{ "areas": [ { "catalog_count": 21, "id": "compute", "library_count": 3, "name": "Compute" }, { "catalog_count": 43, "id": "data", "library_count": 6, "name": "Data protection (encryption and backups)" }, { "catalog_count": 11, "id": "edge", "library_count": 3, "name": "Edge and TLS" }, { "catalog_count": 33, "id": "governance", "library_count": 3, "name": "Governance" }, { "catalog_count": 17, "id": "iam", "library_count": 4, "name": "Identity and access" }, { "catalog_count": 21, "id": "logging", "library_count": 4, "name": "Logging and audit trails" }, { "catalog_count": 22, "id": "monitoring", "library_count": 3, "name": "Monitoring and alerting" }, { "catalog_count": 25, "id": "network", "library_count": 4, "name": "Network exposure" } ], "catalog_hash": "93c71a41da493343d162adbd8589865b12bc9bace12295d22597500a72ffbfa0", "catalog_size": 193, "cis_benchmark": "CIS Amazon Web Services Foundations Benchmark v3.0.0", "controls": [ { "area": "logging", "checks": "Every CloudTrail trail has log file validation turned on, so a tampered or deleted log file is detectable.", "cis": [ "3.2" ], "evidence_type": "logging", "fail_condition": "Fails when any CloudTrail trail has log file validation turned off.", "fsbp": [], "id": "aws.cloudtrail.full_posture.log_file_validation", "name": "CloudTrail trails validate log file integrity", "pass_condition": "Passes when every CloudTrail trail has log file validation enabled.", "read_only": true, "resource_family": "trail", "rollup_id": "cloudtrail.multi_region_logging", "service": "CloudTrail", "severity": "high", "soc2": [ "CC7.1", "CC7.2" ] }, { "area": "logging", "checks": "At least one CloudTrail trail is logging in every AWS Region, so activity in a Region nobody watches still leaves a record.", "cis": [ "3.1" ], "evidence_type": "logging", "fail_condition": "Fails when no logging trail covers every Region.", "fsbp": [], "id": "aws.cloudtrail.full_posture.multi_region", "name": "A CloudTrail trail records activity in every Region", "pass_condition": "Passes when a trail is logging and covers every Region.", "read_only": true, "resource_family": "trail", "rollup_id": "cloudtrail.multi_region_logging", "service": "CloudTrail", "severity": "high", "soc2": [ "CC2.1", "CC7.2" ] }, { "area": "network", "checks": "No security group allows SSH on port 22 from anywhere on the internet, so remote access stays behind a known network or a managed path.", "cis": [ "5.2", "5.3" ], "evidence_type": "network", "fail_condition": "Fails when any security group allows SSH from every address on the internet.", "fsbp": [], "id": "aws.ec2.public_ingress_posture.tcp_22_open_to_world", "name": "Security groups do not expose SSH to the internet", "pass_condition": "Passes when no security group allows port 22 from 0.0.0.0/0 or ::/0.", "read_only": true, "resource_family": "security-group", "rollup_id": "ec2.sg_open_ingress", "service": "EC2", "severity": "high", "soc2": [ "CC6.1", "CC6.6" ] }, { "area": "iam", "checks": "Every IAM user who can sign in to the AWS console has an MFA device registered, not just the root user.", "cis": [ "1.10" ], "evidence_type": "identity", "fail_condition": "Fails when any IAM user can sign in to the console without MFA.", "fsbp": [], "id": "aws.iam.root_mfa_posture.iam_users_without_mfa", "name": "IAM users with console access have MFA", "pass_condition": "Passes when every IAM user with a console password has an MFA device.", "read_only": true, "resource_family": "account", "rollup_id": "iam.root_mfa_enabled", "service": "IAM", "severity": "high", "soc2": [ "CC6.1", "CC6.6" ] }, { "area": "iam", "checks": "The AWS root user has multi-factor authentication turned on, so a stolen root password alone cannot open the account.", "cis": [ "1.5" ], "evidence_type": "identity", "fail_condition": "Fails when the root user signs in with a password alone.", "fsbp": [], "id": "aws.iam.root_mfa_posture.root_account_mfa_enabled", "name": "The root user has MFA enabled", "pass_condition": "Passes when the root user has an MFA device