Product logo
DocsBlogPricing

Policy types for @turbot/aws-cisv1-4

AWS > CIS v1.4

Configures a default auditing level against the Amazon Web Services Foundations Benchmark, Version 1.4.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/cis
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Level 1 (Scored)",
  "Check: Level 1 (Scored & Not Scored)",
  "Check: Level 1 & Level 2 (Scored)",
  "Check: Level 1 & Level 2 (Scored & Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Level 1 (Scored)",
    "Check: Level 1 (Scored & Not Scored)",
    "Check: Level 1 & Level 2 (Scored)",
    "Check: Level 1 & Level 2 (Scored & Not Scored)"
  ],
  "default": "Skip"
}

AWS > CIS v1.4 > 1 - Identity and Access Management

Covers recommendations for configuring AWS IAM features

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s01
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4",
  "Skip",
  "Check: Level 1 (Scored)",
  "Check: Level 1 (Scored & Not Scored)",
  "Check: Level 1 & Level 2 (Scored)",
  "Check: Level 1 & Level 2 (Scored & Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4",
    "Skip",
    "Check: Level 1 (Scored)",
    "Check: Level 1 (Scored & Not Scored)",
    "Check: Level 1 & Level 2 (Scored)",
    "Check: Level 1 & Level 2 (Scored & Not Scored)"
  ],
  "example": [
    "Skip"
  ],
  "default": "Per AWS > CIS v1.4"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.01 - Maintain current contact details (Manual)

Configures auditing against a CIS Benchmark item.

Level: 1 (Not Scored)

Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0101
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
  "Skip",
  "Check: Level 1 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
    "Skip",
    "Check: Level 1 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.01 - Maintain current contact details (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).

  1. Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.
  2. On the navigation bar, choose your account name, and then choose My Account.
  3. On the Account Settings page, review and verify the current details.
  4. Under Contact Information, review and verify the current details.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1.4 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0101Attestation
Category
Parent
Targets
Schema
{
  "type": "string",
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered (Manual)

Configures auditing against a CIS Benchmark item.

Level: 1 (Not Scored)

AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0102
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
  "Skip",
  "Check: Level 1 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
    "Skip",
    "Check: Level 1 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

Perform the following in the AWS Management Console to determine if security contact information is present:

  1. Click on your account name at the top right corner of the console
  2. From the drop-down menu Click My Account
  3. Scroll down to the Alternate Contacts section
  4. Ensure contact information is specified in the Security section

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1.4 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0102Attestation
Category
Parent
Targets
Schema
{
  "type": "string",
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account (Manual)

Configures auditing against a CIS Benchmark item.

Level: 1 (Not Scored)

The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0103
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
  "Skip",
  "Check: Level 1 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
    "Skip",
    "Check: Level 1 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

Perform the following in the AWS Management Console:

  1. Login to the AWS account as the 'root' user .
  2. On the top right you will see the <Root_Account_Name> .
  3. Click on the <Root_Account_Name> .
  4. From the drop-down menu Click My Account .
  5. In the Configure Security Challenge Questions section on the Personal Information page, configure three security challenge questions .
  6. Click Save questions .

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1.4 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0103Attestation
Category
Parent
Targets
Schema
{
  "type": "string",
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.04 - Ensure no 'root' user account access key exists (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0104
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.05 - Ensure MFA is enabled for the 'root' user account (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0105
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.06 - Ensure hardware MFA is enabled for the 'root' user account (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0106
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.07 - Eliminate use of the 'root' user for administrative and daily tasks (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0107
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.08 - Ensure IAM password policy requires minimum length of 14 or greater (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0108
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.09 - Ensure IAM password policy prevents password reuse (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords. This control checks whether the number of passwords to remember is set to 24. The control state will be in Alarm if the value is not set to 24.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0109
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.10 - Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0110
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.11 - Do not setup access keys during initial user setup for all IAM users that have a console password (Manual)

Configures auditing against a CIS Benchmark item.

Level: 1 (Not Scored)

AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM User credentials you have to determine what type of access they require.

Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user.

AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0111
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Not Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.12 - Ensure credentials unused for 45 days or greater are disabled (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0112
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.13 - Ensure there is only one active access key available for any single IAM user (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0113
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.14 - Ensure access keys are rotated every 90 days or less (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0114
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.15 - Ensure IAM Users Receive Permissions Only Through Groups (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user:

  1. Edit the user policy directly, aka an inline, or user, policy;
  2. attach a policy directly to a user;
  3. add the user to an IAM group that has an attached policy.

Only the third implementation is recommended.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0115
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.16 - Ensure IAM policies that allow full ":" administrative privileges are not attached (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0116
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.17 - Ensure a support role has been created to manage incidents with AWS Support (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0117
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances (Manual)

Configures auditing against a CIS Benchmark item.

Level: 2 (Not Scored)

AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. "AWS Access" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0118
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
  "Skip",
  "Check: Level 2 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
    "Skip",
    "Check: Level 2 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

IAM roles can only be associated at the launch of an instance. To remediate an instance to add it to a role you must create a new instance. If the instance has no external dependencies on its current private ip or public addresses are elastic IPs:

  1. In AWS IAM create a new role. Assign a permissions policy if needed permissions are already known.
  2. In the AWS console launch a new instance with identical settings to the existing instance, and ensure that the newly created role is selected.
  3. Shutdown both the existing instance and the new instance.
  4. Detach disks from both instances.
  5. Attach the existing instance disks to the new instance.
  6. Boot the new instance and you should have the same machine, but with the associated role.

Note: if your environment has dependencies on a dynamically assigned PRIVATE IP address you can create an AMI from the existing instance, destroy the old one and then when launching from the AMI, manually assign the previous private IP address.

Note: if your environment has dependencies on a dynamically assigned PUBLIC IP address there is not a way ensure the address is retained and assign an instance role. Dependencies on dynamically assigned public IP addresses are a bad practice and, if possible, you may wish to rebuild the instance with a new elastic IP address and make the investment to remediate affected systems while assigning the system to a role.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1.4 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0118Attestation
Category
Parent
Targets
Schema
{
  "type": "string",
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.19 - Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0119
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.20 - Ensure that IAM Access analyzer is enabled for all regions (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Enable IAM Access analyzer for IAM policies about all resources in each region.

IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0120
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments (Manual)

Configures auditing against a CIS Benchmark item.

Level: 2 (Not Scored)

In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0121
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
  "Skip",
  "Check: Level 2 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation",
    "Skip",
    "Check: Level 2 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 1 - Identity and Access Management using attestation"
}

AWS > CIS v1.4 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

For multi-account AWS environments with an external identity provider...

  1. Determine the master account for identity federation or IAM user management
  2. Login to that account through the AWS Management Console
  3. Click Services
  4. Click IAM
  5. Click Identity providers
  6. Verify the configuration Then..., determine all accounts that should not have local users present. For each account...
  7. Determine all accounts that should not have local users present
  8. Log into the AWS Management Console
  9. Switch role into each identified account
  10. Click Services
  11. Click IAM
  12. Click Users
  13. Confirm that no IAM users representing individuals are present For multi-account AWS environments implementing AWS Organizations without an external identity provider...
  14. Determine all accounts that should not have local users present
  15. Log into the AWS Management Console
  16. Switch role into each identified account
  17. Click Services
  18. Click IAM
  19. Click Users
  20. Confirm that no IAM users representing individuals are present

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1.4 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0121Attestation
Category
Parent
Targets
Schema
{
  "type": "string",
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 1 - Identity and Access Management > Maximum Attestation Duration

The maximum duration for CIS Attestations. Attestation policies can not be set further in the future than is specified here

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s01Attestation
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > Maximum Attestation Duration",
  "Skip",
  "30 days",
  "60 days",
  "90 days",
  "1 year",
  "2 years",
  "3 years"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > Maximum Attestation Duration",
    "Skip",
    "30 days",
    "60 days",
    "90 days",
    "1 year",
    "2 years",
    "3 years"
  ],
  "default": "Per AWS > CIS v1.4 > Maximum Attestation Duration"
}

AWS > CIS v1.4 > 2 - Storage

Covers security recommendations addressing Storage.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s02
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4",
  "Skip",
  "Check: Level 1 (Scored)",
  "Check: Level 1 (Scored & Not Scored)",
  "Check: Level 1 & Level 2 (Scored)",
  "Check: Level 1 & Level 2 (Scored & Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4",
    "Skip",
    "Check: Level 1 (Scored)",
    "Check: Level 1 (Scored & Not Scored)",
    "Check: Level 1 & Level 2 (Scored)",
    "Check: Level 1 & Level 2 (Scored & Not Scored)"
  ],
  "example": [
    "Skip"
  ],
  "default": "Per AWS > CIS v1.4"
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3)

Covers security recommendations addressing Simple Storage Service (S3).

