mroberts/claude-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
37fc3fb2911c2b2c9ea8c443ead9304b971b7af3
claude-plugin/plugins/reviews/skills/audit-terraform/data/controls/cis.json
T
mroberts f5934181ec Move the code and terraform audits into the reviews plugin 
Copy the standalone code-review and terraform-review skills into
plugins/reviews as audit-code and audit-terraform. The rename separates the
automated, linter-driven audits from the guided review-pr walkthrough that
already lived here.

Resolve bundled script paths through ${SKILL_DIR}, exported in a new step 0.
CLAUDE_PLUGIN_ROOT is not set in the Bash tool environment, so the obvious
substitution would have expanded to nothing and broken every collection
script invocation.

Replace the PLAN and DESIGN docs with READMEs written from the current
SKILL.md and scripts. The old docs had drifted badly: they named semgrep
where the code calls opengrep, scoped five review agents where there are
now eight, and predated Lua, PowerShell, and GitHub Actions support.

Add CONSISTENCY_NORMS to the audit-terraform agent inputs. The collection
script writes consistency_norms.json and the agent prompt declares it, but
SKILL.md never listed it, leaving the variable unsubstituted.

Drop the --ingest-verdicts instruction from both skills. review_stats.py
parses no arguments, so the ref-mode verdict template it told users to feed
back could never be read.

Point audit-terraform's smoke test at README.md and resolve its fixture
paths relative to the test file rather than an absolute home directory.

Tests: 197 passing (audit-code), 106 passing (audit-terraform).
2026-07-21 11:11:05 -05:00

1543 lines
54 KiB
JSON
Raw Blame History

{
"source": "cis",
"fetched_at": "2026-05-12T17:17:42.841641+00:00",
"controls": [
{
"control_id": "CIS Account.1",
"title": "Security contact information should be provided for an AWS account",
"severity": "medium",
"resource_types": [
"aws_account_alternate_contact"
],
"requirement": "CIS v5.0.0 \u00a71.2, v3.0.0 \u00a71.2, v1.4.0 \u00a71.2, v1.2.0 \u00a71.18",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudTrail.1",
"title": "CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events",
"severity": "medium",
"resource_types": [
"aws_cloudtrail"
],
"requirement": "CIS v5.0.0 \u00a73.1, v3.0.0 \u00a73.1, v1.4.0 \u00a73.1, v1.2.0 \u00a72.1",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudTrail.2",
"title": "CloudTrail should have encryption at-rest enabled",
"severity": "medium",
"resource_types": [
"aws_cloudtrail"
],
"requirement": "CIS v5.0.0 \u00a73.5, v3.0.0 \u00a73.5, v1.4.0 \u00a73.7, v1.2.0 \u00a72.7",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudTrail.4",
"title": "CloudTrail log file validation should be enabled",
"severity": "medium",
"resource_types": [
"aws_cloudtrail"
],
"requirement": "CIS v5.0.0 \u00a73.2, v3.0.0 \u00a73.2, v1.4.0 \u00a73.2, v1.2.0 \u00a72.2",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudTrail.5",
"title": "CloudTrail trails should be integrated with Amazon CloudWatch Logs",
"severity": "medium",
"resource_types": [
"aws_cloudtrail"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a73.4, v1.2.0 \u00a72.4",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudTrail.6",
"title": "Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible",
"severity": "medium",
"resource_types": [
"aws_cloudtrail"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a73.3, v1.2.0 \u00a72.3",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudTrail.7",
"title": "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket",
"severity": "medium",
"resource_types": [
"aws_cloudtrail"
],
"requirement": "CIS v5.0.0 \u00a73.4, v3.0.0 \u00a73.4, v1.4.0 \u00a73.6, v1.2.0 \u00a72.6",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.1",
"title": "A log metric filter and alarm should exist for usage of the \"root\" user",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.3, v1.2.0 \u00a73.3",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.2",
"title": "Ensure a log metric filter and alarm exist for unauthorized API calls",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.2.0 \u00a73.1",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.3",
"title": "Ensure a log metric filter and alarm exist for Management Console sign-in without MFA",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.2.0 \u00a73.2",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.4",
"title": "Ensure a log metric filter and alarm exist for IAM policy changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.4, v1.2.0 \u00a73.4",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.5",
"title": "Ensure a log metric filter and alarm exist for CloudTrail configuration changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.5, v1.2.0 \u00a73.5",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.6",