active.", "read_only": true, "resource_family": "account", "rollup_id": "iam.root_mfa_enabled", "service": "IAM", "severity": "high", "soc2": [ "CC6.1", "CC6.6" ] }, { "area": "iam", "checks": "No active IAM access key is older than the rotation window, 90 days by default, so a leaked key has a limited useful life.", "cis": [ "1.14" ], "evidence_type": "identity", "fail_condition": "Fails when any active IAM access key is 90 days old or older.", "fsbp": [], "id": "aws.iam.root_mfa_posture.stale_access_keys", "name": "Active IAM access keys are rotated within 90 days", "pass_condition": "Passes when every active IAM access key was created or rotated in the last 90 days.", "read_only": true, "resource_family": "account", "rollup_id": "iam.root_mfa_enabled", "service": "IAM", "severity": "medium", "soc2": [ "CC6.1", "CC6.2" ] }, { "area": "data", "checks": "Every RDS database instance has storage encryption turned on, so data at rest and its backups are unreadable without the key.", "cis": [ "2.3.1" ], "evidence_type": "encryption", "fail_condition": "Fails when any RDS instance in scope stores data unencrypted.", "fsbp": [], "id": "aws.rds.encryption_posture.instances_encrypted", "name": "RDS DB instances encrypt storage at rest", "pass_condition": "Passes when every RDS instance in scope has storage encryption enabled.", "read_only": true, "resource_family": "rds-instance", "rollup_id": "rds.encryption_at_rest", "service": "RDS", "severity": "high", "soc2": [ "CC6.1", "CC6.7", "PI1.4" ] }, { "area": "network", "checks": "Every S3 bucket has all four Block Public Access settings on, so a single bad policy or ACL cannot expose its contents.", "cis": [ "2.1.4" ], "evidence_type": "network", "fail_condition": "Fails when any S3 bucket has one or more Block Public Access settings off.", "fsbp": [], "id": "aws.s3.public_access_posture.bucket_bpa", "name": "S3 buckets block public access at the bucket level", "pass_condition": "Passes when every S3 bucket has all four Block Public Access settings on.", "read_only": true, "resource_family": "bucket", "rollup_id": "s3.public_access_block", "service": "S3", "severity": "high", "soc2": [ "CC6.1", "CC6.6" ] }, { "area": "governance", "checks": "The AWS account has a security alternate contact on record, so AWS security notices reach a person who can act on them.", "cis": [ "1.2" ], "evidence_type": "configuration", "fail_condition": "Fails when the account has no security alternate contact on record.", "fsbp": [], "id": "aws.soc2.service_posture.account_security_contact_configured", "name": "The account has a security alternate contact", "pass_condition": "Passes when the account has a security alternate contact on record.", "read_only": true, "resource_family": "account", "service": "AWS Account", "severity": "medium", "soc2": [ "CC2.3", "CC7.4" ] }, { "area": "edge", "checks": "Every load balancer HTTP listener redirects to HTTPS, so a visitor who types a plain http address ends up on an encrypted connection.", "cis": [], "evidence_type": "network", "fail_condition": "Fails when any HTTP listener on a load balancer forwards traffic without redirecting.", "fsbp": [], "id": "aws.soc2.service_posture.alb_http_to_https_redirect", "name": "Load balancer HTTP listeners redirect to HTTPS", "pass_condition": "Passes when every HTTP listener on a load balancer redirects to HTTPS.", "read_only": true, "resource_family": "load-balancer", "service": "ELBv2", "severity": "high", "soc2": [ "CC6.6", "CC6.7" ] }, { "area": "edge", "checks": "Every load balancer has an HTTPS listener that uses an ACM certificate, so traffic from the internet is encrypted at the front door.", "cis": [], "evidence_type": "network", "fail_condition": "Fails when any load balancer in scope has no HTTPS listener with an ACM certificate.", "fsbp": [], "id": "aws.soc2.service_posture.alb_tls_listener_present", "name": "Load balancers terminate TLS with an ACM certificate", "pass_condition": "Passes when every load balancer in scope has an HTTPS listener with an ACM certificate.", "read_only": true, "resource_family": "load-balancer", "service": "ELBv2", "severity": "high", "soc2": [ "CC6.6", "CC6.7" ] }, { "area": "data", "checks": "AWS Backup has at least one backup plan, which shows backups are scheduled by policy instead of by memory.", "cis": [], "evidence_type": "encryption", "fail_condition": "Fails when AWS Backup has no backup plan at all.", "fsbp": [], "id": "aws.soc2.service_posture.backup_plans_observed", "name": "AWS Backup has at least one backup plan", "pass_condition": "Passes when AWS Backup has at least one backup plan.", "read_only": true, "resource_family": "account", "service": "AWS Backup", "severity": "medium", "soc2": [ "A1.2", "A1.3" ] }, { "area": "edge", "checks": "Every CloudFront distribution redirects viewers to HTTPS or accepts only HTTPS, so visitors never browse your site in plain text.", "cis": [], "evidence_type": "network", "fail_condition": "Fails when any CloudFront distribution still serves viewers over plain HTTP.", "fsbp": [], "id": "aws.soc2.service_posture.cloudfront_viewer_https_policy_enforced", "name": "CloudFront distributions require HTTPS from viewers", "pass_condition": "Passes when every CloudFront distribution redirects viewers to HTTPS or allows only HTTPS.", "read_only": true, "resource_family": "cloudfront-distribution", "service": "CloudFront", "severity": "high", "soc2": [ "CC6.6", "CC6.7" ] }, { "area": "monitoring", "checks": "The account has at least one CloudWatch alarm, which shows that at least one metric threshold is watched rather than none.", "cis": [], "evidence_type": "monitoring", "fail_condition": "Fails when the account has no CloudWatch alarms.", "fsbp": [], "id": "aws.soc2.service_posture.cloudwatch_alarms_present", "name": "The account has at least one CloudWatch alarm", "pass_condition": "Passes when the account has at least one CloudWatch alarm.", "read_only": true, "resource_family": "account", "service": "CloudWatch", "severity": "medium", "soc2": [ "A1.1", "CC7.2" ] }, { "area": "logging", "checks": "Every CloudWatch log group has an explicit retention period, so logs are neither deleted by accident nor kept forever by default.", "cis": [], "evidence_type": "logging", "fail_condition": "Fails when any CloudWatch log group is set to never expire.", "fsbp": [], "id": "aws.soc2.service_posture.cloudwatch_log_group_retention_configured", "name": "CloudWatch log groups have a retention period", "pass_condition": "Passes when every CloudWatch log group has a retention period set.", "read_only": true, "resource_family": "log-group", "service": "CloudWatch Logs", "severity": "medium", "soc2": [ "CC2.1", "CC7.2" ] }, { "area": "iam", "checks": "Each Cognito user pool has a password policy set, so sign-in rules for your application's users are defined rather than left at defaults.", "cis": [], "evidence_type": "identity", "fail_condition": "Fails when any Cognito user pool in scope has no password policy defined.", "fsbp": [], "id": "aws.soc2.service_posture.cognito_password_policy_present", "name": "Cognito user pools define a password policy", "pass_condition": "Passes when every Cognito user pool in scope has a password policy defined.", "read_only": true, "resource_family": "user-pool", "service": "Cognito", "severity": "medium", "soc2": [ "CC6.1", "CC6.2" ] }, { "area": "monitoring", "checks": "AWS Config is actively recording resource changes in each scoped Region, which gives you a history of what changed and when.", "cis": [ "3.3" ], "evidence_type": "monitoring", "fail_condition": "Fails when any Region in scope has no Config recorder, or one that is stopped.", "fsbp": [], "id": "aws.soc2.service_posture.config_recorder_recording", "name": "AWS Config recorders are actively recording", "pass_condition": "Passes when an AWS Config recorder is recording in every Region in scope.", "read_only": true, "resource_family": "region", "service": "AWS Config", "severity": "high", "soc2": [ "CC7.1", "CC7.2", "CC8.1" ] }, { "area": "data", "checks": "Every DynamoDB table has point-in-time recovery turned on, so a table can be restored to any second in the last 35 days.", "cis": [], "evidence_type": "encryption", "fail_condition": "Fails when any DynamoDB table in scope has point-in-time recovery turned off.", "fsbp": [], "id": "aws.soc2.service_posture.dynamodb_pitr_enabled", "name": "DynamoDB tables have point-in-time recovery", "pass_condition": "Passes when every DynamoDB table in scope has point-in-time recovery enabled.", "read_only": true, "resource_family": "dynamodb-table", "service": "DynamoDB", "severity": "medium", "soc2": [ "A1.2", "A1.3" ] }, { "area": "data", "checks": "EBS encryption by default is on in each scoped Region, so every new volume is encrypted without anyone having to remember.", "cis": [ "2.2.1" ], "evidence_type": "encryption", "fail_condition": "Fails when EBS encryption by default is off in any Region in scope.", "fsbp": [], "id": "aws.soc2.service_posture.ebs_encryption_by_default_enabled", "name": "EBS encryption by default is on in each scoped Region", "pass_condition": "Passes when EBS encryption by default is on in every Region in scope.", "read_only": true, "resource_family": "region", "service": "EBS", "severity": "high", "soc2": [ "CC6.1", "CC6.7" ] }, { "area": "compute", "checks": "Every EC2 instance requires IMDSv2 for its metadata service, which blocks the request-forgery path that steals instance credentials.", "cis": [ "5.6" ], "evidence_type": "configuration", "fail_condition": "Fails when any EC2 instance in scope still accepts IMDSv1 requests.", "fsbp": [], "id": "aws.soc2.service_posture.ec2_imdsv2_required", "name": "EC2 instances require IMDSv2", "pass_condition": "Passes when every EC2 instance in scope requires IMDSv2 session tokens.", "read_only": true, "resource_family": "ec2-instance", "service": "EC2", "severity": "medium", "soc2": [ "CC6.1", "CC6.6" ] }, { "area": "compute", "checks": "Every ECR repository scans images for known vulnerabilities on push or through Amazon Inspector, so a vulnerable image is flagged early.", "cis": [], "evidence_type": "configuration", "fail_condition": "Fails when any ECR repository has neither scan on push nor Inspector coverage.", "fsbp": [], "id": "aws.soc2.service_posture.ecr_image_scanning_enabled", "name": "ECR repositories scan images on push or through Inspector", "pass_condition": "Passes when every ECR repository scans on push or is covered by Inspector scanning.", "read_only": true, "resource_family": "ecr-repo", "service": "ECR", "severity": "medium", "soc2": [ "CC6.8", "CC7.1" ] }, { "area": "monitoring", "checks": "GuardDuty has an enabled detector in each scoped Region, so AWS threat detection is watching account activity everywhere you run.", "cis": [], "evidence_type": "monitoring", "fail_condition": "Fails when any Region in scope has no enabled GuardDuty detector.", "fsbp": [], "id": "aws.soc2.service_posture.guardduty_detector_enabled", "name": "GuardDuty has an enabled detector in each scoped Region", "pass_condition": "Passes when GuardDuty has an enabled detector in every Region in scope.", "read_only": true, "resource_family": "region", "service": "GuardDuty", "severity": "high", "soc2": [ "A1.3", "CC6.6", "CC7.2" ] }, { "area": "data", "checks": "Every customer-managed KMS key has automatic rotation turned on, so a key is not used unchanged year after year.", "cis": [ "3.6" ], "evidence_type": "encryption", "fail_condition": "Fails when any customer-managed KMS key has automatic rotation turned off.", "fsbp": [], "id": "aws.soc2.service_posture.kms_customer_key_rotation_enabled", "name": "Customer-managed KMS keys rotate automatically", "pass_condition": "Passes when every customer-managed KMS key has automatic rotation enabled.", "read_only": true, "resource_family": "kms-key", "service": "KMS", "severity": "medium", "soc2": [ "CC6.1", "CC6.7" ] }, { "area": "governance", "checks": "The AWS Organization applies service control policies beyond the default allow-all, so guardrails hold even when a single account is misconfigured.", "cis": [], "evidence_type": "configuration", "fail_condition": "Fails when the organization relies only on the default allow-all