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s0201
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "Skip"
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.01 - Ensure all S3 buckets employ encryption-at-rest (Manual)

Configures auditing against a CIS Benchmark item.

Level: 2 (Not Scored)

Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020101
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage",
  "Skip",
  "Check: Level 2 (Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage",
    "Skip",
    "Check: Level 2 (Not Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage"
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.02 - Ensure S3 Bucket Policy is set to deny HTTP requests (Manual)

Configures auditing against a CIS Benchmark item.

Level: 2 (Not Scored)

At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020102
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage",
  "Skip",
  "Check: Level 2 (Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage",
    "Skip",
    "Check: Level 2 (Not Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage"
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure MFA Delete is enable on S3 buckets (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020103
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage"
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure all data in Amazon S3 has been discovered, classified and secured when required. (Manual)

Configures auditing against a CIS Benchmark item.

Level: 2 (Not Scored)

Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020104
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage using attestation",
  "Skip",
  "Check: Level 2 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage using attestation",
    "Skip",
    "Check: Level 2 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage using attestation"
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure all data in Amazon S3 has been discovered, classified and secured when required. (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

  1. Login to the Macie console at https://console.aws.amazon.com/macie/
  2. In the left hand pane click on By job under findings.
  3. Confirm that you have a Job setup for your S3 Buckets

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1.4 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020104Attestation
Category
Parent
Targets
Schema
{
  "type": "string",
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.05 - Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Amazon S3 provides Block public access (bucket settings) and Block public access (account settings) to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, Block public access (bucket settings) prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, Block public access (account settings) prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020105
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage"
}

AWS > CIS v1.4 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2)

Covers security recommendations addressing Elastic Compute Cloud (EC2).

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s0202
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "Skip"
}

AWS > CIS v1.4 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2) > 2.02.01 - Ensure EBS volume encryption is enabled (Manual)

Configures auditing against a CIS Benchmark item.

Level: 1 (Not Scored)

Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020201
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage",
  "Skip",
  "Check: Level 1 (Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage",
    "Skip",
    "Check: Level 1 (Not Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage"
}

AWS > CIS v1.4 > 2 - Storage > 2.03 - Relational Database Service (RDS)

Covers security recommendations addressing Relational Database Service (RDS).

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s0203
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "Skip"
}

AWS > CIS v1.4 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.01 - Ensure that encryption is enabled for RDS Instances (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r020301
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 2 - Storage",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 2 - Storage",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 2 - Storage"
}

AWS > CIS v1.4 > 2 - Storage > Maximum Attestation Duration

The maximum duration for CIS Attestations. Attestation policies can not be set further in the future than is specified here.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s02Attestation
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > Maximum Attestation Duration",
  "Skip",
  "30 days",
  "60 days",
  "90 days",
  "1 year",
  "2 years",
  "3 years"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > Maximum Attestation Duration",
    "Skip",
    "30 days",
    "60 days",
    "90 days",
    "1 year",
    "2 years",
    "3 years"
  ],
  "default": "Per AWS > CIS v1.4 > Maximum Attestation Duration"
}

AWS > CIS v1.4 > 3 - Logging

Covers recommendations for configuring AWS logging features.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s03
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4",
  "Skip",
  "Check: Level 1 (Scored)",
  "Check: Level 1 (Scored & Not Scored)",
  "Check: Level 1 & Level 2 (Scored)",
  "Check: Level 1 & Level 2 (Scored & Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4",
    "Skip",
    "Check: Level 1 (Scored)",
    "Check: Level 1 (Scored & Not Scored)",
    "Check: Level 1 & Level 2 (Scored)",
    "Check: Level 1 & Level 2 (Scored & Not Scored)"
  ],
  "example": [
    "Skip"
  ],
  "default": "Per AWS > CIS v1.4"
}