"title": "Ensure a log metric filter and alarm exist for AWS Management Console authentication failures",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.6, v1.2.0 \u00a73.6",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.7",
"title": "Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.7, v1.2.0 \u00a73.7",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.8",
"title": "Ensure a log metric filter and alarm exist for S3 bucket policy changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.8, v1.2.0 \u00a73.8",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.9",
"title": "Ensure a log metric filter and alarm exist for AWS Config configuration changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.9, v1.2.0 \u00a73.9",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.10",
"title": "Ensure a log metric filter and alarm exist for security group changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.10, v1.2.0 \u00a73.10",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.11",
"title": "Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.11, v1.2.0 \u00a73.11",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.12",
"title": "Ensure a log metric filter and alarm exist for changes to network gateways",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.12, v1.2.0 \u00a73.12",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.13",
"title": "Ensure a log metric filter and alarm exist for route table changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.13, v1.2.0 \u00a73.13",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS CloudWatch.14",
"title": "Ensure a log metric filter and alarm exist for VPC changes",
"severity": "medium",
"resource_types": [],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a74.14, v1.2.0 \u00a73.14",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS Config.1",
"title": "AWS Config should be enabled and use the service-linked role for resource recording",
"severity": "medium",
"resource_types": [
"aws_config_configuration_recorder",
"aws_config_delivery_channel",
"aws_config_config_rule"
],
"requirement": "CIS v5.0.0 \u00a73.3, v3.0.0 \u00a73.3, v1.4.0 \u00a73.5, v1.2.0 \u00a72.5",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.2",
"title": "VPC default security groups should not allow inbound or outbound traffic",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a75.5, v3.0.0 \u00a75.4, v1.4.0 \u00a75.3, v1.2.0 \u00a74.3",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.6",
"title": "VPC flow logging should be enabled in all VPCs",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a73.7, v3.0.0 \u00a73.7, v1.4.0 \u00a73.9, v1.2.0 \u00a72.9",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.7",
"title": "EBS default encryption should be enabled",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a75.1.1, v3.0.0 \u00a72.2.1, v1.4.0 \u00a72.2.1, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.8",
"title": "EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a75.7, v3.0.0 \u00a75.6, v1.4.0 \u00a7Not supported, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.13",
"title": "Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 replaced by requirements 5.3 and 5.4, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 replaced by requirements 5.2 and 5.3, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 replaced by requirements 5.2 and 5.3, v1.2.0 \u00a74.1",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.14",
"title": "Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 replaced by requirements 5.3 and 5.4, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 replaced by requirements 5.2 and 5.3, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 replaced by requirements 5.2 and 5.3, v1.2.0 \u00a74.2",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.21",
"title": "Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a75.2, v3.0.0 \u00a75.1, v1.4.0 \u00a75.1, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.53",
"title": "EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a75.3, v3.0.0 \u00a75.2, v1.4.0 \u00a7Not supported, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EC2.54",
"title": "EC2 security groups should not allow ingress from ::/0 to remote server administration ports",
"severity": "medium",
"resource_types": [
"aws_instance",
"aws_security_group",
"aws_security_group_rule",
"aws_vpc",
"aws_subnet",
"aws_network_acl",
"aws_ebs_volume",
"aws_ebs_default_kms_key",
"aws_eip",
"aws_nat_gateway",
"aws_internet_gateway",
"aws_route_table",
"aws_vpc_endpoint",
"aws_flow_log",
"aws_default_security_group"
],
"requirement": "CIS v5.0.0 \u00a75.4, v3.0.0 \u00a75.3, v1.4.0 \u00a7Not supported, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EFS.1",
"title": "Elastic File System should be configured to encrypt file data at-rest using AWS KMS",
