜๊ถŒํ•œ ๊ด€๋ จ ์ง€์นจ", "ํŠน์ˆ˜๊ถŒํ•œ ์‹ ์ฒญยท์Šน์ธ ๋‚ด์—ญ", - "ํŠน์ˆ˜๊ถŒํ•œ์ž ๋ชฉ๋ก", "ํŠน์ˆ˜๊ถŒํ•œ ๊ฒ€ํ†  ๋‚ด์šฉ" ], "NonComplianceCases": [ @@ -1428,28 +1488,67 @@ "Name": "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ", "Description": "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•˜๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ •์˜ ๋“ฑ๋กยท์ด์šฉยท์‚ญ์ œ ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์˜ ๋ถ€์—ฌยท๋ณ€๊ฒฝยท์‚ญ์ œ ์ด๋ ฅ์„ ๋‚จ๊ธฐ๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ ์ ์ •์„ฑ ์—ฌ๋ถ€๋ฅผ ์ ๊ฒ€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_policy_changes", - "accessanalyzer_enabled_without_findings", "accessanalyzer_enabled", - "cloudtrail_insights_exist", - "cloudtrail_multi_region_enabled_logging_management_events", - "cloudtrail_cloudwatch_logging_enabled" + "accessanalyzer_enabled_without_findings", + "apigateway_restapi_authorizers_enabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "autoscaling_group_launch_configuration_requires_imdsv2", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_metric_filter_policy_changes", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_self_registration_disabled", + "config_recorder_using_aws_service_role", + "dynamodb_table_cross_account_access", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_managed_by_ssm", + "ec2_instance_profile_attached", + "eventbridge_bus_cross_account_access", + "eventbridge_schema_registry_cross_account_access", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_policy_allows_privilege_escalation", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_administrator_access_policy", + "s3_bucket_cross_account_access", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "ses_identity_not_publicly_accessible", + "sns_topics_not_publicly_accessible", + "sqs_queues_not_publicly_accessible", + "ssm_documents_set_as_public", + "vpc_endpoint_services_allowed_principals_trust_boundaries" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Subdomain": "2.5 ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", "Section": "2.5.6 ์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ", "AuditChecklist": [ - "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ์ƒ์„ฑยท๋“ฑ๋กยท๋ถ€์—ฌ ๋ฐ ์ด์šฉยท๋ณ€๊ฒฝยท๋ง์†Œ ๋“ฑ์˜ ์ด๋ ฅ์„ ๋‚จ๊ธฐ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ์ƒ์„ฑยท๋“ฑ๋กยท๋ถ€์—ฌยท ์ด์šฉยท๋ณ€๊ฒฝยท๋ง์†Œ ๋“ฑ์˜ ์ด๋ ฅ์„ ๋‚จ๊ธฐ๊ณ  ์žˆ๋Š”๊ฐ€?", "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์˜ ์ ์ •์„ฑ ๊ฒ€ํ†  ๊ธฐ์ค€, ๊ฒ€ํ† ์ฃผ์ฒด, ๊ฒ€ํ† ๋ฐฉ๋ฒ•, ์ฃผ๊ธฐ ๋“ฑ์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ •๊ธฐ์  ๊ฒ€ํ† ๋ฅผ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ†  ๊ฒฐ๊ณผ ์ ‘๊ทผ๊ถŒํ•œ ๊ณผ๋‹ค ๋ถ€์—ฌ, ๊ถŒํ•œ๋ถ€์—ฌ ์ ˆ์ฐจ ๋ฏธ์ค€์ˆ˜, ๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ ๋ฌธ์ œ์ ์ด ๋ฐœ๊ฒฌ๋œ ๊ฒฝ์šฐ ๊ทธ์— ๋”ฐ๋ฅธ ์กฐ์น˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" ], @@ -1475,123 +1574,139 @@ "Name": "๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", "Description": "๋„คํŠธ์›Œํฌ์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ธฐ ์œ„ํ•˜์—ฌ IP๊ด€๋ฆฌ, ๋‹จ๋ง์ธ์ฆ ๋“ฑ ๊ด€๋ฆฌ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ์ดํ–‰ํ•˜๊ณ , ์—…๋ฌด๋ชฉ์  ๋ฐ ์ค‘์š”๋„์— ๋”ฐ๋ผ ๋„คํŠธ์›Œํฌ ๋ถ„๋ฆฌ(DMZ, ์„œ๋ฒ„ํŒœ, DB์กด, ๊ฐœ๋ฐœ์กด ๋“ฑ)์™€ ์ ‘๊ทผํ†ต์ œ๋ฅผ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "ssm_documents_set_as_public", - "s3_access_point_public_access_block", - "s3_bucket_public_write_acl", - "s3_bucket_acl_prohibited", - "s3_account_level_public_access_blocks", - "s3_bucket_level_public_access_block", - "emr_cluster_account_public_block_enabled", - "emr_cluster_master_nodes_no_public_ip", - "emr_cluster_publicly_accesible", - "documentdb_cluster_public_snapshot", - "sns_topics_not_publicly_accessible", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", - "cloudfront_distributions_geo_restrictions_enabled", - "opensearch_service_domains_not_publicly_accessible", - "glacier_vaults_policy_public_access", - "lightsail_instance_public", - "lightsail_database_public", - "neptune_cluster_uses_public_subnet", - "neptune_cluster_public_snapshot", - "ecr_repositories_not_publicly_accessible", - "workspaces_vpc_2private_1public_subnets_nat", - "elb_internet_facing", - "sqs_queues_not_publicly_accessible", - "redshift_cluster_public_access", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", - "awslambda_function_url_public", - "awslambda_function_url_cors_policy", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_waf_acl_attached", + "appstream_fleet_default_internet_access_disabled", + "autoscaling_group_launch_configuration_no_public_ip", + "awslambda_function_inside_vpc", "awslambda_function_not_publicly_accessible", - "iam_user_administrator_access_policy", - "iam_group_administrator_access_policy", - "iam_user_mfa_enabled_console_access", - "networkfirewall_in_all_vpc", + "cloudfront_distributions_default_root_object", + "cloudfront_distributions_geo_restrictions_enabled", + "cloudfront_distributions_s3_origin_access_control", + "cloudfront_distributions_using_waf", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_security_group_changes", + "cognito_user_pool_waf_acl_attached", + "dms_instance_no_public_access", + "documentdb_cluster_public_snapshot", + "dynamodb_table_cross_account_access", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_public_ip", + "ec2_instance_uses_single_eni", + "ec2_launch_template_no_public_ip", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_default_restrict_traffic", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ecr_repositories_not_publicly_accessible", + "ecs_service_no_assign_public_ip", + "ecs_task_set_no_assign_public_ip", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", "eks_cluster_network_policy_enabled", "eks_cluster_not_publicly_accessible", "eks_cluster_private_nodes_enabled", - "eks_cluster_not_publicly_accessible", - "kafka_cluster_is_public", - "kafka_cluster_unrestricted_access_disabled", - "vpc_peering_routing_tables_with_least_privilege", - "vpc_subnet_no_public_ip_by_default", - "vpc_endpoint_services_allowed_principals_trust_boundaries", - "vpc_endpoint_connections_trust_boundaries", - "vpc_subnet_separate_private_public", - "dms_instance_no_public_access", + "elasticache_cluster_uses_public_subnet", + "elb_internet_facing", "elbv2_internet_facing", "elbv2_listeners_underneath", - "elasticache_cluster_uses_public_subnet", - "appstream_fleet_maximum_session_duration", - "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", - "appstream_fleet_session_disconnect_timeout", + "elbv2_waf_acl_attached", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_exposed", + "glue_data_catalogs_not_publicly_accessible", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "lightsail_database_public", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "neptune_cluster_public_snapshot", + "neptune_cluster_uses_public_subnet", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "opensearch_service_domains_not_publicly_accessible", "rds_snapshots_public_access", - "rds_instance_no_public_access", - "rds_instance_event_subscription_security_groups", - "rds_instance_iam_authentication_enabled", - "apigateway_restapi_public", - "apigateway_restapi_authorizers_enabled", - "apigateway_restapi_public_with_authorizer", - "sagemaker_training_jobs_network_isolation_enabled", - "sagemaker_models_vpc_settings_configured", - "sagemaker_training_jobs_vpc_settings_configured", + "rds_instance_inside_vpc", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_public_access", + "route53_dangling_ip_subdomain_takeover", + "s3_access_point_public_access_block", "sagemaker_models_network_isolation_enabled", - "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_models_vpc_settings_configured", "sagemaker_notebook_instance_vpc_settings_configured", - "ec2_instance_port_ldap_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_securitygroup_not_used", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_elastic_ip_shodan", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_networkacl_allow_ingress_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_ebs_public_snapshot", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_transitgateway_auto_accept_vpc_attachments", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_ami_public", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_instance_imdsv2_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_instance_public_ip", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_training_jobs_vpc_settings_configured", + "sqs_queues_server_side_encryption_enabled", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_with_rules", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.1 ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", "AuditChecklist": [ "์กฐ์ง์˜ ๋„คํŠธ์›Œํฌ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ๊ฒฝ๋กœ๋ฅผ ์‹๋ณ„ํ•˜๊ณ  ์ ‘๊ทผํ†ต์ œ ์ •์ฑ…์— ๋”ฐ๋ผ ๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ๋Š” ์ธ๊ฐ€๋œ ์‚ฌ์šฉ์ž๋งŒ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1624,35 +1739,111 @@ "Name": "์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ", "Description": "์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ์— ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๋Š” ์‚ฌ์šฉ์ž, ์ ‘๊ทผ์ œํ•œ ๋ฐฉ์‹, ์•ˆ์ „ํ•œ ์ ‘๊ทผ์ˆ˜๋‹จ ๋“ฑ์„ ์ •์˜ํ•˜์—ฌ ํ†ต์ œํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "lightsail_instance_public", - "lightsail_static_ip_unused", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_elastic_ip_unassigned", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_elastic_ip_shodan", - "ec2_instance_port_rdp_exposed_to_internet", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_waf_acl_attached", + "apigatewayv2_api_authorizers_enabled", + "athena_workgroup_enforce_configuration", + "autoscaling_group_launch_configuration_requires_imdsv2", + "awslambda_function_inside_vpc", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "awslambda_function_not_publicly_accessible", + "cloudfront_distributions_s3_origin_access_control", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_not_publicly_accessible", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_client_token_revocation_enabled", + "dms_instance_no_public_access", + "documentdb_cluster_public_snapshot", + "dynamodb_table_cross_account_access", + "ec2_ami_public", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_imdsv2_enabled", "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", "ec2_instance_managed_by_ssm", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_instance_public_ip", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ecr_repositories_not_publicly_accessible", + "ecs_service_no_assign_public_ip", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_no_privileged_containers", + "ecs_task_set_no_assign_public_ip", + "efs_access_point_enforce_root_directory", + "efs_access_point_enforce_user_identity", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", + "eks_cluster_network_policy_enabled", + "eks_cluster_not_publicly_accessible", + "eks_cluster_private_nodes_enabled", + "elasticache_cluster_uses_public_subnet", + "elasticache_redis_replication_group_auth_enabled", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_exposed", + "glacier_vaults_policy_public_access", + "glue_data_catalogs_not_publicly_accessible", + "guardduty_lambda_protection_enabled", + "guardduty_s3_protection_enabled", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "neptune_cluster_public_snapshot", + "opensearch_service_domains_not_publicly_accessible", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "s3_access_point_public_access_block", + "s3_account_level_public_access_blocks", + "s3_bucket_acl_prohibited", + "s3_bucket_cross_account_access", + "s3_bucket_level_public_access_block", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "s3_multi_region_access_point_public_access_block", + "ssm_documents_set_as_public" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.2 ์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ", "AuditChecklist": [ "์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ๋ณ„ ์šด์˜์ฒด์ œ(OS)์— ์ ‘๊ทผ์ด ํ—ˆ์šฉ๋˜๋Š” ์‚ฌ์šฉ์ž, ์ ‘๊ทผ ๊ฐ€๋Šฅ ์œ„์น˜, ์ ‘๊ทผ ์ˆ˜๋‹จ ๋“ฑ์„ ์ •์˜ํ•˜์—ฌ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1684,11 +1875,30 @@ "Id": "2.6.3", "Name": "์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ", "Description": "์‚ฌ์šฉ์ž๋ณ„ ์—…๋ฌด ๋ฐ ์ ‘๊ทผ ์ •๋ณด์˜ ์ค‘์š”๋„ ๋“ฑ์— ๋”ฐ๋ผ ์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ œํ•œํ•˜๊ณ , ๋ถˆํ•„์š”ํ•œ ์ •๋ณด ๋˜๋Š” ์ค‘์š”์ •๋ณด ๋…ธ์ถœ์„ ์ตœ์†Œํ™”ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigatewayv2_api_authorizers_enabled", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "cloudfront_distributions_default_root_object", + "codeartifact_packages_external_public_publishing_disabled", + "cognito_user_pool_waf_acl_attached", + "ec2_ami_public", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ecr_repositories_not_publicly_accessible", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "eks_cluster_network_policy_enabled" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.3 ์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ", "AuditChecklist": [ "์ค‘์š”์ •๋ณด ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์‚ฌ์šฉ์ž์˜ ์—…๋ฌด์— ๋”ฐ๋ผ ์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ฐจ๋“ฑ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1716,7 +1926,7 @@ "์‚ฌ๋ก€ 1 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์˜ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌํ™”๋ฉด ์ค‘ ์ผ๋ถ€ ํ™”๋ฉด์˜ ๊ถŒํ•œ ์ œ์–ด ๊ธฐ๋Šฅ์— ์˜ค๋ฅ˜๊ฐ€ ์กด์žฌํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์—ด๋žŒ ๊ถŒํ•œ์ด ์—†๋Š” ์‚ฌ์šฉ์ž์—๊ฒŒ๋„ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๋…ธ์ถœ๋˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", "์‚ฌ๋ก€ 2 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์˜ ๊ด€๋ฆฌ์ž ํŽ˜์ด์ง€๊ฐ€ ์™ธ๋ถ€์ธํ„ฐ๋„ท์— ์˜คํ”ˆ๋˜์–ด ์žˆ์œผ๋ฉด์„œ ์•ˆ์ „ํ•œ ์ธ์ฆ์ˆ˜๋‹จ์ด ์ ์šฉ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", "์‚ฌ๋ก€ 3 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์— ๋Œ€ํ•˜์—ฌ ํƒ€๋‹นํ•œ ์‚ฌ์œ  ์—†์ด ์„ธ์…˜ ํƒ€์ž„์•„์›ƒ ๋˜๋Š” ๋™์ผ ์‚ฌ์šฉ์ž ๊ณ„์ •์˜ ๋™์‹œ ์ ‘์†์„ ์ œํ•œํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", - "์‚ฌ๋ก€ 4 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์„ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋‹ค์šด๋กœ๋“œ๋ฐ›๋Š” ๊ฒฝ์šฐ ํ•ด๋‹น ํŒŒ์ผ ๋‚ด์— ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ๋“ฑ ์—…๋ฌด์ƒ ๋ถˆํ•„์š”ํ•œ ์ •๋ณด๊ฐ€ ๊ณผ๋„ํ•˜๊ฒŒ ํฌํ•จ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์„ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋‹ค์šด๋กœ๋“œ๋ฐ›๋Š” ๊ฒฝ์šฐ ํ•ด๋‹น ํŒŒ์ผ ๋‚ด์— ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ๋“ฑ ์—…๋ฌด์ƒ ๋ถˆํ•„์š”ํ•œ ์ •๋ณด๊ฐ€ ๊ณผ๋„ํ•˜๊ฒŒ ํฌํ•จ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ,", "์‚ฌ๋ก€ 5 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์˜ ๊ฐœ์ธ์ •๋ณด ์กฐํšŒํ™”๋ฉด์—์„œ like ๊ฒ€์ƒ‰์„ ๊ณผ๋„ํ•˜๊ฒŒ ํ—ˆ์šฉํ•˜๊ณ  ์žˆ์–ด, ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ ๋ณธ์ธ์˜ ์—…๋ฌด ๋ฒ”์œ„๋ฅผ ์ดˆ๊ณผํ•˜์—ฌ ์„ฑ์”จ๋งŒ์œผ๋กœ๋„ ์ „์ฒด ๊ณ ๊ฐ ์ •๋ณด๋ฅผ ์กฐํšŒํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ", "์‚ฌ๋ก€ 6 : ๊ฐœ์ธ์ •๋ณด ํ‘œ์‹œ์ œํ•œ ์กฐ์น˜ ๊ธฐ์ค€์ด ๋งˆ๋ จ๋˜์–ด ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜ ์ด๋ฅผ ์ค€์ˆ˜ํ•˜์ง€ ์•Š๋Š” ๋“ฑ์˜ ์‚ฌ์œ ๋กœ ๋™์ผํ•œ ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์— ๋Œ€ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ํ™”๋ฉด๋ณ„๋กœ ์„œ๋กœ ๋‹ค๋ฅธ ๋งˆ์Šคํ‚น ๊ธฐ์ค€์ด ์ ์šฉ๋œ ๊ฒฝ์šฐ", "์‚ฌ๋ก€ 7 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ํ™”๋ฉด์ƒ์—๋Š” ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๋งˆ์Šคํ‚น๋˜์–ด ํ‘œ์‹œ๋˜์–ด ์žˆ์œผ๋‚˜, ์›น๋ธŒ๋ผ์šฐ์ € ์†Œ์Šค๋ณด๊ธฐ๋ฅผ ํ†ตํ•˜์—ฌ ๋งˆ์Šคํ‚น๋˜์ง€ ์•Š์€ ์ „์ฒด ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๋…ธ์ถœ๋˜๋Š” ๊ฒฝ์šฐ" @@ -1729,48 +1939,51 @@ "Name": "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ", "Description": "ํ…Œ์ด๋ธ” ๋ชฉ๋ก ๋“ฑ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋‚ด์—์„œ ์ €์žฅยท๊ด€๋ฆฌ๋˜๊ณ  ์žˆ๋Š” ์ •๋ณด๋ฅผ ์‹๋ณ„ํ•˜๊ณ , ์ •๋ณด์˜ ์ค‘์š”๋„์™€ ์‘์šฉํ”„๋กœ๊ทธ๋žจ ๋ฐ ์‚ฌ์šฉ์ž ์œ ํ˜• ๋“ฑ์— ๋”ฐ๋ฅธ ์ ‘๊ทผํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", "documentdb_cluster_public_snapshot", - "opensearch_service_domains_internal_user_database_enabled", - "opensearch_service_domains_use_cognito_authentication_for_kibana", - "opensearch_service_domains_https_communications_enforced", - "opensearch_service_domains_not_publicly_accessible", - "accessanalyzer_enabled_without_findings", - "accessanalyzer_enabled", + "dynamodb_table_cross_account_access", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "guardduty_rds_protection_enabled", "lightsail_database_public", "neptune_cluster_iam_authentication_enabled", "neptune_cluster_uses_public_subnet", - "neptune_cluster_public_snapshot", - "dynamodb_table_cross_account_access", - "redshift_cluster_public_access", - "vpc_subnet_separate_private_public", - "dms_instance_no_public_access", + "opensearch_service_domains_internal_user_database_enabled", "rds_cluster_iam_authentication_enabled", - "rds_snapshots_public_access", - "rds_instance_no_public_access", + "rds_cluster_non_default_port", + "rds_cluster_storage_encrypted", "rds_instance_iam_authentication_enabled", + "rds_instance_no_public_access", + "rds_instance_non_default_port", + "rds_instance_storage_encrypted", "rds_instance_transport_encrypted", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_instance_port_mongodb_exposed_to_internet" + "rds_snapshots_public_access", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_in_transit_encryption_enabled", + "redshift_cluster_non_default_database_name", + "redshift_cluster_non_default_username", + "redshift_cluster_public_access" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.4 ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ", "AuditChecklist": [ "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์˜ ํ…Œ์ด๋ธ” ๋ชฉ๋ก ๋“ฑ ์ €์žฅยท๊ด€๋ฆฌ๋˜๊ณ  ์žˆ๋Š” ์ •๋ณด๋ฅผ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1805,7 +2018,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.5 ๋ฌด์„  ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", "AuditChecklist": [ "๋ฌด์„ ๋„คํŠธ์›Œํฌ๋ฅผ ์—…๋ฌด์ ์œผ๋กœ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๋ฌด์„  AP ๋ฐ ๋„คํŠธ์›Œํฌ ๊ตฌ๊ฐ„ ๋ณด์•ˆ์„ ์œ„ํ•˜์—ฌ ์ธ์ฆ, ์†ก์ˆ˜์‹  ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1835,37 +2048,30 @@ "Name": "์›๊ฒฉ์ ‘๊ทผ ํ†ต์ œ", "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ์ด์™ธ ์žฅ์†Œ์—์„œ์˜ ์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ฆฌ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋Š” ์›์น™์ ์œผ๋กœ ๊ธˆ์ง€ํ•˜๊ณ , ์žฌํƒ๊ทผ๋ฌดยท์žฅ์• ๋Œ€์‘ยท์›๊ฒฉํ˜‘์—… ๋“ฑ ๋ถˆ๊ฐ€ํ”ผํ•œ ์‚ฌ์œ ๋กœ ์›๊ฒฉ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์ฑ…์ž„์ž ์Šน์ธ, ์ ‘๊ทผ ๋‹จ๋ง ์ง€์ •, ์ ‘๊ทผ ํ—ˆ์šฉ๋ฒ”์œ„ ๋ฐ ๊ธฐ๊ฐ„ ์„ค์ •, ๊ฐ•ํ™”๋œ ์ธ์ฆ, ๊ตฌ๊ฐ„ ์•”ํ˜ธํ™”, ์ ‘์†๋‹จ๋ง ๋ณด์•ˆ(๋ฐฑ์‹ , ํŒจ์น˜ ๋“ฑ) ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_mfa_enabled", - "cognito_user_pool_self_registration_disabled", - "workspaces_vpc_2private_1public_subnets_nat", - "workspaces_volume_encryption_enabled", - "iam_user_console_access_unused", - "iam_user_mfa_enabled_console_access", - "networkfirewall_in_all_vpc", - "vpc_subnet_no_public_ip_by_default", - "vpc_flow_logs_enabled", - "vpc_subnet_separate_private_public", - "appstream_fleet_maximum_session_duration", "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_maximum_session_duration", "appstream_fleet_session_disconnect_timeout", - "ec2_client_vpn_endpoint_connection_logging_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_ssh_exposed_to_internet", + "appstream_fleet_session_idle_disconnect_timeout", + "autoscaling_group_launch_configuration_requires_imdsv2", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_networkacl_allow_ingress_any_port", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_networkacl_allow_ingress_tcp_port_22" + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "vpc_vpn_connection_tunnels_up", + "workspaces_volume_encryption_enabled", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.6 ์›๊ฒฉ์ ‘๊ทผ ํ†ต์ œ", "AuditChecklist": [ "์ธํ„ฐ๋„ท๊ณผ ๊ฐ™์€ ์™ธ๋ถ€ ๋„คํŠธ์›Œํฌ๋ฅผ ํ†ตํ•œ ์ •๋ณด์‹œ์Šคํ…œ ์›๊ฒฉ์šด์˜์€ ์›์น™์ ์œผ๋กœ ๊ธˆ์ง€ํ•˜๊ณ  ์žฅ์• ๋Œ€์‘ ๋“ฑ ๋ถ€๋“์ดํ•˜๊ฒŒ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1900,30 +2106,62 @@ "Name": "์ธํ„ฐ๋„ท ์ ‘์† ํ†ต์ œ", "Description": "์ธํ„ฐ๋„ท์„ ํ†ตํ•œ ์ •๋ณด ์œ ์ถœ, ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ, ๋‚ด๋ถ€๋ง ์นจํˆฌ ๋“ฑ์„ ์˜ˆ๋ฐฉํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ฃผ์š” ์ •๋ณด์‹œ์Šคํ…œ, ์ฃผ์š” ์ง๋ฌด ์ˆ˜ํ–‰ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ทจ๊ธ‰ ๋‹จ๋ง๊ธฐ ๋“ฑ์— ๋Œ€ํ•œ ์ธํ„ฐ๋„ท ์ ‘์† ๋˜๋Š” ์„œ๋น„์Šค(P2P, ์›นํ•˜๋“œ, ๋ฉ”์‹ ์ € ๋“ฑ)๋ฅผ ์ œํ•œํ•˜๋Š” ๋“ฑ ์ธํ„ฐ๋„ท ์ ‘์† ํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_changes_to_network_acls_alarm_configured", - "workspaces_vpc_2private_1public_subnets_nat", - "workspaces_volume_encryption_enabled", - "networkfirewall_in_all_vpc", - "vpc_subnet_no_public_ip_by_default", - "vpc_flow_logs_enabled", - "vpc_subnet_separate_private_public", - "appstream_fleet_maximum_session_duration", + "apigateway_restapi_waf_acl_attached", "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", - "appstream_fleet_session_disconnect_timeout", - "route53_dangling_ip_subdomain_takeover", - "ec2_elastic_ip_unassigned", + "autoscaling_group_launch_configuration_no_public_ip", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "cloudfront_distributions_using_waf", + "dms_instance_no_public_access", "ec2_elastic_ip_shodan", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_public_ip" + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_public_ip", + "ecs_service_no_assign_public_ip", + "elb_internet_facing", + "elbv2_internet_facing", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_exposed", + "glue_data_catalogs_not_publicly_accessible", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "neptune_cluster_public_snapshot", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_multi_az", + "opensearch_service_domains_not_publicly_accessible", + "route53_dangling_ip_subdomain_takeover", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Subdomain": "2.6 ์ ‘๊ทผํ†ต์ œ", "Section": "2.6.7 ์ธํ„ฐ๋„ท ์ ‘์† ํ†ต์ œ", "AuditChecklist": [ "์ฃผ์š” ์ง๋ฌด ์ˆ˜ํ–‰ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ทจ๊ธ‰ ๋‹จ๋ง๊ธฐ ๋“ฑ ์—…๋ฌด์šฉ PC์˜ ์ธํ„ฐ๋„ท ์ ‘์†์— ๋Œ€ํ•œ ํ†ต์ œ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -1956,77 +2194,88 @@ "Name": "์•”ํ˜ธ์ •์ฑ… ์ ์šฉ", "Description": "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์œ„ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ๋ฐ˜์˜ํ•œ ์•”ํ˜ธํ™” ๋Œ€์ƒ, ์•”ํ˜ธ ๊ฐ•๋„, ์•”ํ˜ธ ์‚ฌ์šฉ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด์˜ ์ €์žฅยท์ „์†กยท์ „๋‹ฌ ์‹œ ์•”ํ˜ธํ™”๋ฅผ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "codebuild_project_no_secrets_in_variables", - "ssm_document_secrets", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_group_no_secrets_in_logs", - "glue_etl_jobs_amazon_s3_encryption_enabled", - "glue_development_endpoints_s3_encryption_enabled", - "glue_data_catalogs_metadata_encryption_enabled", - "glue_data_catalogs_connection_passwords_encryption_enabled", - "glue_development_endpoints_cloudwatch_logs_encryption_enabled", - "glue_database_connections_ssl_enabled", - "glue_etl_jobs_job_bookmark_encryption_enabled", - "glue_development_endpoints_job_bookmark_encryption_enabled", - "glue_etl_jobs_cloudwatch_logs_encryption_enabled", - "s3_bucket_kms_encryption", - "s3_bucket_default_encryption", - "s3_bucket_secure_transport_policy", - "documentdb_cluster_storage_encrypted", - "sns_subscription_not_using_http_endpoints", - "sns_topics_kms_encryption_at_rest_enabled", - "cloudfront_distributions_https_enabled", + "acm_certificates_expiration_check", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_cache_encrypted", + "athena_workgroup_encryption", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "backup_recovery_point_encrypted", + "cloudformation_stack_outputs_find_secrets", + "cloudfront_distributions_custom_ssl_certificate", "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_origin_traffic_encrypted", "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudwatch_log_group_no_secrets_in_logs", + "codebuild_project_no_secrets_in_variables", + "codebuild_project_s3_logs_encrypted", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "codebuild_report_group_export_encrypted", + "directoryservice_ldap_certificate_expiration", + "directoryservice_radius_server_security_protocol", + "dms_endpoint_ssl_enabled", + "documentdb_cluster_storage_encrypted", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_accelerator_cluster_in_transit_encryption_enabled", + "ec2_ebs_default_encryption", + "ec2_ebs_snapshots_encrypted", + "ec2_ebs_volume_encryption", + "ec2_instance_secrets_user_data", + "ec2_launch_template_no_secrets", + "ecs_task_definitions_no_environment_secrets", + "efs_encryption_at_rest_enabled", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "elb_ssl_listeners_use_acm_certificate", + "elbv2_insecure_ssl_ciphers", + "elbv2_nlb_tls_termination_enabled", + "elbv2_ssl_listeners", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_database_connections_ssl_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_ml_transform_encrypted_at_rest", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_in_transit_encryption_enabled", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_connector_in_transit_encryption_enabled", + "kinesis_stream_encrypted_at_rest", + "neptune_cluster_snapshot_encrypted", + "neptune_cluster_storage_encrypted", "opensearch_service_domains_encryption_at_rest_enabled", "opensearch_service_domains_https_communications_enforced", "opensearch_service_domains_node_to_node_encryption_enabled", - "neptune_cluster_storage_encrypted", - "dynamodb_accelerator_cluster_encryption_enabled", - "dynamodb_tables_kms_cmk_encryption_enabled", - "storagegateway_fileshare_encryption_enabled", - "ecs_task_definitions_no_environment_secrets", - "directoryservice_radius_server_security_protocol", - "workspaces_volume_encryption_enabled", - "elb_insecure_ssl_ciphers", - "elb_ssl_listeners", - "sqs_queues_server_side_encryption_enabled", - "cloudtrail_kms_encryption_enabled", - "awslambda_function_no_secrets_in_code", - "awslambda_function_no_secrets_in_variables", - "eks_cluster_kms_cmk_encryption_in_secrets_enabled", - "kafka_cluster_mutual_tls_authentication_enabled", - "kafka_cluster_encryption_at_rest_uses_cmk", - "kafka_cluster_in_transit_encryption_enabled", - "autoscaling_find_secrets_ec2_launch_configuration", - "elbv2_insecure_ssl_ciphers", - "elbv2_ssl_listeners", - "backup_vaults_exist", - "backup_vaults_encrypted", - "cloudformation_stack_outputs_find_secrets", - "elasticache_redis_cluster_in_transit_encryption_enabled", - "elasticache_redis_cluster_rest_encryption_enabled", + "rds_cluster_storage_encrypted", "rds_instance_storage_encrypted", - "rds_snapshots_encrypted", "rds_instance_transport_encrypted", - "apigateway_restapi_client_certificate_enabled", - "efs_encryption_at_rest_enabled", - "sagemaker_training_jobs_volume_and_output_encryption_enabled", - "sagemaker_training_jobs_intercontainer_encryption_enabled", + "rds_snapshots_encrypted", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_in_transit_encryption_enabled", + "s3_bucket_default_encryption", + "s3_bucket_secure_transport_policy", "sagemaker_notebook_instance_encryption_enabled", - "acm_certificates_with_secure_key_algorithms", - "athena_workgroup_enforce_configuration", - "athena_workgroup_encryption", - "ec2_instance_secrets_user_data", - "ec2_ebs_default_encryption", - "ec2_ebs_snapshots_encrypted", - "ec2_launch_template_no_secrets", - "ec2_ebs_volume_encryption" + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sns_subscription_not_using_http_endpoints", + "sqs_queues_server_side_encryption_enabled", + "ssm_document_secrets", + "transfer_server_in_transit_encryption_enabled" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.7. ์•”ํ˜ธํ™” ์ ์šฉ", + "Subdomain": "2.7 ์•”ํ˜ธํ™” ์ ์šฉ", "Section": "2.7.1 ์•”ํ˜ธ์ •์ฑ… ์ ์šฉ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด์˜ ๋ณดํ˜ธ๋ฅผ ์œ„ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ๋ฐ˜์˜ํ•œ ์•”ํ˜ธํ™” ๋Œ€์ƒ, ์•”ํ˜ธ๊ฐ•๋„, ์•”ํ˜ธ์‚ฌ์šฉ ๋“ฑ์ด ํฌํ•จ๋œ ์•”ํ˜ธ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2057,20 +2306,45 @@ "Name": "์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ", "Description": "์•”ํ˜ธํ‚ค์˜ ์•ˆ์ „ํ•œ ์ƒ์„ฑยท์ด์šฉยท๋ณด๊ด€ยท๋ฐฐํฌยทํŒŒ๊ธฐ๋ฅผ ์œ„ํ•œ ๊ด€๋ฆฌ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ํ•„์š” ์‹œ ๋ณต๊ตฌ๋ฐฉ์•ˆ์„ ๋งˆ๋ จํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "secretsmanager_automatic_rotation_enabled", - "kms_cmk_are_used", - "kms_key_not_publicly_accessible", - "kms_cmk_rotation_enabled", - "kms_cmk_not_deleted_unintentionally", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "athena_workgroup_encryption", + "backup_vaults_encrypted", + "bedrock_model_invocation_logs_encryption_enabled", + "cloudfront_distributions_custom_ssl_certificate", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_origin_traffic_encrypted", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudtrail_kms_encryption_enabled", + "cloudwatch_log_group_kms_encryption_enabled", "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "directoryservice_ldap_certificate_expiration", + "dms_endpoint_ssl_enabled", + "dynamodb_tables_kms_cmk_encryption_enabled", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "iam_no_expired_server_certificates_stored", + "iam_rotate_access_key_90_days", + "iam_user_accesskey_unused", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", "rds_instance_certificate_expiration", - "acm_certificates_transparency_logs_enabled" + "s3_bucket_kms_encryption", + "secretsmanager_automatic_rotation_enabled", + "secretsmanager_not_publicly_accessible", + "secretsmanager_secret_rotated_periodically", + "secretsmanager_secret_unused", + "sns_topics_kms_encryption_at_rest_enabled", + "storagegateway_fileshare_encryption_enabled", + "workspaces_volume_encryption_enabled" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.7. ์•”ํ˜ธํ™” ์ ์šฉ", + "Subdomain": "2.7 ์•”ํ˜ธํ™” ์ ์šฉ", "Section": "2.7.2 ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ", "AuditChecklist": [ "์•”ํ˜ธํ‚ค ์ƒ์„ฑ, ์ด์šฉ, ๋ณด๊ด€, ๋ฐฐํฌ, ๋ณ€๊ฒฝ, ๋ณต๊ตฌ, ํŒŒ๊ธฐ ๋“ฑ์— ๊ด€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2096,28 +2370,11 @@ "Id": "2.8.1", "Name": "๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ์ •์˜", "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ๋„์ž…ยท๊ฐœ๋ฐœยท๋ณ€๊ฒฝ ์‹œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ, ์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์ , ์•ˆ์ „ํ•œ ์ฝ”๋”ฉ๋ฐฉ๋ฒ• ๋“ฑ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์„ ์ •์˜ํ•˜๊ณ  ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "codebuild_project_no_secrets_in_variables", - "codebuild_project_user_controlled_buildspec", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "macie_is_enabled", - "inspector2_is_enabled", - "config_recorder_all_regions_enabled", - "fms_policy_compliant", - "wafv2_webacl_logging_enabled", - "accessanalyzer_enabled", - "wellarchitected_workload_no_high_or_medium_risks", - "cloudtrail_cloudwatch_logging_enabled", - "networkfirewall_in_all_vpc", - "vpc_flow_logs_enabled", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "securityhub_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Subdomain": "2.8 ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", "Section": "2.8.1 ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ์ •์˜", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์„ ์‹ ๊ทœ๋กœ ๋„์ž…ยท๊ฐœ๋ฐœ ๋˜๋Š” ๋ณ€๊ฒฝํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ธก๋ฉด์˜ ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ๋ฐ ์ธ์ˆ˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2144,31 +2401,11 @@ "Id": "2.8.2", "Name": "๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ๊ฒ€ํ†  ๋ฐ ์‹œํ—˜", "Description": "์‚ฌ์ „ ์ •์˜๋œ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ์ •๋ณด์‹œ์Šคํ…œ์ด ๋„์ž… ๋˜๋Š” ๊ตฌํ˜„๋˜์—ˆ๋Š”์ง€๋ฅผ ๊ฒ€ํ† ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜, ์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์  ์ ๊ฒ€, ์•ˆ์ „ํ•œ ์ฝ”๋”ฉ ๊ตฌํ˜„, ๊ฐœ์ธ์ •๋ณด ์˜ํ–ฅํ‰๊ฐ€ ๋“ฑ์˜ ๊ฒ€ํ†  ๊ธฐ์ค€๊ณผ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์— ๋Œ€ํ•œ ๊ฐœ์„ ์กฐ์น˜๋ฅผ ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "codebuild_project_no_secrets_in_variables", - "codebuild_project_user_controlled_buildspec", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "macie_is_enabled", - "inspector2_is_enabled", - "inspector2_active_findings_exist", - "config_recorder_all_regions_enabled", - "fms_policy_compliant", - "wafv2_webacl_logging_enabled", - "accessanalyzer_enabled_without_findings", - "accessanalyzer_enabled", - "wellarchitected_workload_no_high_or_medium_risks", - "cloudtrail_cloudwatch_logging_enabled", - "networkfirewall_in_all_vpc", - "vpc_flow_logs_enabled", - "guardduty_no_high_severity_findings", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "securityhub_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Subdomain": "2.8 ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", "Section": "2.8.2 ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ๊ฒ€ํ†  ๋ฐ ์‹œํ—˜", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์˜ ๋„์ž…, ๊ฐœ๋ฐœ, ๋ณ€๊ฒฝ ์‹œ ๋ถ„์„ ๋ฐ ์„ค๊ณ„ ๋‹จ๊ณ„์—์„œ ์ •์˜ํ•œ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์ด ํšจ๊ณผ์ ์œผ๋กœ ์ ์šฉ๋˜์—ˆ๋Š”์ง€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•œ ์‹œํ—˜์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2203,13 +2440,11 @@ "Id": "2.8.3", "Name": "์‹œํ—˜๊ณผ ์šด์˜ ํ™˜๊ฒฝ ๋ถ„๋ฆฌ", "Description": "๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ์‹œ์Šคํ…œ์€ ์šด์˜์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ ๋ฐ ๋ณ€๊ฒฝ์˜ ์œ„ํ—˜์„ ๊ฐ์†Œ์‹œํ‚ค๊ธฐ ์œ„ํ•˜์—ฌ ์›์น™์ ์œผ๋กœ ๋ถ„๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "codebuild_project_user_controlled_buildspec" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Subdomain": "2.8 ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", "Section": "2.8.3 ์‹œํ—˜๊ณผ ์šด์˜ ํ™˜๊ฒฝ ๋ถ„๋ฆฌ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ์‹œ์Šคํ…œ์„ ์šด์˜์‹œ์Šคํ…œ๊ณผ ๋ถ„๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2232,13 +2467,11 @@ "Id": "2.8.4", "Name": "์‹œํ—˜ ๋ฐ์ดํ„ฐ ๋ณด์•ˆ", "Description": "์‹œ์Šคํ…œ ์‹œํ—˜ ๊ณผ์ •์—์„œ ์šด์˜๋ฐ์ดํ„ฐ์˜ ์œ ์ถœ์„ ์˜ˆ๋ฐฉํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์‹œํ—˜ ๋ฐ์ดํ„ฐ์˜ ์ƒ์„ฑ๊ณผ ์ด์šฉ ๋ฐ ๊ด€๋ฆฌ, ํŒŒ๊ธฐ, ๊ธฐ์ˆ ์  ๋ณดํ˜ธ์กฐ์น˜์— ๊ด€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "codebuild_project_no_secrets_in_variables" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Subdomain": "2.8 ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", "Section": "2.8.4 ์‹œํ—˜ ๋ฐ์ดํ„ฐ ๋ณด์•ˆ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ๊ณผ์ •์—์„œ ์‹ค์ œ ์šด์˜ ๋ฐ์ดํ„ฐ์˜ ์‚ฌ์šฉ์„ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2264,13 +2497,13 @@ "Name": "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๊ด€๋ฆฌ", "Description": "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ์€ ์ธ๊ฐ€๋œ ์‚ฌ์šฉ์ž๋งŒ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ฆฌํ•˜๊ณ , ์šด์˜ํ™˜๊ฒฝ์— ๋ณด๊ด€ํ•˜์ง€ ์•Š๋Š” ๊ฒƒ์„ ์›์น™์œผ๋กœ ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "ecr_repositories_not_publicly_accessible", - "codeartifact_packages_external_public_publishing_disabled" + "codeartifact_packages_external_public_publishing_disabled", + "ecr_repositories_tag_immutability" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Subdomain": "2.8 ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", "Section": "2.8.5 ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๊ด€๋ฆฌ", "AuditChecklist": [ "๋น„์ธ๊ฐ€์ž์— ์˜ํ•œ ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2298,7 +2531,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Subdomain": "2.8 ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", "Section": "2.8.6 ์šด์˜ํ™˜๊ฒฝ ์ด๊ด€", "AuditChecklist": [ "์‹ ๊ทœ ๋„์ž…ยท๊ฐœ๋ฐœ ๋ฐ ๋ณ€๊ฒฝ๋œ ์‹œ์Šคํ…œ์„ ์šด์˜ํ™˜๊ฒฝ์œผ๋กœ ์•ˆ์ „ํ•˜๊ฒŒ ์ด๊ด€ํ•˜๊ธฐ ์œ„ํ•œ ํ†ต์ œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2323,26 +2556,11 @@ "Id": "2.9.1", "Name": "๋ณ€๊ฒฝ๊ด€๋ฆฌ", "Description": "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์ž์‚ฐ์˜ ๋ชจ๋“  ๋ณ€๊ฒฝ๋‚ด์—ญ์„ ๊ด€๋ฆฌํ•  ์ˆ˜ ์žˆ๋„๋ก ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ๋ณ€๊ฒฝ ์ „ ์‹œ์Šคํ…œ์˜ ์„ฑ๋Šฅ ๋ฐ ๋ณด์•ˆ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "codebuild_project_older_90_days", - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "config_recorder_all_regions_enabled", - "cloudtrail_cloudwatch_logging_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.1 ๋ณ€๊ฒฝ๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์ž์‚ฐ(ํ•˜๋“œ์›จ์–ด, ์šด์˜์ฒด์ œ, ์ƒ์šฉ ์†Œํ”„ํŠธ์›จ์–ด ํŒจํ‚ค์ง€ ๋“ฑ) ๋ณ€๊ฒฝ์— ๊ด€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2367,50 +2585,75 @@ "Name": "์„ฑ๋Šฅ ๋ฐ ์žฅ์• ๊ด€๋ฆฌ", "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐ€์šฉ์„ฑ ๋ณด์žฅ์„ ์œ„ํ•˜์—ฌ ์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰ ์š”๊ตฌ์‚ฌํ•ญ์„ ์ •์˜ํ•˜๊ณ  ํ˜„ํ™ฉ์„ ์ง€์†์ ์œผ๋กœ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์žฅ์•  ๋ฐœ์ƒ ์‹œ ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•˜๊ธฐ ์œ„ํ•œ ํƒ์ง€ยท๊ธฐ๋กยท๋ถ„์„ยท๋ณต๊ตฌยท๋ณด๊ณ  ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "kms_cmk_not_deleted_unintentionally", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "s3_bucket_no_mfa_delete", - "s3_bucket_cross_region_replication", - "documentdb_cluster_cloudwatch_log_export", - "documentdb_cluster_deletion_protection", - "config_recorder_all_regions_enabled", - "cognito_user_pool_deletion_protection_enabled", - "neptune_cluster_multi_az", - "neptune_cluster_deletion_protection", - "directoryservice_directory_monitor_notifications", - "directoryservice_ldap_certificate_expiration", - "elb_is_in_multiple_az", - "elb_cross_zone_load_balancing_enabled", - "cloudtrail_bucket_requires_mfa_delete", - "cloudtrail_multi_region_enabled_logging_management_events", - "cloudtrail_multi_region_enabled", - "iam_no_expired_server_certificates_stored", - "networkfirewall_deletion_protection", - "kafka_cluster_enhanced_monitoring_enabled", - "vpc_subnet_different_az", - "trustedadvisor_premium_support_plan_subscribed", - "trustedadvisor_errors_and_warnings", - "dms_instance_multi_az_enabled", + "acm_certificates_expiration_check", + "apigateway_restapi_tracing_enabled", + "autoscaling_group_capacity_rebalance_enabled", + "autoscaling_group_elb_health_check_enabled", "autoscaling_group_multiple_az", - "elbv2_is_in_multiple_az", - "elbv2_deletion_protection", + "autoscaling_group_multiple_instance_types", + "awslambda_function_vpc_multi_az", "cloudformation_stacks_termination_protection_enabled", + "cloudfront_distributions_s3_origin_non_existent_bucket", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "dms_instance_multi_az_enabled", + "documentdb_cluster_deletion_protection", + "documentdb_cluster_multi_az_enabled", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_deletion_protection_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ecs_cluster_container_insights_enabled", + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_logging_block_mode", + "elasticache_redis_cluster_automatic_failover_enabled", "elasticache_redis_cluster_multi_az_enabled", - "rds_instance_multi_az", - "rds_cluster_backtrack_enabled", - "rds_instance_enhanced_monitoring_enabled", - "rds_instance_deletion_protection", - "rds_instance_certificate_expiration", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elb_connection_draining_enabled", + "elb_cross_zone_load_balancing_enabled", + "elb_is_in_multiple_az", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_deletion_protection", + "elbv2_is_in_multiple_az", + "fsx_windows_file_system_multi_az_enabled", + "iam_no_expired_server_certificates_stored", + "kafka_cluster_enhanced_monitoring_enabled", + "kms_cmk_not_deleted_unintentionally", + "mq_broker_active_deployment_mode", + "mq_broker_cluster_deployment_mode", + "neptune_cluster_deletion_protection", + "neptune_cluster_multi_az", + "networkfirewall_deletion_protection", + "networkfirewall_multi_az", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", "rds_cluster_deletion_protection", "rds_cluster_multi_az", - "acm_certificates_expiration_check", - "route53_domains_transferlock_enabled", - "ec2_instance_detailed_monitoring_enabled" + "rds_instance_certificate_expiration", + "rds_instance_deletion_protection", + "rds_instance_deprecated_engine_version", + "rds_instance_multi_az", + "redshift_cluster_multi_az_enabled", + "s3_bucket_cross_region_replication", + "s3_bucket_no_mfa_delete", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "sagemaker_endpoint_config_prod_variant_instances", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "trustedadvisor_errors_and_warnings", + "trustedadvisor_premium_support_plan_subscribed", + "vpc_different_regions", + "vpc_endpoint_multi_az_enabled", + "vpc_subnet_different_az", + "vpc_vpn_connection_tunnels_up" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.2 ์„ฑ๋Šฅ ๋ฐ ์žฅ์• ๊ด€๋ฆฌ", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐ€์šฉ์„ฑ ๋ณด์žฅ์„ ์œ„ํ•˜์—ฌ ์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰์„ ์ง€์†์ ์œผ๋กœ ๋ชจ๋‹ˆํ„ฐ๋งํ•  ์ˆ˜ ์žˆ๋Š” ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2440,48 +2683,41 @@ "Name": "๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ๊ด€๋ฆฌ", "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐ€์šฉ์„ฑ๊ณผ ๋ฐ์ดํ„ฐ ๋ฌด๊ฒฐ์„ฑ์„ ์œ ์ง€ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ฐฑ์—… ๋Œ€์ƒ, ์ฃผ๊ธฐ, ๋ฐฉ๋ฒ•, ๋ณด๊ด€์žฅ์†Œ, ๋ณด๊ด€๊ธฐ๊ฐ„, ์†Œ์‚ฐ ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ์•„์šธ๋Ÿฌ ์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์ ์‹œ์— ๋ณต๊ตฌํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "s3_access_point_public_access_block", - "s3_bucket_lifecycle_enabled", - "s3_bucket_object_versioning", - "s3_bucket_kms_encryption", - "s3_bucket_public_write_acl", - "s3_bucket_policy_public_write_access", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_cross_region_replication", - "s3_bucket_default_encryption", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_public_snapshot", - "lightsail_instance_automated_snapshots", - "neptune_cluster_backup_enabled", - "neptune_cluster_public_snapshot", - "ecr_repositories_lifecycle_policy_enabled", - "dynamodb_tables_pitr_enabled", - "directoryservice_directory_snapshots_limit", - "redshift_cluster_automated_snapshot", - "dlm_ebs_snapshot_lifecycle_policy_exists", + "backup_plans_exist", + "backup_recovery_point_encrypted", "backup_reportplans_exist", "backup_vaults_exist", - "backup_vaults_encrypted", - "backup_plans_exist", - "elasticache_redis_cluster_backup_enabled", - "rds_cluster_copy_tags_to_snapshots", - "rds_instance_copy_tags_to_snapshots", - "rds_cluster_backtrack_enabled", - "rds_snapshots_public_access", - "rds_instance_backup_enabled", - "efs_have_backup_enabled", - "ec2_ebs_snapshot_account_block_public_access", - "ec2_ebs_public_snapshot", + "cloudfront_distributions_multiple_origin_failover_configured", + "directoryservice_directory_snapshots_limit", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "documentdb_cluster_backup_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_pitr_enabled", + "ec2_ebs_volume_protected_by_backup_plan", "ec2_ebs_volume_snapshots_exists", - "ec2_ebs_snapshots_encrypted", - "ec2_ami_public" + "efs_have_backup_enabled", + "elasticache_redis_cluster_backup_enabled", + "fsx_file_system_copy_tags_to_backups_enabled", + "lightsail_instance_automated_snapshots", + "neptune_cluster_backup_enabled", + "neptune_cluster_copy_tags_to_snapshots", + "neptune_cluster_public_snapshot", + "neptune_cluster_snapshot_encrypted", + "rds_cluster_backtrack_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_cluster_protected_by_backup_plan", + "rds_instance_backup_enabled", + "rds_instance_copy_tags_to_snapshots", + "rds_instance_protected_by_backup_plan", + "rds_snapshots_encrypted", + "rds_snapshots_public_access", + "redshift_cluster_automated_snapshot", + "s3_bucket_lifecycle_enabled" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.3 ๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ๊ด€๋ฆฌ", "AuditChecklist": [ "๋ฐฑ์—… ๋Œ€์ƒ, ์ฃผ๊ธฐ, ๋ฐฉ๋ฒ•, ์ ˆ์ฐจ ๋“ฑ์ด ํฌํ•จ๋œ ๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2511,92 +2747,81 @@ "Name": "๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ๊ด€๋ฆฌ", "Description": "์„œ๋ฒ„, ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ๋ณด์•ˆ์‹œ์Šคํ…œ, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ์ ‘์†๊ธฐ๋ก, ์‹œ์Šคํ…œ๋กœ๊ทธ, ๊ถŒํ•œ๋ถ€์—ฌ ๋‚ด์—ญ ๋“ฑ์˜ ๋กœ๊ทธ์œ ํ˜•, ๋ณด์กด๊ธฐ๊ฐ„, ๋ณด์กด๋ฐฉ๋ฒ• ๋“ฑ์„ ์ •ํ•˜๊ณ  ์œ„ยท๋ณ€์กฐ, ๋„๋‚œ, ๋ถ„์‹ค๋˜์ง€ ์•Š๋„๋ก ์•ˆ์ „ํ•˜๊ฒŒ ๋ณด์กดยท๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "eventbridge_bus_exposed", - "eventbridge_bus_cross_account_access", - "eventbridge_schema_registry_cross_account_access", - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_group_no_secrets_in_logs", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "glue_development_endpoints_cloudwatch_logs_encryption_enabled", - "glue_etl_jobs_cloudwatch_logs_encryption_enabled", - "s3_access_point_public_access_block", - "s3_bucket_server_access_logging_enabled", - "s3_bucket_kms_encryption", - "s3_bucket_public_write_acl", - "s3_bucket_policy_public_write_access", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_default_encryption", - "s3_account_level_public_access_blocks", - "s3_bucket_level_public_access_block", - "documentdb_cluster_cloudwatch_log_export", - "macie_is_enabled", - "inspector2_is_enabled", - "config_recorder_all_regions_enabled", + "acm_certificates_transparency_logs_enabled", + "apigateway_restapi_logging_enabled", + "apigatewayv2_api_access_logging_enabled", + "athena_workgroup_logging_enabled", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "bedrock_model_invocation_logging_enabled", + "bedrock_model_invocation_logs_encryption_enabled", + "cloudformation_stack_outputs_find_secrets", "cloudfront_distributions_logging_enabled", - "wafv2_webacl_logging_enabled", - "opensearch_service_domains_audit_logging_enabled", - "opensearch_service_domains_cloudwatch_logging_enabled", - "directoryservice_directory_log_forwarding_enabled", - "directoryservice_directory_monitor_notifications", - "elb_logging_enabled", - "redshift_cluster_audit_logging", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", "cloudtrail_insights_exist", + "cloudtrail_log_file_validation_enabled", "cloudtrail_logs_s3_bucket_access_logging_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", "cloudtrail_multi_region_enabled_logging_management_events", "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_log_file_validation_enabled", "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_multi_region_enabled", - "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_securityaudit_role_created", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "codebuild_project_logging_enabled", + "codebuild_project_s3_logs_encrypted", + "config_recorder_all_regions_enabled", + "datasync_task_logging_enabled", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "documentdb_cluster_cloudwatch_log_export", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_enabled", "eks_control_plane_logging_all_types_enabled", - "apigatewayv2_api_access_logging_enabled", - "kafka_cluster_enhanced_monitoring_enabled", - "vpc_flow_logs_enabled", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "trustedadvisor_premium_support_plan_subscribed", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elb_logging_enabled", "elbv2_logging_enabled", - "securityhub_enabled", + "eventbridge_global_endpoint_event_replication_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_logging_enabled", + "kafka_cluster_enhanced_monitoring_enabled", + "mq_broker_logging_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "networkfirewall_logging_enabled", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "rds_cluster_critical_event_subscription", + "rds_cluster_integration_cloudwatch_logs", + "rds_instance_critical_event_subscription", "rds_instance_enhanced_monitoring_enabled", - "rds_snapshots_public_access", - "rds_snapshots_encrypted", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", "rds_instance_integration_cloudwatch_logs", - "apigateway_restapi_logging_enabled", - "efs_not_publicly_accessible", - "acm_certificates_transparency_logs_enabled", + "redshift_cluster_audit_logging", "route53_public_hosted_zones_cloudwatch_logging_enabled", - "ec2_instance_detailed_monitoring_enabled", - "ec2_ebs_snapshot_account_block_public_access", - "ec2_instance_managed_by_ssm", - "ec2_ebs_public_snapshot", - "ec2_ebs_snapshots_encrypted", - "ec2_client_vpn_endpoint_connection_logging_enabled" + "s3_bucket_server_access_logging_enabled", + "vpc_flow_logs_enabled", + "waf_global_webacl_logging_enabled", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.4 ๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ๊ด€๋ฆฌ", "AuditChecklist": [ "์„œ๋ฒ„, ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ๋ณด์•ˆ์‹œ์Šคํ…œ, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋กœ๊ทธ๊ด€๋ฆฌ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ด์— ๋”ฐ๋ผ ํ•„์š”ํ•œ ๋กœ๊ทธ๋ฅผ ์ƒ์„ฑํ•˜์—ฌ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2628,38 +2853,11 @@ "Id": "2.9.5", "Name": "๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ์ ๊ฒ€", "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ์ •์ƒ์ ์ธ ์‚ฌ์šฉ์„ ๋ณด์žฅํ•˜๊ณ  ์‚ฌ์šฉ์ž ์˜คยท๋‚จ์šฉ(๋น„์ธ๊ฐ€์ ‘์†, ๊ณผ๋‹ค์กฐํšŒ ๋“ฑ)์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ ‘๊ทผ ๋ฐ ์‚ฌ์šฉ์— ๋Œ€ํ•œ ๋กœ๊ทธ ๊ฒ€ํ† ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๋ฉฐ, ๋ฌธ์ œ ๋ฐœ์ƒ ์‹œ ์‚ฌํ›„์กฐ์น˜๋ฅผ ์ ์‹œ์— ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_group_no_secrets_in_logs", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "inspector2_active_findings_exist", - "cognito_user_pool_client_prevent_user_existence_errors", - "accessanalyzer_enabled_without_findings", - "cloudtrail_insights_exist", - "cloudtrail_threat_detection_enumeration", - "guardduty_no_high_severity_findings", - "trustedadvisor_errors_and_warnings" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.5 ๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ์ ๊ฒ€", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์˜ค๋ฅ˜, ์˜คยท๋‚จ์šฉ(๋น„์ธ๊ฐ€์ ‘์†, ๊ณผ๋‹ค์กฐํšŒ ๋“ฑ), ๋ถ€์ •ํ–‰์œ„ ๋“ฑ ์ด์ƒ์ง•ํ›„๋ฅผ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋กœ๊ทธ ๊ฒ€ํ†  ์ฃผ๊ธฐ, ๋Œ€์ƒ, ๋ฐฉ๋ฒ• ๋“ฑ์„ ํฌํ•จํ•œ ๋กœ๊ทธ ๊ฒ€ํ†  ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2694,7 +2892,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.6 ์‹œ๊ฐ„ ๋™๊ธฐํ™”", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ์˜ ์‹œ๊ฐ„์„ ํ‘œ์ค€์‹œ๊ฐ„์œผ๋กœ ๋™๊ธฐํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2720,7 +2918,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Subdomain": "2.9 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", "Section": "2.9.7 ์ •๋ณด์ž์‚ฐ์˜ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐ", "AuditChecklist": [ "์ •๋ณด์ž์‚ฐ์˜ ์•ˆ์ „ํ•œ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐ์— ๋Œ€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2753,86 +2951,106 @@ "Name": "๋ณด์•ˆ์‹œ์Šคํ…œ ์šด์˜", "Description": "๋ณด์•ˆ์‹œ์Šคํ…œ ์œ ํ˜•๋ณ„๋กœ ๊ด€๋ฆฌ์ž ์ง€์ •, ์ตœ์‹  ์ •์ฑ… ์—…๋ฐ์ดํŠธ, ๋ฃฐ์…‹ ๋ณ€๊ฒฝ, ์ด๋ฒคํŠธ ๋ชจ๋‹ˆํ„ฐ๋ง ๋“ฑ์˜ ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ๋ณด์•ˆ์‹œ์Šคํ…œ๋ณ„ ์ •์ฑ…์ ์šฉ ํ˜„ํ™ฉ์„ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "organizations_delegated_administrators", + "apigateway_restapi_waf_acl_attached", + "autoscaling_group_multiple_az", + "autoscaling_group_multiple_instance_types", + "cloudfront_distributions_using_waf", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_kms_encryption_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cognito_user_pool_waf_acl_attached", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", + "dms_instance_minor_version_upgrade_enabled", + "dms_instance_multi_az_enabled", + "dms_instance_no_public_access", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_instance_managed_by_ssm", + "elbv2_waf_acl_attached", + "fms_policy_compliant", + "guardduty_centrally_managed", + "guardduty_ec2_malware_protection_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", + "guardduty_is_enabled", + "guardduty_lambda_protection_enabled", + "guardduty_no_high_severity_findings", + "guardduty_rds_protection_enabled", + "guardduty_s3_protection_enabled", + "inspector2_active_findings_exist", + "inspector2_is_enabled", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", + "macie_automated_sensitive_data_discovery_enabled", + "macie_is_enabled", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_logging_enabled", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "securityhub_enabled", + "shield_advanced_protection_in_associated_elastic_ips", "shield_advanced_protection_in_classic_load_balancers", - "shield_advanced_protection_in_route53_hosted_zones", "shield_advanced_protection_in_cloudfront_distributions", "shield_advanced_protection_in_global_accelerators", - "shield_advanced_protection_in_associated_elastic_ips", "shield_advanced_protection_in_internet_facing_load_balancers", - "ssm_managed_compliant_patching", - "secretsmanager_automatic_rotation_enabled", - "kms_cmk_are_used", - "kms_key_not_publicly_accessible", - "kms_cmk_rotation_enabled", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "macie_is_enabled", - "inspector2_is_enabled", - "inspector2_active_findings_exist", - "config_recorder_all_regions_enabled", - "cognito_user_pool_waf_acl_attached", - "fms_policy_compliant", - "ssmincidents_enabled_with_plans", - "cloudfront_distributions_using_waf", - "wafv2_webacl_logging_enabled", - "guardduty_no_high_severity_findings", - "guardduty_is_enabled", - "guardduty_centrally_managed", + "shield_advanced_protection_in_route53_hosted_zones", "trustedadvisor_errors_and_warnings", - "elbv2_waf_acl_attached", - "securityhub_enabled", - "apigateway_restapi_waf_acl_attached", - "ec2_instance_port_ldap_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_securitygroup_from_launch_wizard", - "ec2_securitygroup_not_used", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_networkacl_allow_ingress_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "trustedadvisor_premium_support_plan_subscribed", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_logging_enabled", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled", + "wafv2_webacl_with_rules" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.1 ๋ณด์•ˆ์‹œ์Šคํ…œ ์šด์˜", "AuditChecklist": [ "์กฐ์ง์—์„œ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š” ๋ณด์•ˆ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2869,11 +3087,563 @@ "Id": "2.10.2", "Name": "ํด๋ผ์šฐ๋“œ ๋ณด์•ˆ", "Description": "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ์ด์šฉ ์‹œ ์„œ๋น„์Šค ์œ ํ˜•(SaaS, PaaS, IaaS ๋“ฑ)์— ๋”ฐ๋ฅธ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ, ์„ค์ • ์˜ค๋ฅ˜ ๋“ฑ์— ๋”ฐ๋ผ ์ค‘์š”์ •๋ณด์™€ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ์œ ยท๋…ธ์ถœ๋˜์ง€ ์•Š๋„๋ก ๊ด€๋ฆฌ์ž ์ ‘๊ทผ ๋ฐ ๋ณด์•ˆ ์„ค์ • ๋“ฑ์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_cache_encrypted", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_logging_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_tracing_enabled", + "apigateway_restapi_waf_acl_attached", + "apigatewayv2_api_access_logging_enabled", + "apigatewayv2_api_authorizers_enabled", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "athena_workgroup_encryption", + "athena_workgroup_enforce_configuration", + "athena_workgroup_logging_enabled", + "autoscaling_group_capacity_rebalance_enabled", + "autoscaling_group_elb_health_check_enabled", + "autoscaling_group_launch_configuration_no_public_ip", + "autoscaling_group_launch_configuration_requires_imdsv2", + "autoscaling_group_multiple_az", + "autoscaling_group_multiple_instance_types", + "autoscaling_group_using_ec2_launch_template", + "awslambda_function_inside_vpc", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "awslambda_function_using_supported_runtimes", + "awslambda_function_vpc_multi_az", + "backup_plans_exist", + "backup_recovery_point_encrypted", + "backup_reportplans_exist", + "backup_vaults_encrypted", + "backup_vaults_exist", + "bedrock_agent_guardrail_enabled", + "bedrock_guardrail_prompt_attack_filter_enabled", + "bedrock_guardrail_sensitive_information_filter_enabled", + "bedrock_model_invocation_logging_enabled", + "bedrock_model_invocation_logs_encryption_enabled", + "cloudformation_stack_outputs_find_secrets", + "cloudformation_stacks_termination_protection_enabled", + "cloudfront_distributions_custom_ssl_certificate", + "cloudfront_distributions_default_root_object", + "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_geo_restrictions_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_logging_enabled", + "cloudfront_distributions_multiple_origin_failover_configured", + "cloudfront_distributions_origin_traffic_encrypted", + "cloudfront_distributions_s3_origin_access_control", + "cloudfront_distributions_s3_origin_non_existent_bucket", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudfront_distributions_using_waf", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_kms_encryption_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "codeartifact_packages_external_public_publishing_disabled", + "codebuild_project_logging_enabled", + "codebuild_project_no_secrets_in_variables", + "codebuild_project_older_90_days", + "codebuild_project_s3_logs_encrypted", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "codebuild_project_user_controlled_buildspec", + "codebuild_report_group_export_encrypted", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_deletion_protection_enabled", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_password_policy_lowercase", + "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_number", + "cognito_user_pool_password_policy_symbol", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_self_registration_disabled", + "cognito_user_pool_temporary_password_expiration", + "cognito_user_pool_waf_acl_attached", + "config_recorder_all_regions_enabled", + "config_recorder_using_aws_service_role", + "datasync_task_logging_enabled", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "directoryservice_directory_snapshots_limit", + "directoryservice_ldap_certificate_expiration", + "directoryservice_radius_server_security_protocol", + "directoryservice_supported_mfa_radius_enabled", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", + "dms_instance_minor_version_upgrade_enabled", + "dms_instance_multi_az_enabled", + "dms_instance_no_public_access", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "documentdb_cluster_deletion_protection", + "documentdb_cluster_multi_az_enabled", + "documentdb_cluster_public_snapshot", + "documentdb_cluster_storage_encrypted", + "drs_job_exist", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_accelerator_cluster_in_transit_encryption_enabled", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_cross_account_access", + "dynamodb_table_deletion_protection_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_kms_cmk_encryption_enabled", + "dynamodb_tables_pitr_enabled", + "ec2_ami_public", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_ebs_default_encryption", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_ebs_snapshots_encrypted", + "ec2_ebs_volume_encryption", + "ec2_ebs_volume_protected_by_backup_plan", + "ec2_ebs_volume_snapshots_exists", + "ec2_elastic_ip_shodan", + "ec2_elastic_ip_unassigned", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ec2_instance_imdsv2_enabled", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_managed_by_ssm", + "ec2_instance_older_than_specific_days", + "ec2_instance_paravirtual_type", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_profile_attached", + "ec2_instance_public_ip", + "ec2_instance_secrets_user_data", + "ec2_instance_uses_single_eni", + "ec2_launch_template_no_public_ip", + "ec2_launch_template_no_secrets", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_default_restrict_traffic", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ecr_registry_scan_images_on_push_enabled", + "ecr_repositories_lifecycle_policy_enabled", + "ecr_repositories_not_publicly_accessible", + "ecr_repositories_scan_vulnerabilities_in_latest_image", + "ecr_repositories_tag_immutability", + "ecs_cluster_container_insights_enabled", + "ecs_service_fargate_latest_platform_version", + "ecs_service_no_assign_public_ip", + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_enabled", + "ecs_task_definitions_no_environment_secrets", + "ecs_task_definitions_no_privileged_containers", + "ecs_task_set_no_assign_public_ip", + "efs_access_point_enforce_root_directory", + "efs_access_point_enforce_user_identity", + "efs_encryption_at_rest_enabled", + "efs_have_backup_enabled", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "eks_cluster_network_policy_enabled", + "eks_cluster_not_publicly_accessible", + "eks_cluster_private_nodes_enabled", + "eks_cluster_uses_a_supported_version", + "eks_control_plane_logging_all_types_enabled", + "elasticache_cluster_uses_public_subnet", + "elasticache_redis_cluster_auto_minor_version_upgrades", + "elasticache_redis_cluster_automatic_failover_enabled", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "elasticache_redis_replication_group_auth_enabled", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elasticbeanstalk_environment_managed_updates_enabled", + "elb_connection_draining_enabled", + "elb_cross_zone_load_balancing_enabled", + "elb_desync_mitigation_mode", + "elb_insecure_ssl_ciphers", + "elb_internet_facing", + "elb_is_in_multiple_az", + "elb_logging_enabled", + "elb_ssl_listeners", + "elb_ssl_listeners_use_acm_certificate", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_deletion_protection", + "elbv2_desync_mitigation_mode", + "elbv2_insecure_ssl_ciphers", + "elbv2_internet_facing", + "elbv2_is_in_multiple_az", + "elbv2_listeners_underneath", + "elbv2_logging_enabled", + "elbv2_nlb_tls_termination_enabled", + "elbv2_ssl_listeners", + "elbv2_waf_acl_attached", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_cross_account_access", + "eventbridge_bus_exposed", + "eventbridge_global_endpoint_event_replication_enabled", + "eventbridge_schema_registry_cross_account_access", + "fms_policy_compliant", + "fsx_file_system_copy_tags_to_backups_enabled", + "fsx_file_system_copy_tags_to_volumes_enabled", + "fsx_windows_file_system_multi_az_enabled", + "glacier_vaults_policy_public_access", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_data_catalogs_not_publicly_accessible", + "glue_database_connections_ssl_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_etl_jobs_logging_enabled", + "glue_ml_transform_encrypted_at_rest", + "guardduty_centrally_managed", + "guardduty_ec2_malware_protection_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", + "guardduty_is_enabled", + "guardduty_lambda_protection_enabled", + "guardduty_no_high_severity_findings", + "guardduty_rds_protection_enabled", + "guardduty_s3_protection_enabled", + "iam_administrator_access_with_mfa", + "iam_avoid_root_usage", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_check_saml_providers_sts", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_no_expired_server_certificates_stored", + "iam_no_root_access_key", + "iam_password_policy_expires_passwords_within_90_days_or_less", + "iam_password_policy_lowercase", + "iam_password_policy_minimum_length_14", + "iam_password_policy_number", + "iam_password_policy_reuse_24", + "iam_password_policy_symbol", + "iam_password_policy_uppercase", + "iam_policy_allows_privilege_escalation", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_rotate_access_key_90_days", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_accesskey_unused", + "iam_user_administrator_access_policy", + "iam_user_console_access_unused", + "iam_user_hardware_mfa_enabled", + "iam_user_mfa_enabled_console_access", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "iam_user_with_temporary_credentials", + "inspector2_active_findings_exist", + "inspector2_is_enabled", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_enhanced_monitoring_enabled", + "kafka_cluster_in_transit_encryption_enabled", + "kafka_cluster_is_public", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_unrestricted_access_disabled", + "kafka_cluster_uses_latest_version", + "kafka_connector_in_transit_encryption_enabled", + "kinesis_stream_encrypted_at_rest", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", + "lightsail_database_public", + "lightsail_instance_automated_snapshots", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "macie_automated_sensitive_data_discovery_enabled", + "macie_is_enabled", + "mq_broker_active_deployment_mode", + "mq_broker_auto_minor_version_upgrades", + "mq_broker_cluster_deployment_mode", + "mq_broker_logging_enabled", + "neptune_cluster_backup_enabled", + "neptune_cluster_copy_tags_to_snapshots", + "neptune_cluster_deletion_protection", + "neptune_cluster_iam_authentication_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "neptune_cluster_multi_az", + "neptune_cluster_public_snapshot", + "neptune_cluster_snapshot_encrypted", + "neptune_cluster_storage_encrypted", + "neptune_cluster_uses_public_subnet", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_logging_enabled", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "opensearch_service_domains_encryption_at_rest_enabled", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_node_to_node_encryption_enabled", + "opensearch_service_domains_not_publicly_accessible", + "opensearch_service_domains_updated_to_the_latest_service_software_version", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "organizations_account_part_of_organizations", + "organizations_delegated_administrators", + "organizations_opt_out_ai_services_policy", + "organizations_scp_check_deny_regions", + "organizations_tags_policies_enabled_and_attached", + "rds_cluster_backtrack_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_cluster_critical_event_subscription", + "rds_cluster_default_admin", + "rds_cluster_deletion_protection", + "rds_cluster_iam_authentication_enabled", + "rds_cluster_integration_cloudwatch_logs", + "rds_cluster_minor_version_upgrade_enabled", + "rds_cluster_multi_az", + "rds_cluster_non_default_port", + "rds_cluster_protected_by_backup_plan", + "rds_cluster_storage_encrypted", + "rds_instance_backup_enabled", + "rds_instance_certificate_expiration", + "rds_instance_copy_tags_to_snapshots", + "rds_instance_critical_event_subscription", + "rds_instance_default_admin", + "rds_instance_deletion_protection", + "rds_instance_deprecated_engine_version", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", + "rds_instance_iam_authentication_enabled", + "rds_instance_inside_vpc", + "rds_instance_integration_cloudwatch_logs", + "rds_instance_minor_version_upgrade_enabled", + "rds_instance_multi_az", + "rds_instance_no_public_access", + "rds_instance_non_default_port", + "rds_instance_protected_by_backup_plan", + "rds_instance_storage_encrypted", + "rds_instance_transport_encrypted", + "rds_snapshots_encrypted", + "rds_snapshots_public_access", + "redshift_cluster_audit_logging", + "redshift_cluster_automated_snapshot", + "redshift_cluster_automatic_upgrades", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_in_transit_encryption_enabled", + "redshift_cluster_multi_az_enabled", + "redshift_cluster_non_default_database_name", + "redshift_cluster_non_default_username", + "redshift_cluster_public_access", + "resourceexplorer2_indexes_found", + "route53_dangling_ip_subdomain_takeover", + "route53_domains_privacy_protection_enabled", + "route53_domains_transferlock_enabled", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "s3_access_point_public_access_block", + "s3_account_level_public_access_blocks", + "s3_bucket_acl_prohibited", + "s3_bucket_cross_account_access", + "s3_bucket_cross_region_replication", + "s3_bucket_default_encryption", + "s3_bucket_event_notifications_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_level_public_access_block", + "s3_bucket_lifecycle_enabled", + "s3_bucket_no_mfa_delete", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "s3_bucket_secure_transport_policy", + "s3_bucket_server_access_logging_enabled", + "s3_multi_region_access_point_public_access_block", + "sagemaker_endpoint_config_prod_variant_instances", + "sagemaker_models_network_isolation_enabled", + "sagemaker_models_vpc_settings_configured", + "sagemaker_notebook_instance_encryption_enabled", + "sagemaker_notebook_instance_root_access_disabled", + "sagemaker_notebook_instance_vpc_settings_configured", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sagemaker_training_jobs_vpc_settings_configured", + "secretsmanager_automatic_rotation_enabled", + "secretsmanager_not_publicly_accessible", + "secretsmanager_secret_rotated_periodically", + "secretsmanager_secret_unused", + "securityhub_enabled", + "ses_identity_not_publicly_accessible", + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones", + "sns_subscription_not_using_http_endpoints", + "sns_topics_kms_encryption_at_rest_enabled", + "sns_topics_not_publicly_accessible", + "sqs_queues_not_publicly_accessible", + "sqs_queues_server_side_encryption_enabled", + "ssm_document_secrets", + "ssm_documents_set_as_public", + "ssm_managed_compliant_patching", + "ssmincidents_enabled_with_plans", + "storagegateway_fileshare_encryption_enabled", + "transfer_server_in_transit_encryption_enabled", + "trustedadvisor_errors_and_warnings", + "trustedadvisor_premium_support_plan_subscribed", + "vpc_different_regions", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_endpoint_multi_az_enabled", + "vpc_endpoint_services_allowed_principals_trust_boundaries", + "vpc_flow_logs_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_different_az", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_logging_enabled", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled", + "wafv2_webacl_with_rules", + "wellarchitected_workload_no_high_or_medium_risks", + "workspaces_volume_encryption_enabled", + "workspaces_vpc_2private_1public_subnets_nat" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.2 ํด๋ผ์šฐ๋“œ ๋ณด์•ˆ", "AuditChecklist": [ "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ์ œ๊ณต์ž์™€ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์— ๋Œ€ํ•œ ์ฑ…์ž„๊ณผ ์—ญํ• ์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์ด๋ฅผ ๊ณ„์•ฝ์„œ(SLA ๋“ฑ)์— ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -2905,87 +3675,44 @@ "Name": "๊ณต๊ฐœ์„œ๋ฒ„ ๋ณด์•ˆ", "Description": "์™ธ๋ถ€ ๋„คํŠธ์›Œํฌ์— ๊ณต๊ฐœ๋˜๋Š” ์„œ๋ฒ„์˜ ๊ฒฝ์šฐ ๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ์™€ ๋ถ„๋ฆฌํ•˜๊ณ  ์ทจ์•ฝ์  ์ ๊ฒ€, ์ ‘๊ทผํ†ต์ œ, ์ธ์ฆ, ์ •๋ณด ์ˆ˜์ง‘ยท์ €์žฅยท๊ณต๊ฐœ ์ ˆ์ฐจ ๋“ฑ ๊ฐ•ํ™”๋œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "ssm_document_secrets", - "ssm_managed_compliant_patching", - "inspector2_active_findings_exist", - "cloudfront_distributions_https_enabled", - "cloudfront_distributions_using_deprecated_ssl_protocols", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_waf_acl_attached", + "cloudfront_distributions_s3_origin_non_existent_bucket", "cloudfront_distributions_using_waf", - "lightsail_instance_public", - "lightsail_database_public", - "lightsail_static_ip_unused", + "cognito_user_pool_waf_acl_attached", + "elb_desync_mitigation_mode", "elb_insecure_ssl_ciphers", + "elb_internet_facing", "elb_ssl_listeners", - "awslambda_function_no_secrets_in_code", - "awslambda_function_no_secrets_in_variables", - "awslambda_function_url_public", - "awslambda_function_url_cors_policy", - "awslambda_function_inside_vpc", - "awslambda_function_not_publicly_accessible", - "networkfirewall_in_all_vpc", - "apigatewayv2_api_authorizers_enabled", - "kafka_cluster_mutual_tls_authentication_enabled", - "vpc_subnet_separate_private_public", - "autoscaling_find_secrets_ec2_launch_configuration", - "elbv2_waf_acl_attached", + "elb_ssl_listeners_use_acm_certificate", "elbv2_desync_mitigation_mode", "elbv2_insecure_ssl_ciphers", + "elbv2_internet_facing", + "elbv2_listeners_underneath", + "elbv2_nlb_tls_termination_enabled", "elbv2_ssl_listeners", - "apigateway_restapi_public", - "apigateway_restapi_waf_acl_attached", - "apigateway_restapi_client_certificate_enabled", - "apigateway_restapi_authorizers_enabled", - "apigateway_restapi_public_with_authorizer", - "acm_certificates_expiration_check", + "elbv2_waf_acl_attached", + "lightsail_database_public", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "route53_dangling_ip_subdomain_takeover", "route53_domains_privacy_protection_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_instance_secrets_user_data", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_default_restrict_traffic", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_networkacl_allow_ingress_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_launch_template_no_secrets", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_instance_imdsv2_enabled", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_instance_port_telnet_exposed_to_internet" + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.3 ๊ณต๊ฐœ์„œ๋ฒ„ ๋ณด์•ˆ", "AuditChecklist": [ "๊ณต๊ฐœ์„œ๋ฒ„๋ฅผ ์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ์ด์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3015,7 +3742,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.4 ์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ๋ณด์•ˆ", "AuditChecklist": [ "์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ๊ฑฐ๋ž˜์˜ ์•ˆ์ „์„ฑ๊ณผ ์‹ ๋ขฐ์„ฑ ํ™•๋ณด๋ฅผ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3027,8 +3754,8 @@ "๊ฒฐ์ œ์‹œ์Šคํ…œ ์—ฐ๊ณ„ ์‹œ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ†  ๊ฒฐ๊ณผ" ], "NonComplianceCases": [ - "์‚ฌ๋ก€ 1 : ์ „์ž๊ฒฐ์ œ๋Œ€ํ–‰์—…์ฒด์™€ ์œ„ํƒ ๊ณ„์•ฝ์„ ๋งบ๊ณ  ์—ฐ๊ณ„๋ฅผ ํ•˜์˜€์œผ๋‚˜, ์ ์ ˆํ•œ ์ธ์ฆ ๋ฐ ์ ‘๊ทผ์ œํ•œ ์—†์ด ํŠน์ • URL์„ ํ†ตํ•˜์—ฌ ๊ฒฐ์ œ ๊ด€๋ จ ์ •๋ณด๊ฐ€ ๋ชจ๋‘ ํ‰๋ฌธ์œผ๋กœ ์ „์†ก๋˜๋Š” ๊ฒฝ์šฐ", - "์‚ฌ๋ก€ 2 : ์ „์ž๊ฒฐ์ œ๋Œ€ํ–‰์—…์ฒด์™€ ์™ธ๋ถ€ ์—ฐ๊ณ„ ์‹œ์Šคํ…œ์ด ์ „์šฉ๋ง์œผ๋กœ ์—ฐ๊ฒฐ๋˜์–ด ์žˆ์œผ๋‚˜, ํ•ด๋‹น ์—ฐ๊ณ„ ์‹œ์Šคํ…œ์—์„œ ๋‚ด๋ถ€ ์—…๋ฌด ์‹œ์Šคํ…œ์œผ๋กœ์˜ ์ ‘๊ทผ์ด ์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ ๋“ฑ์œผ๋กœ ์ ์ ˆํžˆ ํ†ต์ œ๋˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 1 : ์ „์ž๊ฒฐ์ œ๋Œ€ํ–‰์—…์ฒด์™€ ์œ„ํƒ ๊ณ„์•ฝ์„ ๋งบ๊ณ  ์—ฐ๊ณ„๋ฅผ ํ•˜์˜€์œผ๋‚˜, ์ ์ ˆํ•œ ์ธ์ฆ ๋ฐ ์ ‘๊ทผ์ œํ•œ ์—†์ด ํŠน์ • URL์„ ํ†ตํ•˜์—ฌ ๊ฒฐ์ œ ๊ด€๋ จ ์ •๋ณด๊ฐ€ ๋ชจ๋‘ ํ‰๋ฌธ์œผ๋กœ ์ „์†ก๋˜๋Š” ๊ฒฝ์šฐ,", + "์‚ฌ๋ก€ 2 : ์ „์ž๊ฒฐ์ œ๋Œ€ํ–‰์—…์ฒด์™€ ์™ธ๋ถ€ ์—ฐ๊ณ„ ์‹œ์Šคํ…œ์ด ์ „์šฉ๋ง์œผ๋กœ ์—ฐ๊ฒฐ๋˜์–ด ์žˆ์œผ๋‚˜, ํ•ด๋‹น ์—ฐ๊ณ„ ์‹œ์Šคํ…œ์—์„œ ๋‚ด๋ถ€ ์—…๋ฌด ์‹œ์Šคํ…œ์œผ๋กœ์˜ ์ ‘๊ทผ์ด ์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ ๋“ฑ์œผ๋กœ ์ ์ ˆํžˆ ํ†ต์ œ๋˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ,", "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ์™ธ๋ถ€ ํ•€ํ…Œํฌ ์„œ๋น„์Šค ์—ฐ๊ณ„ ์‹œ ์ •๋ณด๋ณดํ˜ธํŒ€์˜ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ† ๋ฅผ ๋ฐ›๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์ตœ๊ทผ์— ์‹ ๊ทœ ํ•€ํ…Œํฌ ์„œ๋น„์Šค๋ฅผ ์—ฐ๊ณ„ํ•˜๋ฉด์„œ ์ผ์ •์ƒ ์ด์œ ๋กœ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ† ๋ฅผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" ] } @@ -3038,29 +3765,11 @@ "Id": "2.10.5", "Name": "์ •๋ณด์ „์†ก ๋ณด์•ˆ", "Description": "๋‹ค๋ฅธ ์กฐ์ง์— ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ์ „์†กํ•  ๊ฒฝ์šฐ ์•ˆ์ „ํ•œ ์ „์†ก ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์กฐ์ง ๊ฐ„ ํ•ฉ์˜๋ฅผ ํ†ตํ•˜์—ฌ ๊ด€๋ฆฌ ์ฑ…์ž„, ์ „์†ก๋ฐฉ๋ฒ•, ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์œ„ํ•œ ๊ธฐ์ˆ ์  ๋ณดํ˜ธ์กฐ์น˜ ๋“ฑ์„ ํ˜‘์•ฝํ•˜๊ณ  ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "glue_database_connections_ssl_enabled", - "s3_bucket_secure_transport_policy", - "sns_subscription_not_using_http_endpoints", - "cloudfront_distributions_https_enabled", - "cloudfront_distributions_using_deprecated_ssl_protocols", - "opensearch_service_domains_https_communications_enforced", - "opensearch_service_domains_node_to_node_encryption_enabled", - "directoryservice_radius_server_security_protocol", - "elb_insecure_ssl_ciphers", - "elb_ssl_listeners", - "kafka_cluster_mutual_tls_authentication_enabled", - "kafka_cluster_in_transit_encryption_enabled", - "elbv2_insecure_ssl_ciphers", - "elbv2_ssl_listeners", - "elasticache_redis_cluster_in_transit_encryption_enabled", - "rds_instance_transport_encrypted", - "apigateway_restapi_client_certificate_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.5 ์ •๋ณด์ „์†ก ๋ณด์•ˆ", "AuditChecklist": [ "์™ธ๋ถ€ ์กฐ์ง์— ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ์ „์†กํ•  ๊ฒฝ์šฐ ์•ˆ์ „ํ•œ ์ „์†ก ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3083,18 +3792,11 @@ "Id": "2.10.6", "Name": "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ๊ธฐ ๋ณด์•ˆ", "Description": "PC, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ ๋“ฑ ๋‹จ๋ง๊ธฐ๊ธฐ๋ฅผ ์—…๋ฌด ๋ชฉ์ ์œผ๋กœ ๋„คํŠธ์›Œํฌ์— ์—ฐ๊ฒฐํ•  ๊ฒฝ์šฐ ๊ธฐ๊ธฐ ์ธ์ฆ ๋ฐ ์Šน์ธ, ์ ‘๊ทผ ๋ฒ”์œ„, ๊ธฐ๊ธฐ ๋ณด์•ˆ์„ค์ • ๋“ฑ์˜ ์ ‘๊ทผํ†ต์ œ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "workspaces_vpc_2private_1public_subnets_nat", - "workspaces_volume_encryption_enabled", - "appstream_fleet_maximum_session_duration", - "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_session_idle_disconnect_timeout", - "appstream_fleet_session_disconnect_timeout" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.6 ์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ๊ธฐ ๋ณด์•ˆ", "AuditChecklist": [ "PC, ๋…ธํŠธ๋ถ, ๊ฐ€์ƒPC, ํƒœ๋ธ”๋ฆฟ ๋“ฑ ์—…๋ฌด์— ์‚ฌ์šฉ๋˜๋Š” ๋‹จ๋ง๊ธฐ์— ๋Œ€ํ•˜์—ฌ ๊ธฐ๊ธฐ์ธ์ฆ, ์Šน์ธ, ์ ‘๊ทผ๋ฒ”์œ„ ์„ค์ •, ๊ธฐ๊ธฐ ๋ณด์•ˆ์„ค์ • ๋“ฑ์˜ ๋ณด์•ˆ ํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3130,7 +3832,7 @@ "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.7 ๋ณด์กฐ์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ", "AuditChecklist": [ "์™ธ์žฅํ•˜๋“œ, USB๋ฉ”๋ชจ๋ฆฌ, CD ๋“ฑ ๋ณด์กฐ์ €์žฅ๋งค์ฒด ์ทจ๊ธ‰(์‚ฌ์šฉ), ๋ณด๊ด€, ํ๊ธฐ, ์žฌ์‚ฌ์šฉ์— ๋Œ€ํ•œ ์ •์ฑ… ๋ฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3162,25 +3864,25 @@ "Name": "ํŒจ์น˜๊ด€๋ฆฌ", "Description": "์†Œํ”„ํŠธ์›จ์–ด, ์šด์˜์ฒด์ œ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ์˜ ์ทจ์•ฝ์ ์œผ๋กœ ์ธํ•œ ์นจํ•ด์‚ฌ๊ณ ๋ฅผ ์˜ˆ๋ฐฉํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ตœ์‹  ํŒจ์น˜๋ฅผ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋‹ค๋งŒ ์„œ๋น„์Šค ์˜ํ–ฅ์„ ๊ฒ€ํ† ํ•˜์—ฌ ์ตœ์‹  ํŒจ์น˜ ์ ์šฉ์ด ์–ด๋ ค์šธ ๊ฒฝ์šฐ ๋ณ„๋„์˜ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "ssm_managed_compliant_patching", - "cloudfront_distributions_using_deprecated_ssl_protocols", - "opensearch_service_domains_updated_to_the_latest_service_software_version", - "redshift_cluster_automatic_upgrades", "awslambda_function_using_supported_runtimes", - "eks_cluster_uses_a_supported_version", - "kafka_cluster_uses_latest_version", "dms_instance_minor_version_upgrade_enabled", + "ecs_service_fargate_latest_platform_version", + "eks_cluster_uses_a_supported_version", "elasticache_redis_cluster_auto_minor_version_upgrades", - "rds_instance_deprecated_engine_version", + "elasticbeanstalk_environment_managed_updates_enabled", + "kafka_cluster_uses_latest_version", + "mq_broker_auto_minor_version_upgrades", + "opensearch_service_domains_updated_to_the_latest_service_software_version", "rds_cluster_minor_version_upgrade_enabled", + "rds_instance_deprecated_engine_version", "rds_instance_minor_version_upgrade_enabled", - "ec2_instance_account_imdsv2_enabled", - "ec2_instance_older_than_specific_days" + "redshift_cluster_automatic_upgrades", + "ssm_managed_compliant_patching" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.8 ํŒจ์น˜๊ด€๋ฆฌ", "AuditChecklist": [ "์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ, PC ๋“ฑ ์ž์‚ฐ๋ณ„ ํŠน์„ฑ ๋ฐ ์ค‘์š”๋„์— ๋”ฐ๋ผ ์šด์˜์ฒด์ œ(OS)์™€ ์†Œํ”„ํŠธ์›จ์–ด์˜ ํŒจ์น˜๊ด€๋ฆฌ ์ •์ฑ… ๋ฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3210,11 +3912,13 @@ "Id": "2.10.9", "Name": "์•…์„ฑ์ฝ”๋“œ ํ†ต์ œ", "Description": "๋ฐ”์ด๋Ÿฌ์Šคยท์›œยทํŠธ๋กœ์ด๋ชฉ๋งˆยท๋žœ์„ฌ์›จ์–ด ๋“ฑ์˜ ์•…์„ฑ์ฝ”๋“œ๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด, ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์•…์„ฑ์ฝ”๋“œ ์˜ˆ๋ฐฉยทํƒ์ง€ยท๋Œ€์‘ ๋“ฑ์˜ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "guardduty_ec2_malware_protection_enabled" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Subdomain": "2.10 ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", "Section": "2.10.9 ์•…์„ฑ์ฝ”๋“œ ํ†ต์ œ", "AuditChecklist": [ "๋ฐ”์ด๋Ÿฌ์Šค, ์›œ, ํŠธ๋กœ์ด๋ชฉ๋งˆ, ๋žœ์„ฌ์›จ์–ด ๋“ฑ์˜ ์•…์„ฑ์ฝ”๋“œ๋กœ๋ถ€ํ„ฐ ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ์—…๋ฌด์šฉ๋‹จ๋ง๊ธฐ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3245,11 +3949,20 @@ "Id": "2.11.1", "Name": "์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘์ฒด๊ณ„ ๊ตฌ์ถ•", "Description": "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ ๋“ฑ์„ ์˜ˆ๋ฐฉํ•˜๊ณ  ์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์‹ ์†ํ•˜๊ณ  ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋‚ดยท์™ธ๋ถ€ ์นจํ•ด์‹œ๋„์˜ ํƒ์ง€ยท๋Œ€์‘ยท๋ถ„์„ ๋ฐ ๊ณต์œ ๋ฅผ ์œ„ํ•œ ์ฒด๊ณ„์™€ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ , ๊ด€๋ จ ์™ธ๋ถ€๊ธฐ๊ด€ ๋ฐ ์ „๋ฌธ๊ฐ€๋“ค๊ณผ ํ˜‘์กฐ์ฒด๊ณ„๋ฅผ ๊ตฌ์ถ•ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "acm_certificates_with_secure_key_algorithms", + "guardduty_centrally_managed", + "iam_support_role_created", + "ssmincidents_enabled_with_plans" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Subdomain": "2.11 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", "Section": "2.11.1 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘์ฒด๊ณ„ ๊ตฌ์ถ•", "AuditChecklist": [ "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ ๋ฅผ ์˜ˆ๋ฐฉํ•˜๊ณ  ์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์‹ ์†ํ•˜๊ณ  ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•˜๊ธฐ ์œ„ํ•œ ์ฒด๊ณ„์™€ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3281,34 +3994,562 @@ "Name": "์ทจ์•ฝ์  ์ ๊ฒ€ ๋ฐ ์กฐ์น˜", "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ์ทจ์•ฝ์ ์ด ๋…ธ์ถœ๋˜์–ด ์žˆ๋Š”์ง€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ •๊ธฐ์ ์œผ๋กœ ์ทจ์•ฝ์  ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•˜๊ณ , ๋ฐœ๊ฒฌ๋œ ์ทจ์•ฝ์ ์— ๋Œ€ํ•ด์„œ๋Š” ์‹ ์†ํ•˜๊ฒŒ ์กฐ์น˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์ ์˜ ๋ฐœ์ƒ ์—ฌ๋ถ€๋ฅผ ์ง€์†์ ์œผ๋กœ ํŒŒ์•…ํ•˜๊ณ , ์ •๋ณด์‹œ์Šคํ…œ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ ์กฐ์น˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "codebuild_project_no_secrets_in_variables", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "ssm_document_secrets", - "cloudwatch_log_group_no_secrets_in_logs", - "inspector2_is_enabled", - "inspector2_active_findings_exist", - "ecr_registry_scan_images_on_push_enabled", - "ecr_repositories_scan_images_on_push_enabled", - "ecr_repositories_scan_vulnerabilities_in_latest_image", - "ecs_task_definitions_no_environment_secrets", + "accessanalyzer_enabled", + "accessanalyzer_enabled_without_findings", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "account_security_questions_are_registered_in_the_aws_account", + "acm_certificates_expiration_check", + "acm_certificates_transparency_logs_enabled", + "acm_certificates_with_secure_key_algorithms", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_cache_encrypted", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_logging_enabled", + "apigateway_restapi_public", + "apigateway_restapi_public_with_authorizer", + "apigateway_restapi_tracing_enabled", + "apigateway_restapi_waf_acl_attached", + "apigatewayv2_api_access_logging_enabled", + "apigatewayv2_api_authorizers_enabled", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_session_disconnect_timeout", + "appstream_fleet_session_idle_disconnect_timeout", + "athena_workgroup_encryption", + "athena_workgroup_enforce_configuration", + "athena_workgroup_logging_enabled", + "autoscaling_group_capacity_rebalance_enabled", + "autoscaling_group_elb_health_check_enabled", + "autoscaling_group_launch_configuration_no_public_ip", + "autoscaling_group_launch_configuration_requires_imdsv2", + "autoscaling_group_multiple_az", + "autoscaling_group_multiple_instance_types", + "autoscaling_group_using_ec2_launch_template", + "awslambda_function_inside_vpc", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", "awslambda_function_no_secrets_in_code", "awslambda_function_no_secrets_in_variables", - "autoscaling_find_secrets_ec2_launch_configuration", - "guardduty_no_high_severity_findings", - "guardduty_is_enabled", - "guardduty_centrally_managed", - "trustedadvisor_premium_support_plan_subscribed", - "trustedadvisor_errors_and_warnings", - "securityhub_enabled", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "awslambda_function_using_supported_runtimes", + "awslambda_function_vpc_multi_az", + "backup_plans_exist", + "backup_recovery_point_encrypted", + "backup_reportplans_exist", + "backup_vaults_encrypted", + "backup_vaults_exist", + "bedrock_agent_guardrail_enabled", + "bedrock_guardrail_prompt_attack_filter_enabled", + "bedrock_guardrail_sensitive_information_filter_enabled", + "bedrock_model_invocation_logging_enabled", + "bedrock_model_invocation_logs_encryption_enabled", "cloudformation_stack_outputs_find_secrets", + "cloudformation_stacks_termination_protection_enabled", + "cloudfront_distributions_custom_ssl_certificate", + "cloudfront_distributions_default_root_object", + "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_geo_restrictions_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_https_sni_enabled", + "cloudfront_distributions_logging_enabled", + "cloudfront_distributions_multiple_origin_failover_configured", + "cloudfront_distributions_origin_traffic_encrypted", + "cloudfront_distributions_s3_origin_access_control", + "cloudfront_distributions_s3_origin_non_existent_bucket", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudfront_distributions_using_waf", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_kms_encryption_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_critical_pii_in_logs", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_group_not_publicly_accessible", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "codeartifact_packages_external_public_publishing_disabled", + "codebuild_project_logging_enabled", + "codebuild_project_no_secrets_in_variables", + "codebuild_project_older_90_days", + "codebuild_project_s3_logs_encrypted", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "codebuild_project_user_controlled_buildspec", + "codebuild_report_group_export_encrypted", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_deletion_protection_enabled", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_password_policy_lowercase", + "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_number", + "cognito_user_pool_password_policy_symbol", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_self_registration_disabled", + "cognito_user_pool_temporary_password_expiration", + "cognito_user_pool_waf_acl_attached", + "config_recorder_all_regions_enabled", + "config_recorder_using_aws_service_role", + "datasync_task_logging_enabled", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "directoryservice_directory_snapshots_limit", + "directoryservice_ldap_certificate_expiration", + "directoryservice_radius_server_security_protocol", + "directoryservice_supported_mfa_radius_enabled", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "dms_endpoint_mongodb_authentication_enabled", + "dms_endpoint_neptune_iam_authorization_enabled", + "dms_endpoint_ssl_enabled", + "dms_instance_minor_version_upgrade_enabled", + "dms_instance_multi_az_enabled", + "dms_instance_no_public_access", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "documentdb_cluster_deletion_protection", + "documentdb_cluster_multi_az_enabled", + "documentdb_cluster_public_snapshot", + "documentdb_cluster_storage_encrypted", + "drs_job_exist", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_accelerator_cluster_in_transit_encryption_enabled", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_cross_account_access", + "dynamodb_table_deletion_protection_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_kms_cmk_encryption_enabled", + "dynamodb_tables_pitr_enabled", + "ec2_ami_public", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_ebs_default_encryption", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_ebs_snapshots_encrypted", + "ec2_ebs_volume_encryption", + "ec2_ebs_volume_protected_by_backup_plan", + "ec2_ebs_volume_snapshots_exists", + "ec2_elastic_ip_shodan", + "ec2_elastic_ip_unassigned", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ec2_instance_imdsv2_enabled", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_instance_managed_by_ssm", + "ec2_instance_older_than_specific_days", + "ec2_instance_paravirtual_type", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_telnet_exposed_to_internet", + "ec2_instance_profile_attached", + "ec2_instance_public_ip", "ec2_instance_secrets_user_data", + "ec2_instance_uses_single_eni", + "ec2_launch_template_no_public_ip", "ec2_launch_template_no_secrets", - "ec2_instance_imdsv2_enabled" + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_default_restrict_traffic", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ecr_registry_scan_images_on_push_enabled", + "ecr_repositories_lifecycle_policy_enabled", + "ecr_repositories_not_publicly_accessible", + "ecr_repositories_scan_vulnerabilities_in_latest_image", + "ecr_repositories_tag_immutability", + "ecs_cluster_container_insights_enabled", + "ecs_service_fargate_latest_platform_version", + "ecs_service_no_assign_public_ip", + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_enabled", + "ecs_task_definitions_no_environment_secrets", + "ecs_task_definitions_no_privileged_containers", + "ecs_task_set_no_assign_public_ip", + "efs_access_point_enforce_root_directory", + "efs_access_point_enforce_user_identity", + "efs_encryption_at_rest_enabled", + "efs_have_backup_enabled", + "efs_mount_target_not_publicly_accessible", + "efs_not_publicly_accessible", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "eks_cluster_network_policy_enabled", + "eks_cluster_not_publicly_accessible", + "eks_cluster_private_nodes_enabled", + "eks_cluster_uses_a_supported_version", + "eks_control_plane_logging_all_types_enabled", + "elasticache_cluster_uses_public_subnet", + "elasticache_redis_cluster_auto_minor_version_upgrades", + "elasticache_redis_cluster_automatic_failover_enabled", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "elasticache_redis_replication_group_auth_enabled", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elasticbeanstalk_environment_managed_updates_enabled", + "elb_connection_draining_enabled", + "elb_cross_zone_load_balancing_enabled", + "elb_desync_mitigation_mode", + "elb_insecure_ssl_ciphers", + "elb_internet_facing", + "elb_is_in_multiple_az", + "elb_logging_enabled", + "elb_ssl_listeners", + "elb_ssl_listeners_use_acm_certificate", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_deletion_protection", + "elbv2_desync_mitigation_mode", + "elbv2_insecure_ssl_ciphers", + "elbv2_internet_facing", + "elbv2_is_in_multiple_az", + "elbv2_listeners_underneath", + "elbv2_logging_enabled", + "elbv2_nlb_tls_termination_enabled", + "elbv2_ssl_listeners", + "elbv2_waf_acl_attached", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "eventbridge_bus_cross_account_access", + "eventbridge_bus_exposed", + "eventbridge_global_endpoint_event_replication_enabled", + "eventbridge_schema_registry_cross_account_access", + "fms_policy_compliant", + "fsx_file_system_copy_tags_to_backups_enabled", + "fsx_file_system_copy_tags_to_volumes_enabled", + "fsx_windows_file_system_multi_az_enabled", + "glacier_vaults_policy_public_access", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_data_catalogs_not_publicly_accessible", + "glue_database_connections_ssl_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_etl_jobs_logging_enabled", + "glue_ml_transform_encrypted_at_rest", + "guardduty_centrally_managed", + "guardduty_ec2_malware_protection_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", + "guardduty_is_enabled", + "guardduty_lambda_protection_enabled", + "guardduty_no_high_severity_findings", + "guardduty_rds_protection_enabled", + "guardduty_s3_protection_enabled", + "iam_administrator_access_with_mfa", + "iam_avoid_root_usage", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_check_saml_providers_sts", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_inline_policy_no_full_access_to_kms", + "iam_no_custom_policy_permissive_role_assumption", + "iam_no_expired_server_certificates_stored", + "iam_no_root_access_key", + "iam_password_policy_expires_passwords_within_90_days_or_less", + "iam_password_policy_lowercase", + "iam_password_policy_minimum_length_14", + "iam_password_policy_number", + "iam_password_policy_reuse_24", + "iam_password_policy_symbol", + "iam_password_policy_uppercase", + "iam_policy_allows_privilege_escalation", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_cloudshell_admin_not_attached", + "iam_policy_no_full_access_to_cloudtrail", + "iam_policy_no_full_access_to_kms", + "iam_role_administratoraccess_policy", + "iam_role_cross_account_readonlyaccess_policy", + "iam_role_cross_service_confused_deputy_prevention", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_rotate_access_key_90_days", + "iam_securityaudit_role_created", + "iam_support_role_created", + "iam_user_accesskey_unused", + "iam_user_administrator_access_policy", + "iam_user_console_access_unused", + "iam_user_hardware_mfa_enabled", + "iam_user_mfa_enabled_console_access", + "iam_user_no_setup_initial_access_key", + "iam_user_two_active_access_key", + "iam_user_with_temporary_credentials", + "inspector2_active_findings_exist", + "inspector2_is_enabled", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_enhanced_monitoring_enabled", + "kafka_cluster_in_transit_encryption_enabled", + "kafka_cluster_is_public", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_unrestricted_access_disabled", + "kafka_cluster_uses_latest_version", + "kafka_connector_in_transit_encryption_enabled", + "kinesis_stream_encrypted_at_rest", + "kms_cmk_are_used", + "kms_cmk_not_deleted_unintentionally", + "kms_cmk_rotation_enabled", + "kms_key_not_publicly_accessible", + "lightsail_database_public", + "lightsail_instance_automated_snapshots", + "lightsail_instance_public", + "lightsail_static_ip_unused", + "macie_automated_sensitive_data_discovery_enabled", + "macie_is_enabled", + "mq_broker_active_deployment_mode", + "mq_broker_auto_minor_version_upgrades", + "mq_broker_cluster_deployment_mode", + "mq_broker_logging_enabled", + "neptune_cluster_backup_enabled", + "neptune_cluster_copy_tags_to_snapshots", + "neptune_cluster_deletion_protection", + "neptune_cluster_iam_authentication_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "neptune_cluster_multi_az", + "neptune_cluster_public_snapshot", + "neptune_cluster_snapshot_encrypted", + "neptune_cluster_storage_encrypted", + "neptune_cluster_uses_public_subnet", + "networkfirewall_deletion_protection", + "networkfirewall_in_all_vpc", + "networkfirewall_logging_enabled", + "networkfirewall_multi_az", + "networkfirewall_policy_default_action_fragmented_packets", + "networkfirewall_policy_default_action_full_packets", + "networkfirewall_policy_rule_group_associated", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "opensearch_service_domains_encryption_at_rest_enabled", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_node_to_node_encryption_enabled", + "opensearch_service_domains_not_publicly_accessible", + "opensearch_service_domains_updated_to_the_latest_service_software_version", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "organizations_account_part_of_organizations", + "organizations_delegated_administrators", + "organizations_opt_out_ai_services_policy", + "organizations_scp_check_deny_regions", + "organizations_tags_policies_enabled_and_attached", + "rds_cluster_backtrack_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_cluster_critical_event_subscription", + "rds_cluster_default_admin", + "rds_cluster_deletion_protection", + "rds_cluster_iam_authentication_enabled", + "rds_cluster_integration_cloudwatch_logs", + "rds_cluster_minor_version_upgrade_enabled", + "rds_cluster_multi_az", + "rds_cluster_non_default_port", + "rds_cluster_protected_by_backup_plan", + "rds_cluster_storage_encrypted", + "rds_instance_backup_enabled", + "rds_instance_certificate_expiration", + "rds_instance_copy_tags_to_snapshots", + "rds_instance_critical_event_subscription", + "rds_instance_default_admin", + "rds_instance_deletion_protection", + "rds_instance_deprecated_engine_version", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", + "rds_instance_iam_authentication_enabled", + "rds_instance_inside_vpc", + "rds_instance_integration_cloudwatch_logs", + "rds_instance_minor_version_upgrade_enabled", + "rds_instance_multi_az", + "rds_instance_no_public_access", + "rds_instance_non_default_port", + "rds_instance_protected_by_backup_plan", + "rds_instance_storage_encrypted", + "rds_instance_transport_encrypted", + "rds_snapshots_encrypted", + "rds_snapshots_public_access", + "redshift_cluster_audit_logging", + "redshift_cluster_automated_snapshot", + "redshift_cluster_automatic_upgrades", + "redshift_cluster_encrypted_at_rest", + "redshift_cluster_enhanced_vpc_routing", + "redshift_cluster_in_transit_encryption_enabled", + "redshift_cluster_multi_az_enabled", + "redshift_cluster_non_default_database_name", + "redshift_cluster_non_default_username", + "redshift_cluster_public_access", + "resourceexplorer2_indexes_found", + "route53_dangling_ip_subdomain_takeover", + "route53_domains_privacy_protection_enabled", + "route53_domains_transferlock_enabled", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "s3_access_point_public_access_block", + "s3_account_level_public_access_blocks", + "s3_bucket_acl_prohibited", + "s3_bucket_cross_account_access", + "s3_bucket_cross_region_replication", + "s3_bucket_default_encryption", + "s3_bucket_event_notifications_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_level_public_access_block", + "s3_bucket_lifecycle_enabled", + "s3_bucket_no_mfa_delete", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_public_write_acl", + "s3_bucket_secure_transport_policy", + "s3_bucket_server_access_logging_enabled", + "s3_multi_region_access_point_public_access_block", + "sagemaker_endpoint_config_prod_variant_instances", + "sagemaker_models_network_isolation_enabled", + "sagemaker_models_vpc_settings_configured", + "sagemaker_notebook_instance_encryption_enabled", + "sagemaker_notebook_instance_root_access_disabled", + "sagemaker_notebook_instance_vpc_settings_configured", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sagemaker_training_jobs_vpc_settings_configured", + "secretsmanager_automatic_rotation_enabled", + "secretsmanager_not_publicly_accessible", + "secretsmanager_secret_rotated_periodically", + "secretsmanager_secret_unused", + "securityhub_enabled", + "ses_identity_not_publicly_accessible", + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_internet_facing_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones", + "sns_subscription_not_using_http_endpoints", + "sns_topics_kms_encryption_at_rest_enabled", + "sns_topics_not_publicly_accessible", + "sqs_queues_not_publicly_accessible", + "sqs_queues_server_side_encryption_enabled", + "ssm_document_secrets", + "ssm_documents_set_as_public", + "ssm_managed_compliant_patching", + "ssmincidents_enabled_with_plans", + "storagegateway_fileshare_encryption_enabled", + "transfer_server_in_transit_encryption_enabled", + "trustedadvisor_errors_and_warnings", + "trustedadvisor_premium_support_plan_subscribed", + "vpc_different_regions", + "vpc_endpoint_connections_trust_boundaries", + "vpc_endpoint_for_ec2_enabled", + "vpc_endpoint_multi_az_enabled", + "vpc_endpoint_services_allowed_principals_trust_boundaries", + "vpc_flow_logs_enabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_different_az", + "vpc_subnet_no_public_ip_by_default", + "vpc_subnet_separate_private_public", + "vpc_vpn_connection_tunnels_up", + "waf_global_rule_with_conditions", + "waf_global_rulegroup_not_empty", + "waf_global_webacl_logging_enabled", + "waf_global_webacl_with_rules", + "waf_regional_rule_with_conditions", + "waf_regional_rulegroup_not_empty", + "waf_regional_webacl_with_rules", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled", + "wafv2_webacl_with_rules", + "wellarchitected_workload_no_high_or_medium_risks", + "workspaces_volume_encryption_enabled", + "workspaces_vpc_2private_1public_subnets_nat" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Subdomain": "2.11 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", "Section": "2.11.2 ์ทจ์•ฝ์  ์ ๊ฒ€ ๋ฐ ์กฐ์น˜", "AuditChecklist": [ "์ •๋ณด์‹œ์Šคํ…œ ์ทจ์•ฝ์  ์ ๊ฒ€ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ , ์ •๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3340,39 +4581,87 @@ "Name": "์ด์ƒํ–‰์œ„ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง", "Description": "๋‚ดยท์™ธ๋ถ€์— ์˜ํ•œ ์นจํ•ด์‹œ๋„, ๊ฐœ์ธ์ •๋ณด์œ ์ถœ ์‹œ๋„, ๋ถ€์ •ํ–‰์œ„ ๋“ฑ์„ ์‹ ์†ํ•˜๊ฒŒ ํƒ์ง€ยท๋Œ€์‘ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋„คํŠธ์›Œํฌ ๋ฐ ๋ฐ์ดํ„ฐ ํ๋ฆ„ ๋“ฑ์„ ์ˆ˜์ง‘ํ•˜์—ฌ ๋ถ„์„ํ•˜๋ฉฐ, ๋ชจ๋‹ˆํ„ฐ๋ง ๋ฐ ์ ๊ฒ€ ๊ฒฐ๊ณผ์— ๋”ฐ๋ฅธ ์‚ฌํ›„์กฐ์น˜๋Š” ์ ์‹œ์— ์ด๋ฃจ์–ด์ ธ์•ผ ํ•œ๋‹ค.", "Checks": [ - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "cloudwatch_changes_to_network_route_tables_alarm_configured", + "apigateway_restapi_logging_enabled", + "apigateway_restapi_public", + "apigateway_restapi_tracing_enabled", + "apigatewayv2_api_access_logging_enabled", + "athena_workgroup_logging_enabled", + "bedrock_model_invocation_logging_enabled", + "cloudfront_distributions_logging_enabled", + "cloudtrail_insights_exist", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_llm_jacking", + "cloudtrail_threat_detection_privilege_escalation", + "cloudwatch_alarm_actions_alarm_state_configured", + "cloudwatch_alarm_actions_enabled", + "cloudwatch_changes_to_network_acls_alarm_configured", "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_network_route_tables_alarm_configured", "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_log_metric_filter_authentication_failures", "cloudwatch_log_metric_filter_aws_organizations_changes", "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "cognito_user_pool_client_prevent_user_existence_errors", - "fms_policy_compliant", - "cloudtrail_insights_exist", - "cloudtrail_threat_detection_enumeration", - "networkfirewall_in_all_vpc", - "vpc_flow_logs_enabled", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "codebuild_project_logging_enabled", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "config_recorder_all_regions_enabled", + "datasync_task_logging_enabled", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "documentdb_cluster_cloudwatch_log_export", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_elastic_ip_shodan", + "ec2_instance_detailed_monitoring_enabled", + "ecs_cluster_container_insights_enabled", + "ecs_task_definitions_logging_enabled", + "eks_control_plane_logging_all_types_enabled", + "elasticbeanstalk_environment_cloudwatch_logging_enabled", + "elasticbeanstalk_environment_enhanced_health_reporting", + "elb_logging_enabled", + "elbv2_logging_enabled", + "glue_etl_jobs_logging_enabled", + "guardduty_eks_audit_log_enabled", + "guardduty_eks_runtime_monitoring_enabled", "guardduty_no_high_severity_findings", + "kafka_cluster_enhanced_monitoring_enabled", + "mq_broker_logging_enabled", + "neptune_cluster_integration_cloudwatch_logs", + "networkfirewall_logging_enabled", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "rds_cluster_critical_event_subscription", + "rds_cluster_integration_cloudwatch_logs", + "rds_instance_critical_event_subscription", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_event_subscription_parameter_groups", + "rds_instance_event_subscription_security_groups", + "rds_instance_integration_cloudwatch_logs", + "redshift_cluster_audit_logging", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "s3_bucket_event_notifications_enabled", + "s3_bucket_server_access_logging_enabled", "trustedadvisor_errors_and_warnings", - "securityhub_enabled" + "vpc_flow_logs_enabled", + "waf_global_webacl_logging_enabled", + "wafv2_webacl_logging_enabled", + "wafv2_webacl_rule_logging_enabled" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Subdomain": "2.11 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", "Section": "2.11.3 ์ด์ƒํ–‰์œ„ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง", "AuditChecklist": [ "๋‚ดยท์™ธ๋ถ€์— ์˜ํ•œ ์นจํ•ด์‹œ๋„, ๊ฐœ์ธ์ •๋ณด์œ ์ถœ ์‹œ๋„, ๋ถ€์ •ํ–‰์œ„ ๋“ฑ ์ด์ƒํ–‰์œ„๋ฅผ ํƒ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์ฃผ์š” ์ •๋ณด์‹œ์Šคํ…œ, ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ๋„คํŠธ์›Œํฌ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ์—์„œ ๋ฐœ์ƒํ•œ ๋„คํŠธ์›Œํฌ ํŠธ๋ž˜ํ”ฝ, ๋ฐ์ดํ„ฐ ํ๋ฆ„, ์ด๋ฒคํŠธ ๋กœ๊ทธ ๋“ฑ์„ ์ˆ˜์ง‘ํ•˜์—ฌ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3398,13 +4687,11 @@ "Id": "2.11.4", "Name": "์‚ฌ๊ณ  ๋Œ€์‘ ํ›ˆ๋ จ ๋ฐ ๊ฐœ์„ ", "Description": "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ๋ฅผ ์ž„์ง์›๊ณผ ์ดํ•ด๊ด€๊ณ„์ž๊ฐ€ ์ˆ™์ง€ํ•˜๋„๋ก ์‹œ๋‚˜๋ฆฌ์˜ค์— ๋”ฐ๋ฅธ ๋ชจ์˜ํ›ˆ๋ จ์„ ์—ฐ 1ํšŒ ์ด์ƒ ์‹ค์‹œํ•˜๊ณ  ํ›ˆ๋ จ๊ฒฐ๊ณผ๋ฅผ ๋ฐ˜์˜ํ•˜์—ฌ ๋Œ€์‘์ฒด๊ณ„๋ฅผ ๊ฐœ์„ ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "ssmincidents_enabled_with_plans" - ], + "Checks": [], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Subdomain": "2.11 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", "Section": "2.11.4 ์‚ฌ๊ณ  ๋Œ€์‘ ํ›ˆ๋ จ ๋ฐ ๊ฐœ์„ ", "AuditChecklist": [ "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ์— ๊ด€ํ•œ ๋ชจ์˜ํ›ˆ๋ จ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ด์— ๋”ฐ๋ผ ์—ฐ 1ํšŒ ์ด์ƒ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ›ˆ๋ จ์„ ์‹ค์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3428,11 +4715,15 @@ "Id": "2.11.5", "Name": "์‚ฌ๊ณ  ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌ", "Description": "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ ์ง•ํ›„๋‚˜ ๋ฐœ์ƒ์„ ์ธ์ง€ํ•œ ๋•Œ์—๋Š” ๋ฒ•์  ํ†ต์ง€ ๋ฐ ์‹ ๊ณ  ์˜๋ฌด๋ฅผ ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์‹ ์†ํ•˜๊ฒŒ ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌํ•˜๊ณ  ์‚ฌ๊ณ ๋ถ„์„ ํ›„ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ๋Œ€์‘์ฒด๊ณ„์— ๋ฐ˜์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [], + "Checks": [ + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered" + ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Subdomain": "2.11 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", "Section": "2.11.5 ์‚ฌ๊ณ  ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌ", "AuditChecklist": [ "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์˜ ์ง•ํ›„ ๋˜๋Š” ๋ฐœ์ƒ์„ ์ธ์ง€ํ•œ ๊ฒฝ์šฐ ์ •์˜๋œ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์‹ ์†ํ•˜๊ฒŒ ๋Œ€์‘ ๋ฐ ๋ณด๊ณ ๊ฐ€ ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3465,44 +4756,67 @@ "Name": "์žฌํ•ดยท์žฌ๋‚œ ๋Œ€๋น„ ์•ˆ์ „์กฐ์น˜", "Description": "์ž์—ฐ์žฌํ•ด, ํ†ต์‹ ยท์ „๋ ฅ ์žฅ์• , ํ•ดํ‚น ๋“ฑ ์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค ๋ฐ ์‹œ์Šคํ…œ์˜ ์šด์˜ ์—ฐ์†์„ฑ์„ ์œ„ํ˜‘ํ•  ์ˆ˜ ์žˆ๋Š” ์žฌํ•ด ์œ ํ˜•์„ ์‹๋ณ„ํ•˜๊ณ , ์œ ํ˜•๋ณ„ ์˜ˆ์ƒ ํ”ผํ•ด๊ทœ๋ชจ ๋ฐ ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ๊ฐ„, ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ์ ์„ ์ •์˜ํ•˜๊ณ  ๋ณต๊ตฌ ์ „๋žต ๋ฐ ๋Œ€์ฑ…, ๋น„์ƒ์‹œ ๋ณต๊ตฌ ์กฐ์ง, ๋น„์ƒ์—ฐ๋ฝ์ฒด๊ณ„, ๋ณต๊ตฌ ์ ˆ์ฐจ ๋“ฑ ์žฌํ•ด ๋ณต๊ตฌ์ฒด๊ณ„๋ฅผ ๊ตฌ์ถ•ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "kms_cmk_not_deleted_unintentionally", - "s3_bucket_lifecycle_enabled", - "s3_bucket_object_versioning", - "s3_bucket_cross_region_replication", - "s3_bucket_object_lock", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_cloudwatch_log_export", - "lightsail_instance_automated_snapshots", - "neptune_cluster_multi_az", - "neptune_cluster_deletion_protection", - "dynamodb_tables_pitr_enabled", - "elb_is_in_multiple_az", - "elb_cross_zone_load_balancing_enabled", - "redshift_cluster_automated_snapshot", - "drs_job_exist", - "dlm_ebs_snapshot_lifecycle_policy_exists", - "vpc_subnet_different_az", - "vpc_different_regions", - "dms_instance_multi_az_enabled", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_contact_information_is_registered", + "autoscaling_group_capacity_rebalance_enabled", "autoscaling_group_multiple_az", - "elbv2_is_in_multiple_az", - "elbv2_deletion_protection", - "backup_reportplans_exist", + "autoscaling_group_multiple_instance_types", + "awslambda_function_vpc_multi_az", "backup_plans_exist", + "cloudfront_distributions_multiple_origin_failover_configured", + "directconnect_connection_redundancy", + "directconnect_virtual_interface_redundancy", + "directoryservice_directory_snapshots_limit", + "dms_instance_multi_az_enabled", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_multi_az_enabled", + "drs_job_exist", + "dynamodb_accelerator_cluster_multi_az", + "dynamodb_table_autoscaling_enabled", + "dynamodb_table_protected_by_backup_plan", + "dynamodb_tables_pitr_enabled", + "ec2_ebs_volume_protected_by_backup_plan", + "ec2_ebs_volume_snapshots_exists", + "efs_have_backup_enabled", + "elasticache_redis_cluster_automatic_failover_enabled", "elasticache_redis_cluster_backup_enabled", "elasticache_redis_cluster_multi_az_enabled", - "rds_instance_multi_az", - "rds_instance_deletion_protection", - "rds_cluster_deletion_protection", + "elb_cross_zone_load_balancing_enabled", + "elb_is_in_multiple_az", + "elbv2_cross_zone_load_balancing_enabled", + "elbv2_is_in_multiple_az", + "eventbridge_global_endpoint_event_replication_enabled", + "fsx_file_system_copy_tags_to_backups_enabled", + "fsx_windows_file_system_multi_az_enabled", + "lightsail_instance_automated_snapshots", + "mq_broker_active_deployment_mode", + "mq_broker_cluster_deployment_mode", + "neptune_cluster_backup_enabled", + "neptune_cluster_multi_az", + "opensearch_service_domains_fault_tolerant_data_nodes", + "opensearch_service_domains_fault_tolerant_master_nodes", + "rds_cluster_backtrack_enabled", "rds_cluster_multi_az", + "rds_cluster_protected_by_backup_plan", "rds_instance_backup_enabled", - "efs_have_backup_enabled", - "ec2_ebs_volume_snapshots_exists" + "rds_instance_multi_az", + "rds_instance_protected_by_backup_plan", + "redshift_cluster_automated_snapshot", + "redshift_cluster_multi_az_enabled", + "s3_bucket_cross_region_replication", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_lock", + "s3_bucket_object_versioning", + "sagemaker_endpoint_config_prod_variant_instances", + "vpc_different_regions", + "vpc_endpoint_multi_az_enabled", + "vpc_subnet_different_az" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.12. ์žฌํ•ด ๋ณต๊ตฌ", + "Subdomain": "2.12 ์žฌํ•ด ๋ณต๊ตฌ", "Section": "2.12.1 ์žฌํ•ดยท์žฌ๋‚œ ๋Œ€๋น„ ์•ˆ์ „์กฐ์น˜", "AuditChecklist": [ "์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค(์—…๋ฌด) ์—ฐ์†์„ฑ์„ ์œ„ํ˜‘ํ•  ์ˆ˜ ์žˆ๋Š” IT ์žฌํ•ด ์œ ํ˜•์„ ์‹๋ณ„ํ•˜๊ณ , ์œ ํ˜•๋ณ„ ํ”ผํ•ด๊ทœ๋ชจ ๋ฐ ์—…๋ฌด์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ ํ•ต์‹ฌ IT ์„œ๋น„์Šค(์—…๋ฌด) ๋ฐ ์‹œ์Šคํ…œ์„ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3534,44 +4848,12 @@ "Name": "์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๋ฐ ๊ฐœ์„ ", "Description": "์žฌํ•ด ๋ณต๊ตฌ ์ „๋žต ๋ฐ ๋Œ€์ฑ…์˜ ์ ์ •์„ฑ์„ ์ •๊ธฐ์ ์œผ๋กœ ์‹œํ—˜ํ•˜์—ฌ ์‹œํ—˜๊ฒฐ๊ณผ, ์ •๋ณด์‹œ์Šคํ…œ ํ™˜๊ฒฝ๋ณ€ํ™”, ๋ฒ•๊ทœ ๋“ฑ์— ๋”ฐ๋ฅธ ๋ณ€ํ™”๋ฅผ ๋ฐ˜์˜ํ•˜์—ฌ ๋ณต๊ตฌ์ „๋žต ๋ฐ ๋Œ€์ฑ…์„ ๋ณด์™„ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", "Checks": [ - "kms_cmk_not_deleted_unintentionally", - "s3_bucket_lifecycle_enabled", - "s3_bucket_object_versioning", - "s3_bucket_cross_region_replication", - "s3_bucket_object_lock", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_cloudwatch_log_export", - "lightsail_instance_automated_snapshots", - "neptune_cluster_multi_az", - "neptune_cluster_deletion_protection", - "dynamodb_tables_pitr_enabled", - "elb_is_in_multiple_az", - "elb_cross_zone_load_balancing_enabled", - "redshift_cluster_automated_snapshot", - "drs_job_exist", - "dlm_ebs_snapshot_lifecycle_policy_exists", - "vpc_subnet_different_az", - "vpc_different_regions", - "dms_instance_multi_az_enabled", - "autoscaling_group_multiple_az", - "elbv2_is_in_multiple_az", - "elbv2_deletion_protection", - "backup_reportplans_exist", - "backup_plans_exist", - "elasticache_redis_cluster_backup_enabled", - "elasticache_redis_cluster_multi_az_enabled", - "rds_instance_multi_az", - "rds_instance_deletion_protection", - "rds_cluster_deletion_protection", - "rds_cluster_multi_az", - "rds_instance_backup_enabled", - "efs_have_backup_enabled", - "ec2_ebs_volume_snapshots_exists" + "drs_job_exist" ], "Attributes": [ { "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "2.12. ์žฌํ•ด ๋ณต๊ตฌ", + "Subdomain": "2.12 ์žฌํ•ด ๋ณต๊ตฌ", "Section": "2.12.2 ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๋ฐ ๊ฐœ์„ ", "AuditChecklist": [ "์ˆ˜๋ฆฝ๋œ IT ์žฌํ•ด ๋ณต๊ตฌ์ฒด๊ณ„์˜ ์‹คํšจ์„ฑ์„ ํŒ๋‹จํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜๊ณ„ํš์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3599,7 +4881,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด ๋™์˜, ๋ฒ•๋ น์ƒ ์˜๋ฌด์ค€์ˆ˜, ๊ณ„์•ฝ ์ฒด๊ฒฐยท์ดํ–‰ ๋“ฑ ์ ๋ฒ• ์š”๊ฑด์— ๋”ฐ๋ผ ์ˆ˜์ง‘ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3613,8 +4895,10 @@ "์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜ ์—†์ด ๊ฐœ์ธ์ •๋ณด์˜ ์ถ”๊ฐ€์ ์ธ ์ด์šฉ ์‹œ ๋‹น์ดˆ ์ˆ˜์ง‘ ๋ชฉ์ ๊ณผ์˜ ๊ด€๋ จ์„ฑ, ์˜ˆ์ธก ๊ฐ€๋Šฅ์„ฑ, ์ด์ต ์นจํ•ด ์—ฌ๋ถ€, ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๋“ฑ์˜ ๊ณ ๋ ค์‚ฌํ•ญ์— ๋Œ€ํ•œ ํŒ๋‹จ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ , ์ถ”๊ฐ€์ ์ธ ์ด์šฉ์ด ์ง€์†์ ์œผ๋กœ ๋ฐœ์ƒํ•˜๋Š” ๊ฒฝ์šฐ ๊ณ ๋ ค์‚ฌํ•ญ์— ๋Œ€ํ•œ ํŒ๋‹จ๊ธฐ์ค€์„ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๊ณ  ์ด๋ฅผ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" ], "RelatedRegulations": [ - "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ15์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘ยท์ด์šฉ), ์ œ22์กฐ(๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ฐฉ๋ฒ•), ์ œ22์กฐ์˜2(์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ)", - "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋ฐฉ๋ฒ•์— ๊ด€ํ•œ ๊ณ ์‹œ" + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ15์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘ยท์ด์šฉ)", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋ฐฉ๋ฒ•์— ๊ด€ํ•œ ๊ณ ์‹œ", + "์ œ22์กฐ(๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ฐฉ๋ฒ•)", + "์ œ22์กฐ์˜2(์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ)" ], "AuditEvidence": [ "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ๋ชจ๋ฐ”์ผ์•ฑ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ์ด๋ฒคํŠธ ์ฐธ์—ฌ ๋“ฑ)", @@ -3645,7 +4929,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.2 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์ œํ•œ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ๋ชฉ์ ์— ํ•„์š”ํ•œ ๋ฒ”์œ„์—์„œ ์ตœ์†Œํ•œ์˜ ์ •๋ณด๋งŒ์„ ์ˆ˜์ง‘ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3678,7 +4962,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.3 ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ฒ˜๋ฆฌ ์ œํ•œ", "AuditChecklist": [ "์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋Š” ๋ช…ํ™•ํ•œ ๋ฒ•์  ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ์—๋งŒ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3714,7 +4998,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.4 ๋ฏผ๊ฐ์ •๋ณด ๋ฐ ๊ณ ์œ ์‹๋ณ„์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ", "AuditChecklist": [ "๋ฏผ๊ฐ์ •๋ณด๋Š” ์ •๋ณด์ฃผ์ฒด๋กœ๋ถ€ํ„ฐ ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜ ๊ด€๋ จ ๋ฒ•๋ น์— ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ์—๋งŒ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3745,7 +5029,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.5 ๊ฐœ์ธ์ •๋ณด ๊ฐ„์ ‘์ˆ˜์ง‘", "AuditChecklist": [ "์ •๋ณด์ฃผ์ฒด ์ด์™ธ์˜ ์ œ3์ž๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต๋ฐ›๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘์— ๋Œ€ํ•œ ๋™์˜ํš๋“ ์ฑ…์ž„์ด ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณตํ•˜๋Š” ์ž์—๊ฒŒ ์žˆ์Œ์„ ๊ณ„์•ฝ์„ ํ†ตํ•˜์—ฌ ๋ช…์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3780,7 +5064,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.6 ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์„ค์น˜ยท์šด์˜", "AuditChecklist": [ "๊ณต๊ฐœ๋œ ์žฅ์†Œ์— ๊ณ ์ •ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ์„ค์น˜ยท์šด์˜ํ•  ๊ฒฝ์šฐ ๋ฒ•์  ํ—ˆ์šฉ ์š”๊ฑด์— ํ•ด๋‹นํ•˜๋Š”์ง€๋ฅผ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3819,7 +5103,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.1.7 ๋งˆ์ผ€ํŒ… ๋ชฉ์ ์˜ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉ", "AuditChecklist": [ "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์žฌํ™”๋‚˜ ์„œ๋น„์Šค๋ฅผ ํ™๋ณดํ•˜๊ฑฐ๋‚˜ ํŒ๋งค๋ฅผ ๊ถŒ์œ ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์— ๋Œ€ํ•œ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์ด๋ฅผ ๋ช…ํ™•ํ•˜๊ฒŒ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์•Œ๋ฆฌ๊ณ  ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3854,14 +5138,11 @@ "Id": "3.2.1", "Name": "๊ฐœ์ธ์ •๋ณด ํ˜„ํ™ฉ๊ด€๋ฆฌ", "Description": "์ˆ˜์ง‘ยท๋ณด์œ ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์˜ ํ•ญ๋ชฉ, ๋ณด์œ ๋Ÿ‰, ์ฒ˜๋ฆฌ ๋ชฉ์  ๋ฐ ๋ฐฉ๋ฒ•, ๋ณด์œ ๊ธฐ๊ฐ„ ๋“ฑ ํ˜„ํ™ฉ์„ ์ •๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ๊ณต๊ณต๊ธฐ๊ด€์˜ ๊ฒฝ์šฐ ์ด๋ฅผ ๋ฒ•๋ฅ ์—์„œ ์ •ํ•œ ๊ด€๊ณ„๊ธฐ๊ด€์˜ ์žฅ์—๊ฒŒ ๋“ฑ๋กํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "s3_bucket_lifecycle_enabled", - "macie_is_enabled" - ], + "Checks": [], "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.2 ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.2.1 ๊ฐœ์ธ์ •๋ณด ํ˜„ํ™ฉ๊ด€๋ฆฌ", "AuditChecklist": [ "์ˆ˜์ง‘ยท๋ณด์œ ํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด์˜ ํ•ญ๋ชฉ, ๋ณด์œ ๋Ÿ‰, ์ฒ˜๋ฆฌ ๋ชฉ์  ๋ฐ ๋ฐฉ๋ฒ•, ๋ณด์œ ๊ธฐ๊ฐ„ ๋“ฑ ํ˜„ํ™ฉ์„ ์ •๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3904,7 +5185,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.2 ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.2.2 ๊ฐœ์ธ์ •๋ณด ํ’ˆ์งˆ๋ณด์žฅ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ตœ์‹ ์˜ ์ƒํƒœ๋กœ ์ •ํ™•ํ•˜๊ฒŒ ์œ ์ง€ํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ ๋ฐ ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3932,7 +5213,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.2 ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.2.3 ์ด์šฉ์ž ๋‹จ๋ง๊ธฐ ์ ‘๊ทผ ๋ณดํ˜ธ", "AuditChecklist": [ "์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜ ๋‚ด์— ์ €์žฅ๋˜์–ด ์žˆ๋Š” ์ •๋ณด ๋ฐ ์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜์— ์„ค์น˜๋œ ๊ธฐ๋Šฅ์— ๋Œ€ํ•˜์—ฌ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ ๋ช…ํ™•ํ•˜๊ฒŒ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์•Œ๋ฆฌ๊ณ  ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -3963,7 +5244,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.2 ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.2.4 ๊ฐœ์ธ์ •๋ณด ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ๊ณต", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด๋Š” ์ตœ์ดˆ ์ˆ˜์ง‘ ์‹œ ์ •๋ณด์ฃผ์ฒด๋กœ๋ถ€ํ„ฐ ๋™์˜๋ฐ›์€ ๋ชฉ์  ๋˜๋Š” ๋ฒ•๋ น์— ๊ทผ๊ฑฐํ•œ ๋ฒ”์œ„ ๋‚ด์—์„œ๋งŒ ์ด์šฉยท์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4000,7 +5281,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.2 ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.2.5 ๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ", "AuditChecklist": [ "๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ๋ชฉ์  ์ œํ•œ, ๊ฐ€๋ช…์ฒ˜๋ฆฌ ๋ฐฉ๋ฒ• ๋ฐ ๊ธฐ์ค€, ์ ์ •์„ฑ ๊ฒ€ํ† , ์žฌ์‹๋ณ„ ๊ธˆ์ง€ ๋ฐ ์žฌ์‹๋ณ„ ๋ฐœ์ƒ ์‹œ ์กฐ์น˜์‚ฌํ•ญ ๋“ฑ ๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ ์ •ํ•˜๊ฒŒ ์ฒ˜๋ฆฌํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4035,7 +5316,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.3 ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.3.1 ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด ๋™์˜, ๋ฒ•๋ น์ƒ ์˜๋ฌด์ค€์ˆ˜ ๋“ฑ ์ ๋ฒ• ์š”๊ฑด์„ ๋ช…ํ™•ํžˆ ์‹๋ณ„ํ•˜๊ณ  ์ด๋ฅผ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4074,7 +5355,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.3 ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.3.2 ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ์—…๋ฌด ์œ„ํƒ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์ œ3์ž์—๊ฒŒ ์œ„ํƒ(์žฌ์œ„ํƒ ํฌํ•จ)ํ•˜๋Š” ๊ฒฝ์šฐ ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๋“ฑ์— ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ๊ณผ ์ˆ˜ํƒ์ž๋ฅผ ํ˜„ํ–‰ํ™”ํ•˜์—ฌ ๊ณต๊ฐœํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4106,7 +5387,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.3 ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.3.3 ์˜์—…์˜ ์–‘๋„ ๋“ฑ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด ์ด์ „", "AuditChecklist": [ "์˜์—…์˜ ์ „๋ถ€ ๋˜๋Š” ์ผ๋ถ€์˜ ์–‘๋„ยทํ•ฉ๋ณ‘ ๋“ฑ์œผ๋กœ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋‹ค๋ฅธ ์‚ฌ๋žŒ์—๊ฒŒ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ์‚ฌ์ „์— ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4131,13 +5412,11 @@ "Id": "3.3.4", "Name": "๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ์ด์ „", "Description": "๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ตญ์™ธ๋กœ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ๊ตญ์™ธ ์ด์ „์— ๋Œ€ํ•œ ๋™์˜, ๊ด€๋ จ ์‚ฌํ•ญ์— ๋Œ€ํ•œ ๊ณต๊ฐœ ๋“ฑ ์ ์ ˆํ•œ ๋ณดํ˜ธ์กฐ์น˜๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", - "Checks": [ - "s3_bucket_cross_region_replication" - ], + "Checks": [], "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.3 ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.3.4 ๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ์ด์ „", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ตญ์™ธ๋กœ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ตญ์™ธ ์ด์ „์— ๊ด€ํ•œ ๊ณ ์ง€ ์‚ฌํ•ญ์„ ๋ชจ๋‘ ์•Œ๋ฆฌ๊ณ  ๋ณ„๋„ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜, ์ธ์ฆ ๋˜๋Š” ์ธ์ • ๋“ฑ ์ ๋ฒ• ์š”๊ฑด์„ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4171,7 +5450,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.4. ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.4 ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.4.1 ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๋ฐ ํŒŒ๊ธฐ์™€ ๊ด€๋ จ๋œ ๋‚ด๋ถ€ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4205,7 +5484,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.4. ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Subdomain": "3.4 ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", "Section": "3.4.2 ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„ ๋ณด์œ  ์‹œ ์กฐ์น˜", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๊ฒฝ๊ณผ ๋˜๋Š” ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„์—๋„ ๊ด€๋ จ ๋ฒ•๋ น ๋“ฑ์— ๋”ฐ๋ผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ๋ณด์กดํ•˜๋Š” ๊ฒฝ์šฐ, ๊ด€๋ จ ๋ฒ•๋ น์— ๋”ฐ๋ฅธ ์ตœ์†Œํ•œ์˜ ๊ธฐ๊ฐ„์œผ๋กœ ํ•œ์ •ํ•˜์—ฌ ์ตœ์†Œํ•œ์˜ ์ •๋ณด๋งŒ์„ ๋ณด์กดํ•˜๋„๋ก ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4238,7 +5517,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.5. ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", + "Subdomain": "3.5 ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", "Section": "3.5.1 ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ ๊ณต๊ฐœ", "AuditChecklist": [ "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์„ ๋ฒ•๋ น์—์„œ ์š”๊ตฌํ•˜๋Š” ๋‚ด์šฉ์„ ๋ชจ๋‘ ํฌํ•จํ•˜์—ฌ ์•Œ๊ธฐ ์‰ฌ์šด ์šฉ์–ด๋กœ ๊ตฌ์ฒด์ ์ด๊ณ  ๋ช…ํ™•ํ•˜๊ฒŒ ์ž‘์„ฑํ•˜์˜€๋Š”๊ฐ€?", @@ -4270,7 +5549,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.5. ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", + "Subdomain": "3.5 ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", "Section": "3.5.2 ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณด์žฅ", "AuditChecklist": [ "์ •๋ณด์ฃผ์ฒด ๋˜๋Š” ๊ทธ ๋Œ€๋ฆฌ์ธ์ด ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•œ ์—ด๋žŒ, ์ •์ •ยท์‚ญ์ œ, ์ฒ˜๋ฆฌ์ •์ง€ ๋ฐ ๋™์˜ ์ฒ ํšŒ ๋“ฑ(์ดํ•˜ '์—ด๋žŒ๋“ฑ์š”๊ตฌ'๋ผ ํ•จ)์„ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘๋ฐฉ๋ฒ•ยท์ ˆ์ฐจ๋ณด๋‹ค ์–ด๋ ต์ง€ ์•„๋‹ˆํ•˜๋„๋ก ๊ถŒ๋ฆฌ ํ–‰์‚ฌ ๋ฐฉ๋ฒ• ๋ฐ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜์—ฌ ๊ณต๊ฐœํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4309,7 +5588,7 @@ "Attributes": [ { "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", - "Subdomain": "3.5. ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", + "Subdomain": "3.5 ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", "Section": "3.5.3 ์ •๋ณด์ฃผ์ฒด์— ๋Œ€ํ•œ ํ†ต์ง€", "AuditChecklist": [ "๋ฒ•์  ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹นํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ๋˜๋Š” ๊ทธ ๋‚ด์—ญ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋Š” ์ •๋ณด์‹œ์Šคํ…œ์— ์ ‘์†ํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ†ต์ง€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", @@ -4323,11 +5602,11 @@ "๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ์–‘์‹ ๋ฐ ๋ฌธ๊ตฌ" ], "NonComplianceCases": [ - "์‚ฌ๋ก€ 1 : ์ „๋…„๋„ ๋ง ๊ธฐ์ค€ ์ง์ „ 3๊ฐœ์›” ๊ฐ„ ์ผ์ผ ํ‰๊ท  ์ €์žฅยท๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด๊ฐ€ 100๋งŒ๋ช… ์ด์ƒ์œผ๋กœ์„œ ๊ฐœ์ธ์ •๋ณด ์ด์šฉ์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹น ๋จ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๊ธˆ๋…„๋„์— ๊ฐœ์ธ์ •๋ณด ์ด์šฉ ๋ฐ๋‚ด์—ญ์„ ํ†ต์ง€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 1 : ์ „๋…„๋„ ๋ง ๊ธฐ์ค€ ์ง์ „ 3๊ฐœ์›” ๊ฐ„ ์ผ์ผ ํ‰๊ท  ์ €์žฅยท๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด๊ฐ€ 100๋งŒ๋ช… ์ด์ƒ์œผ๋กœ์„œ ๊ฐœ์ธ์ •๋ณด ์ด์šฉ์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹น ๋จ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๊ธˆ๋…„๋„์— ๊ฐœ์ธ์ •๋ณด ์ด์šฉ ๋ฐ ๋‚ด์—ญ์„ ํ†ต์ง€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ์„ ๊ฐœ๋ณ„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์ง์ ‘์ ์œผ๋กœ ํ†ต์ง€ํ•˜๋Š” ๋Œ€์‹  ํ™ˆํŽ˜์ด์ง€์—์„œ ๋‹จ์ˆœ ํŒ์—…์ฐฝ์ด๋‚˜ ๋ณ„๋„ ๊ณต์ง€์‚ฌํ•ญ์œผ๋กœ ์•ˆ๋‚ด๋งŒ ํ•œ ๊ฒฝ์šฐ" ] } ] } ] -} +} \ No newline at end of file