AWS > CIS v1.4 > 3 - Logging > 3.01 - Ensure CloudTrail is enabled in all regions (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0301
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.02 - Ensure CloudTrail log file validation is enabled (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0302
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.03 - Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0303
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.04 - Ensure CloudTrail trails are integrated with CloudWatch Logs (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0304
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.05 - Ensure AWS Config is enabled in all regions (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0305
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.06 - Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0306
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.07 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0307
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.08 - Ensure rotation for customer created CMKs is enabled (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0308
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.09 - Ensure VPC flow logging is enabled in all VPCs (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0309
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.10 - Ensure that Object-level logging for write events is enabled for S3 bucket (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0310
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > 3.11 - Ensure that Object-level logging for read events is enabled for S3 bucket (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0311
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 3 - Logging",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 3 - Logging",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 3 - Logging"
}

AWS > CIS v1.4 > 3 - Logging > Maximum Attestation Duration

The maximum duration for CIS Attestations. Attestation policies can not be set further in the future than is specified here.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s03Attestation
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > Maximum Attestation Duration",
  "Skip",
  "30 days",
  "60 days",
  "90 days",
  "1 year",
  "2 years",
  "3 years"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > Maximum Attestation Duration",
    "Skip",
    "30 days",
    "60 days",
    "90 days",
    "1 year",
    "2 years",
    "3 years"
  ],
  "default": "Per AWS > CIS v1.4 > Maximum Attestation Duration"
}

AWS > CIS v1.4 > 4 - Monitoring

Covers recommendations for configuring AWS monitoring features.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s04
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4",
  "Skip",
  "Check: Level 1 (Scored)",
  "Check: Level 1 (Scored & Not Scored)",
  "Check: Level 1 & Level 2 (Scored)",
  "Check: Level 1 & Level 2 (Scored & Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4",
    "Skip",
    "Check: Level 1 (Scored)",
    "Check: Level 1 (Scored & Not Scored)",
    "Check: Level 1 & Level 2 (Scored)",
    "Check: Level 1 & Level 2 (Scored & Not Scored)"
  ],
  "example": [
    "Skip"
  ],
  "default": "Per AWS > CIS v1.4"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.01 - Ensure a log metric filter and alarm exist for unauthorized API calls (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0401
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.02 - Ensure a log metric filter and alarm exist for Management Console sign-in without MFA (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0402
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.03 - Ensure a log metric filter and alarm exist for usage of 'root' account (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0403
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.04 - Ensure a log metric filter and alarm exist for IAM policy changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0404
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.05 - Ensure a log metric filter and alarm exist for CloudTrail configuration changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0405
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.06 - Ensure a log metric filter and alarm exist for AWS Management Console authentication failures (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0406
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.07 - Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0407
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.08 - Ensure a log metric filter and alarm exist for S3 bucket policy changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0408
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.09 - Ensure a log metric filter and alarm exist for AWS Config configuration changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0409
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.10 - Ensure a log metric filter and alarm exist for security group changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0410
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.11 - Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0411
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.12 - Ensure a log metric filter and alarm exist for changes to network gateways (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0412
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.13 - Ensure a log metric filter and alarm exist for route table changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0413
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.14 - Ensure a log metric filter and alarm exist for VPC changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0414
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > 4.15 - Ensure a log metric filter and alarm exists for AWS Organizations changes (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0415
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 4 - Monitoring",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 4 - Monitoring",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 4 - Monitoring"
}

AWS > CIS v1.4 > 4 - Monitoring > Maximum Attestation Duration

The maximum duration for CIS Attestations. Attestation policies can not be set further in the future than is specified here.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s04Attestation
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > Maximum Attestation Duration",
  "Skip",
  "30 days",
  "60 days",
  "90 days",
  "1 year",
  "2 years",
  "3 years"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > Maximum Attestation Duration",
    "Skip",
    "30 days",
    "60 days",
    "90 days",
    "1 year",
    "2 years",
    "3 years"
  ],
  "default": "Per AWS > CIS v1.4 > Maximum Attestation Duration"
}