"severity": "medium",
"resource_types": [
"aws_efs_file_system",
"aws_efs_file_system_policy",
"aws_efs_access_point"
],
"requirement": "CIS v5.0.0 \u00a72.3.1, v3.0.0 \u00a72.4.1, v1.4.0 \u00a7Not supported, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS EFS.8",
"title": "EFS file systems should be encrypted at rest",
"severity": "medium",
"resource_types": [
"aws_efs_file_system",
"aws_efs_file_system_policy",
"aws_efs_access_point"
],
"requirement": "CIS v5.0.0 \u00a72.3.1, v3.0.0 \u00a7Not supported, v1.4.0 \u00a7Not supported, v1.2.0 \u00a7Not supported",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.1",
"title": "IAM policies should not allow full \"*\" administrative privileges",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported, v3.0.0 \u00a7Not supported, v1.4.0 \u00a71.16, v1.2.0 \u00a71.22",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.2",
"title": "IAM users should not have IAM policies attached",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.14, v3.0.0 \u00a71.15, v1.4.0 \u00a7Not supported, v1.2.0 \u00a71.16",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.3",
"title": "IAM users' access keys should be rotated every 90 days or less",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.13, v3.0.0 \u00a71.14, v1.4.0 \u00a71.14, v1.2.0 \u00a71.4",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.4",
"title": "IAM root user access key should not exist",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.3, v3.0.0 \u00a71.4, v1.4.0 \u00a71.4, v1.2.0 \u00a71.12",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.5",
"title": "MFA should be enabled for all IAM users that have a console password",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.9, v3.0.0 \u00a71.10, v1.4.0 \u00a71.10, v1.2.0 \u00a71.2",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.6",
"title": "Hardware MFA should be enabled for the root user",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.5, v3.0.0 \u00a71.6, v1.4.0 \u00a71.6, v1.2.0 \u00a71.14",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.8",
"title": "Unused IAM user credentials should be removed",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 see[IAM.22] IAM user credentials unused for 45 days should be removedinstead, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 see[IAM.22] IAM user credentials unused for 45 days should be removedinstead, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 see[IAM.22] IAM user credentials unused for 45 days should be removedinstead, v1.2.0 \u00a71.3",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.9",
"title": "MFA should be enabled for the root user",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.4, v3.0.0 \u00a71.5, v1.4.0 \u00a71.5, v1.2.0 \u00a71.13",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.11",
"title": "Ensure IAM password policy requires at least one uppercase letter",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.2.0 \u00a71.5",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.12",
"title": "Ensure IAM password policy requires at least one lowercase letter",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.2.0 \u00a71.6",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.13",
"title": "Ensure IAM password policy requires at least one symbol",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.2.0 \u00a71.7",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.14",
"title": "Ensure IAM password policy requires at least one number",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.2.0 \u00a71.8",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.15",
"title": "Ensure IAM password policy requires minimum password length of 14 or greater",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.7, v3.0.0 \u00a71.8, v1.4.0 \u00a71.8, v1.2.0 \u00a71.9",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.16",
"title": "Ensure IAM password policy prevents password reuse",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.8, v3.0.0 \u00a71.9, v1.4.0 \u00a71.9, v1.2.0 \u00a71.10",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.17",
"title": "Ensure IAM password policy expires passwords within 90 days or less",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.2.0 \u00a71.11",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.18",
"title": "Ensure a support role has been created to manage incidents with AWS Support",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.16, v3.0.0 \u00a71.17, v1.4.0 \u00a71.17, v1.2.0 \u00a71.2",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.20",
"title": "Avoid the use of the root user",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS removed this requirement, v1.2.0 \u00a71.1",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.22",
