CISAWSF

The CIS AWS Foundations (CISAWSF) benchmark is a compliance standard for securing Amazon Web Services (AWS) resources. It offers prescriptive guidance for configuring security options on AWS services in accordance with industry best practices.

Compliance checks for Amazon Web Services

Low

CloudTrail changes alarm

Medium

Ensure CloudTrail Log File Integrity Validation is enabled

Medium

Ensure CloudWatch Logs service is configured to monitor CloudTrail trail logs

Medium

Ensure S3 buckets associated with CloudTrail trails are configured with sever access logging

High

Ensure CloudTrail trails have multi-region enabled

High

Ensure S3 buckets for CloudTrail logs are encrypted at rest

High

Ensure stopped DocumentDB instances are removed

Critical

Ensure DocumentDB database instances have storage encryption enabled

High

IAM Group allows inline Admin access (*:*)

Medium

Ensure IAM policies that allow over privileges access to data are not created

AWS Well-Architected Framework

Low

Internet Gateway (IGW) changes alarm

Low

Ensure EKS Private access is enabled

Critical

Ensure there is no unrestricted inbound access to TCP port 23 (Telnet)

AWS Well-Architected Framework

Critical

Ensure default security groups are not in use by ElastiCache

Critical

Ensure default security groups are not in use by OpenSearch

Critical

Ensure default security groups are not in use by ECS

Critical

Ensure default security groups are not in use by ELB

Critical

Ensure default security groups are not in use by RDS

Critical

Ensure default security groups are not in use by ALB

Critical

Ensure default security groups are not in use by MSK

Critical

Ensure there is no unrestricted inbound access to TCP port 22 (SSH)

Critical

Ensure there is no unrestricted inbound access to TCP port 3389 (RDP)

Low

Route Table changes alarm

Low

IAM Policy changes alarm

Low

S3 Bucket changes alarm

Low

Security Group (SG) changes alarm

Low

VPC Peering changes alarm

Low

Transit Gateway (TGW) changes alarm

Low

NAT Gateway changes alarm

Low

VPC changes alarm

Critical

IAM User with inline Admin access (*:*)

Critical

IAM Role with inline Admin access (*:*)

AWS Well-Architected Framework

Critical

Ensure IAM password policy expires passwords within 90 days or less

Medium

Ensure IAM password policy requires minimum length of 14 or greater

Medium

Ensure IAM password policy require at least one symbol

AWS Well-Architected Framework

Medium

Ensure IAM password policy requires at least one uppercase letter

AWS Well-Architected Framework

Medium

Ensure IAM password policy require at least one number

AWS Well-Architected Framework

Medium

Ensure IAM password policy require at least one lowercase letter

AWS Well-Architected Framework

Medium

Ensure IAM password policy prevents password reuse

Critical

IAM Role with Admin access (*:*)

AWS Well-Architected Framework

Low

Cross transit connectivity is allowed by Pod

Low

Cross transit connectivity is allowed by EC2

Low

Cross transit connectivity is allowed by ECS

Low

Cross transit connectivity is allowed by Lambda

Critical

Ensure IAM policies that allow full "*:*" administrative privileges are not created

AWS Well-Architected Framework

Medium

Ensure stopped RDS instances are removed

Medium

Ensure EC2 instance uses an IAM profile

Medium

Ensure AWS EKS cluster has secrets encryption enabled

Medium

Ensure IAM users receive permissions only through groups

AWS Well-Architected Framework

Medium

Ensure VPC flow logging is enabled in all VPCs

Low

Cross peering connectivity is allowed by Lambda

Medium

Ensure default security groups do not allow unrestricted traffic

Low

Cross peering connectivity is allowed by Pod

Low

Cross peering connectivity is allowed by ECS Task

Low

Cross peering connectivity is allowed by EC2

Medium

Ensure IAM users are members of at least one IAM group

AWS Well-Architected Framework

Medium

Ensure IAM User has no inline policy

AWS Well-Architected Framework

Critical

Ensure all IAM users with console access have MFA enabled

Medium

Ensure CloudTrail logs are encrypted at rest

Medium

Ensure EKS Public access is disabled

Medium

Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

Medium

Elastic IP not in use

AWS Well-Architected Framework

Medium

Ensure stopped EC2 instances are removed

AWS Foundational Security Best Practices Controls

Medium

Ensure data stored in the S3 bucket is securely encrypted at rest

Medium

Ensure launch wizard security groups are not in use by EC2

Critical

Ensure RDS database instances have storage encryption enabled