AWS > CIS v1.4 > 5 - Networking

Covers recommendations for configuring AWS networking features.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s05
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4",
  "Skip",
  "Check: Level 1 (Scored)",
  "Check: Level 1 (Scored & Not Scored)",
  "Check: Level 1 & Level 2 (Scored)",
  "Check: Level 1 & Level 2 (Scored & Not Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4",
    "Skip",
    "Check: Level 1 (Scored)",
    "Check: Level 1 (Scored & Not Scored)",
    "Check: Level 1 & Level 2 (Scored)",
    "Check: Level 1 & Level 2 (Scored & Not Scored)"
  ],
  "example": [
    "Skip"
  ],
  "default": "Per AWS > CIS v1.4"
}

AWS > CIS v1.4 > 5 - Networking > 5.01 - Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0501
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 5 - Networking",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 5 - Networking",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 5 - Networking"
}

AWS > CIS v1.4 > 5 - Networking > 5.02 - Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)

Configures auditing against a CIS Benchmark item.

Level: 1 (Scored)

Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0502
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 5 - Networking",
  "Skip",
  "Check: Level 1 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 5 - Networking",
    "Skip",
    "Check: Level 1 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 5 - Networking"
}

AWS > CIS v1.4 > 5 - Networking > 5.03 - Ensure the default security group of every VPC restricts all traffic (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0503
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 5 - Networking",
  "Skip",
  "Check: Level 2 (Scored)"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 5 - Networking",
    "Skip",
    "Check: Level 2 (Scored)"
  ],
  "default": "Per AWS > CIS v1.4 > 5 - Networking"
}

AWS > CIS v1.4 > 5 - Networking > 5.04 - Ensure routing tables for VPC peering are 'least access' (Manual)

Configures auditing against a CIS Benchmark item.

Level: 2 (Not Scored)

Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0504
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > 5 - Networking using attestation",
  "Skip",
  "Check: Level 2 (Not Scored) using attestation"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > 5 - Networking using attestation",
    "Skip",
    "Check: Level 2 (Not Scored) using attestation"
  ],
  "default": "Per AWS > CIS v1.4 > 5 - Networking using attestation"
}

AWS > CIS v1.4 > 5 - Networking > 5.04 - Ensure routing tables for VPC peering are 'least access' (Manual) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

Review routing tables of peered VPCs for whether they route all subnets of each VPC and whether that is necessary to accomplish the intended purposes for peering the VPCs. Via CLI: List all the route tables from a VPC and check if "GatewayId" is pointing to a <peering_connection_id> (e.g. pcx-1a2b3c4d) and if "DestinationCidrBlock" is as specific as desired. aws ec2 describe-route-tables --filter "Name=vpc-id,Values=<vpc_id>" --query "RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId}"

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in AWS > CIS v1 > Maximum Attestation Duration. Set to a blank value to clear the attestation.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/r0504Attestation
Category
Parent
Targets
Schema
{
  "format": "date-time",
  "default": ""
}

AWS > CIS v1.4 > 5 - Networking > Maximum Attestation Duration

The maximum duration for CIS Attestations. Attestation policies can not be set further in the future than is specified here.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/s05Attestation
Category
Parent
Targets
Valid Value
[
  "Per AWS > CIS v1.4 > Maximum Attestation Duration",
  "Skip",
  "30 days",
  "60 days",
  "90 days",
  "1 year",
  "2 years",
  "3 years"
]
Schema
{
  "type": "string",
  "enum": [
    "Per AWS > CIS v1.4 > Maximum Attestation Duration",
    "Skip",
    "30 days",
    "60 days",
    "90 days",
    "1 year",
    "2 years",
    "3 years"
  ],
  "default": "Per AWS > CIS v1.4 > Maximum Attestation Duration"
}

AWS > CIS v1.4 > Maximum Attestation Duration

The maximum duration for CIS Attestations. Attestation policies can not be set further in the future than is specified here.

URI
tmod:@turbot/aws-cisv1-4#/policy/types/attestation
Category
Parent
Targets
Valid Value
[
  "Skip",
  "30 days",
  "60 days",
  "90 days",
  "1 year",
  "2 years",
  "3 years"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "30 days",
    "60 days",
    "90 days",
    "1 year",
    "2 years",
    "3 years"
  ],
  "default": "Skip"
}