"title": "IAM user credentials unused for 45 days should be removed",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.11, v3.0.0 \u00a71.12, v1.4.0 \u00a71.12, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.26",
"title": "Expired SSL/TLS certificates managed in IAM should be removed",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.18, v3.0.0 \u00a71.19, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.27",
"title": "IAM identities should not have the AWSCloudShellFullAccess policy attached",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.21, v3.0.0 \u00a71.22, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS IAM.28",
"title": "IAM Access Analyzer external access analyzer should be enabled",
"severity": "medium",
"resource_types": [
"aws_iam_user",
"aws_iam_role",
"aws_iam_policy",
"aws_iam_user_policy",
"aws_iam_role_policy",
"aws_iam_access_key",
"aws_iam_account_password_policy",
"aws_iam_group",
"aws_iam_user_policy_attachment",
"aws_iam_role_policy_attachment"
],
"requirement": "CIS v5.0.0 \u00a71.19, v3.0.0 \u00a71.20, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS KMS.4",
"title": "AWS KMS key rotation should be enabled",
"severity": "medium",
"resource_types": [
"aws_kms_key",
"aws_kms_alias"
],
"requirement": "CIS v5.0.0 \u00a73.6, v3.0.0 \u00a73.6, v1.4.0 \u00a73.8, v1.2.0 \u00a72.8",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS Macie.1",
"title": "Amazon Macie should be enabled",
"severity": "medium",
"resource_types": [
"aws_macie2_account"
],
"requirement": "CIS v5.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 manual check, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 manual check",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS RDS.2",
"title": "RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration",
"severity": "medium",
"resource_types": [
"aws_db_instance",
"aws_rds_cluster",
"aws_db_subnet_group",
"aws_db_parameter_group",
"aws_rds_cluster_instance",
"aws_db_snapshot",
"aws_db_event_subscription"
],
"requirement": "CIS v5.0.0 \u00a72.2.3, v3.0.0 \u00a72.3.3, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS RDS.3",
"title": "RDS DB instances should have encryption at-rest enabled",
"severity": "medium",
"resource_types": [
"aws_db_instance",
"aws_rds_cluster",
"aws_db_subnet_group",
"aws_db_parameter_group",
"aws_rds_cluster_instance",
"aws_db_snapshot",
"aws_db_event_subscription"
],
"requirement": "CIS v5.0.0 \u00a72.2.1, v3.0.0 \u00a72.3.1, v1.4.0 \u00a72.3.1, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS RDS.5",
"title": "RDS DB instances should be configured with multiple Availability Zones",
"severity": "medium",
"resource_types": [
"aws_db_instance",
"aws_rds_cluster",
"aws_db_subnet_group",
"aws_db_parameter_group",
"aws_rds_cluster_instance",
"aws_db_snapshot",
"aws_db_event_subscription"
],
"requirement": "CIS v5.0.0 \u00a72.2.4, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS RDS.13",
"title": "RDS automatic minor version upgrades should be enabled",
"severity": "medium",
"resource_types": [
"aws_db_instance",
"aws_rds_cluster",
"aws_db_subnet_group",
"aws_db_parameter_group",
"aws_rds_cluster_instance",
"aws_db_snapshot",
"aws_db_event_subscription"
],
"requirement": "CIS v5.0.0 \u00a72.2.2, v3.0.0 \u00a72.3.2, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS RDS.15",
"title": "RDS DB clusters should be configured for multiple Availability Zones",
"severity": "medium",
"resource_types": [
"aws_db_instance",
"aws_rds_cluster",
"aws_db_subnet_group",
"aws_db_parameter_group",
"aws_rds_cluster_instance",
"aws_db_snapshot",
"aws_db_event_subscription"
],
"requirement": "CIS v5.0.0 \u00a72.2.4, v3.0.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.4.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS S3.1",
"title": "S3 general purpose buckets should have block public access settings enabled",
"severity": "medium",
"resource_types": [
"aws_s3_bucket",
"aws_s3_bucket_policy",
"aws_s3_bucket_public_access_block",
"aws_s3_bucket_versioning",
"aws_s3_bucket_server_side_encryption_configuration",
"aws_s3_bucket_logging",
"aws_s3_bucket_lifecycle_configuration",
"aws_s3_bucket_acl"
],
"requirement": "CIS v5.0.0 \u00a72.1.4, v3.0.0 \u00a72.1.4, v1.4.0 \u00a72.1.5, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS S3.5",
"title": "S3 general purpose buckets should require requests to use SSL",
"severity": "medium",
"resource_types": [
"aws_s3_bucket",
"aws_s3_bucket_policy",
"aws_s3_bucket_public_access_block",
"aws_s3_bucket_versioning",
"aws_s3_bucket_server_side_encryption_configuration",
"aws_s3_bucket_logging",
"aws_s3_bucket_lifecycle_configuration",
"aws_s3_bucket_acl"
],
"requirement": "CIS v5.0.0 \u00a72.1.1, v3.0.0 \u00a72.1.1, v1.4.0 \u00a72.1.2, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS S3.8",
"title": "S3 general purpose buckets should block public access",
"severity": "medium",