policy.", "fsbp": [], "id": "aws.soc2.service_posture.organizations_scp_guardrails_present", "name": "The organization applies service control policy guardrails", "pass_condition": "Passes when the organization has service control policies attached beyond the default.", "read_only": true, "resource_family": "organization", "service": "AWS Organizations", "severity": "medium", "soc2": [ "CC5.1", "CC6.1" ] }, { "area": "governance", "checks": "Critical resources carry an Owner tag, so when something looks wrong there is a named person or team to ask.", "cis": [], "evidence_type": "configuration", "fail_condition": "Fails when any critical resource in scope has no Owner tag.", "fsbp": [], "id": "aws.soc2.service_posture.owner_tags_present", "name": "Critical resources carry an Owner tag", "pass_condition": "Passes when every critical resource in scope has an Owner tag.", "read_only": true, "resource_family": "tagged-resource-set", "service": "Tagging", "severity": "medium", "soc2": [ "CC1.3", "CC6.1" ] }, { "area": "network", "checks": "No RDS database instance is marked publicly accessible, so a database does not receive a public address by accident.", "cis": [ "2.3.3" ], "evidence_type": "network", "fail_condition": "Fails when any RDS instance in scope is marked publicly accessible.", "fsbp": [], "id": "aws.soc2.service_posture.rds_public_access_disabled", "name": "RDS instances are not publicly accessible", "pass_condition": "Passes when no RDS instance in scope is marked publicly accessible.", "read_only": true, "resource_family": "rds-instance", "service": "RDS", "severity": "high", "soc2": [ "CC6.1", "CC6.6" ] }, { "area": "data", "checks": "Every S3 bucket encrypts new objects by default, so a missed upload setting does not leave data unencrypted.", "cis": [], "evidence_type": "encryption", "fail_condition": "Fails when any S3 bucket has no default encryption configured.", "fsbp": [], "id": "aws.soc2.service_posture.s3_default_encryption_enabled", "name": "S3 buckets encrypt objects by default", "pass_condition": "Passes when every S3 bucket has default encryption configured.", "read_only": true, "resource_family": "bucket", "service": "S3", "severity": "high", "soc2": [ "CC6.1", "CC6.7" ] }, { "area": "network", "checks": "Every S3 bucket policy denies requests that do not use TLS, so data in transit to and from the bucket is encrypted.", "cis": [ "2.1.1" ], "evidence_type": "network", "fail_condition": "Fails when any S3 bucket policy still accepts requests made without TLS.", "fsbp": [], "id": "aws.soc2.service_posture.s3_ssl_only_policy_present", "name": "S3 bucket policies deny requests that are not over TLS", "pass_condition": "Passes when every S3 bucket policy denies requests made without TLS.", "read_only": true, "resource_family": "bucket", "service": "S3", "severity": "high", "soc2": [ "CC6.6", "CC6.7" ] }, { "area": "compute", "checks": "Every running EC2 instance reports to Systems Manager, so patching and access can be managed without an open SSH port.", "cis": [], "evidence_type": "configuration", "fail_condition": "Fails when any running EC2 instance in scope is missing from Systems Manager.", "fsbp": [], "id": "aws.soc2.service_posture.ssm_managed_instance_coverage", "name": "Running EC2 instances report to Systems Manager", "pass_condition": "Passes when every running EC2 instance in scope reports to Systems Manager.", "read_only": true, "resource_family": "ec2-instance", "service": "SSM", "severity": "medium", "soc2": [ "CC6.1", "CC7.1" ] }, { "area": "logging", "checks": "Every VPC has Flow Logs turned on, so there is a record of which network connections were accepted or rejected.", "cis": [ "3.7" ], "evidence_type": "logging", "fail_condition": "Fails when any VPC in scope has no flow log.", "fsbp": [], "id": "aws.soc2.service_posture.vpc_flow_logs_enabled", "name": "VPCs capture Flow Logs", "pass_condition": "Passes when every VPC in scope has an active flow log.", "read_only": true, "resource_family": "vpc", "service": "VPC", "severity": "high", "soc2": [ "CC2.1", "CC7.2", "P6.1" ] } ], "library_size": 30, "schema_version": 1 }