"resource_types": [
"aws_s3_bucket",
"aws_s3_bucket_policy",
"aws_s3_bucket_public_access_block",
"aws_s3_bucket_versioning",
"aws_s3_bucket_server_side_encryption_configuration",
"aws_s3_bucket_logging",
"aws_s3_bucket_lifecycle_configuration",
"aws_s3_bucket_acl"
],
"requirement": "CIS v5.0.0 \u00a72.1.4, v3.0.0 \u00a72.1.4, v1.4.0 \u00a72.1.5, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
},
{
"control_id": "CIS S3.20",
"title": "S3 general purpose buckets should have MFA delete enabled",
"severity": "medium",
"resource_types": [
"aws_s3_bucket",
"aws_s3_bucket_policy",
"aws_s3_bucket_public_access_block",
"aws_s3_bucket_versioning",
"aws_s3_bucket_server_side_encryption_configuration",
"aws_s3_bucket_logging",
"aws_s3_bucket_lifecycle_configuration",
"aws_s3_bucket_acl"
],
"requirement": "CIS v5.0.0 \u00a72.1.2, v3.0.0 \u00a72.1.2, v1.4.0 \u00a72.1.3, v1.2.0 \u00a7Not supported \u00e2\u0080\u0093 CIS added this requirement in later versions",
"source_url": "https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html"
}
],
"by_resource_type": {
"aws_account_alternate_contact": [
"CIS Account.1"
],
"aws_cloudtrail": [
"CIS CloudTrail.1",
"CIS CloudTrail.2",
"CIS CloudTrail.4",
"CIS CloudTrail.5",
"CIS CloudTrail.6",
"CIS CloudTrail.7"
],
"aws_config_config_rule": [
"CIS Config.1"
],
"aws_config_configuration_recorder": [
"CIS Config.1"
],
"aws_config_delivery_channel": [
"CIS Config.1"
],
"aws_db_event_subscription": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_db_instance": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_db_parameter_group": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_db_snapshot": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_db_subnet_group": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_default_security_group": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_ebs_default_kms_key": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_ebs_volume": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_efs_access_point": [
"CIS EFS.1",
"CIS EFS.8"
],
"aws_efs_file_system": [
"CIS EFS.1",
"CIS EFS.8"
],
"aws_efs_file_system_policy": [
"CIS EFS.1",
"CIS EFS.8"
],
"aws_eip": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_flow_log": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_iam_access_key": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_account_password_policy": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_group": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_policy": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_role": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_role_policy": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_role_policy_attachment": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_user": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_user_policy": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_iam_user_policy_attachment": [
"CIS IAM.1",
"CIS IAM.11",
"CIS IAM.12",
"CIS IAM.13",
"CIS IAM.14",
"CIS IAM.15",
"CIS IAM.16",
"CIS IAM.17",
"CIS IAM.18",
"CIS IAM.2",
"CIS IAM.20",
"CIS IAM.22",
"CIS IAM.26",
"CIS IAM.27",
"CIS IAM.28",
"CIS IAM.3",
"CIS IAM.4",
"CIS IAM.5",
"CIS IAM.6",
"CIS IAM.8",
"CIS IAM.9"
],
"aws_instance": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_internet_gateway": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_kms_alias": [
"CIS KMS.4"
],
"aws_kms_key": [
"CIS KMS.4"
],
"aws_macie2_account": [
"CIS Macie.1"
],
"aws_nat_gateway": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_network_acl": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_rds_cluster": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_rds_cluster_instance": [
"CIS RDS.13",
"CIS RDS.15",
"CIS RDS.2",
"CIS RDS.3",
"CIS RDS.5"
],
"aws_route_table": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_s3_bucket": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_acl": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_lifecycle_configuration": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_logging": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_policy": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_public_access_block": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_server_side_encryption_configuration": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_s3_bucket_versioning": [
"CIS S3.1",
"CIS S3.20",
"CIS S3.5",
"CIS S3.8"
],
"aws_security_group": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_security_group_rule": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_subnet": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_vpc": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
],
"aws_vpc_endpoint": [
"CIS EC2.13",
"CIS EC2.14",
"CIS EC2.2",
"CIS EC2.21",
"CIS EC2.53",
"CIS EC2.54",
"CIS EC2.6",
"CIS EC2.7",
"CIS EC2.8"
]
}
}
Reference in New Issue View Git Blame Copy Permalink