Controls

CIS v1 > 2 Logging > 2.07 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1 > 2 Logging > 2.08 Ensure rotation for customer created CMKs is enabled (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v1 > 2 Logging > 2.09 Ensure VPC flow logging is enabled in all VPCs (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v1 > 3 Monitoring > 3.01 Ensure a log metric filter and alarm exist for unauthorized API calls (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1 > 3 Monitoring > 3.02 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

CIS v1 > 3 Monitoring > 3.03 Ensure a log metric filter and alarm exist for usage of "root" account (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1 > 3 Monitoring > 3.04 Ensure a log metric filter and alarm exist for IAM policy changes (Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.09 Log and Alert on Unsuccessful Administrative Account Login

CIS v1 > 3 Monitoring > 3.05 Ensure a log metric filter and alarm exist for CloudTrail configuration changes (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1 > 3 Monitoring > 3.06 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v1 > 3 Monitoring > 3.07 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1 > 3 Monitoring > 3.08 Ensure a log metric filter and alarm exist for S3 bucket policy changes (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1 > 3 Monitoring > 3.09 Ensure a log metric filter and alarm exist for AWS Config configuration changes (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1 > 3 Monitoring > 3.10 Ensure a log metric filter and alarm exist for security group changes (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v1 > 3 Monitoring > 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) (Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.08 Log and Alert on Changes to Administrative Group Membership

CIS v1 > 3 Monitoring > 3.12 Ensure a log metric filter and alarm exist for changes to network gateways (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.03 Use Automated Tools to Verify Standard Device Configurations and Detect Changes

CIS v1 > 3 Monitoring > 3.13 Ensure a log metric filter and alarm exist for route table changes (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1 > 3 Monitoring > 3.14 Ensure a log metric filter and alarm exist for VPC changes (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1 > 4 Networking > 4.01 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 (Scored)

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.05 Implement Automated Configuration Monitoring Systems

CIS v1 > 4 Networking > 4.02 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v1 > 4 Networking > 4.03 Ensure the default security group of every VPC restricts all traffic (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v1 > 4 Networking > 4.04 Ensure routing tables for VPC peering are "least access" (Not Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v1 > 1 Identity and Access Management

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS

CIS v1 > 2 Logging

CIS

CIS v1 > 3 Monitoring

CIS

CIS v1 > 4 Networking

CIS

CIS v1.4

CIS v1.4 > 1 - Identity and Access Management > 1.01 - Maintain current contact details (Manual)

CIS

CIS v1.4 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered (Manual)

CIS > Controls v7 > 19 Incident Response and Management > 19.03 Designate Management Personnel to Support Incident Handling

CIS v1.4 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account (Manual)

CIS > Controls v7 > 19 Incident Response and Management

CIS v1.4 > 1 - Identity and Access Management > 1.04 - Ensure no 'root' user account access key exists (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 1 - Identity and Access Management > 1.05 - Ensure MFA is enabled for the 'root' user account (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

CIS v1.4 > 1 - Identity and Access Management > 1.06 - Ensure hardware MFA is enabled for the 'root' user account (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v1.4 > 1 - Identity and Access Management > 1.07 - Eliminate use of the 'root' user for administrative and daily tasks (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v1.4 > 1 - Identity and Access Management > 1.08 - Ensure IAM password policy requires minimum length of 14 or greater (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

CIS v1.4 > 1 - Identity and Access Management > 1.09 - Ensure IAM password policy prevents password reuse (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 1 - Identity and Access Management > 1.10 - Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.04 Use Unique Passwords

CIS v1.4 > 1 - Identity and Access Management > 1.11 - Do not setup access keys during initial user setup for all IAM users that have a console password (Manual)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v1.4 > 1 - Identity and Access Management > 1.12 - Ensure credentials unused for 45 days or greater are disabled (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 1 - Identity and Access Management > 1.13 - Ensure there is only one active access key available for any single IAM user (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.09 Disable Dormant Accounts

CIS v1.4 > 1 - Identity and Access Management > 1.14 - Ensure access keys are rotated every 90 days or less (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

CIS v1.4 > 1 - Identity and Access Management > 1.15 - Ensure IAM Users Receive Permissions Only Through Groups (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 1 - Identity and Access Management > 1.16 - Ensure IAM policies that allow full "*:*" administrative privileges are not attached (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 1 - Identity and Access Management > 1.17 - Ensure a support role has been created to manage incidents with AWS Support (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

CIS v1.4 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances (Manual)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v1.4 > 1 - Identity and Access Management > 1.19 - Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed (Automated)

CIS > Controls v7 > 19 Incident Response and Management

CIS v1.4 > 1 - Identity and Access Management > 1.20 - Ensure that IAM Access analyzer is enabled for all regions (Automated)

CIS > Controls v7 > 13 Data Protection

CIS v1.4 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments (Manual)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.01 - Ensure all S3 buckets employ encryption-at-rest (Manual)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.02 - Ensure S3 Bucket Policy is set to deny HTTP requests (Manual)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure MFA Delete is enable on S3 buckets (Automated)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.04 Encrypt All Sensitive Information in Transit

CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure all data in Amazon S3 has been discovered, classified and secured when required. (Manual)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.05 - Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' (Automated)

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

CIS v1.4 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2) > 2.02.01 - Ensure EBS volume encryption is enabled (Manual)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v1.4 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.01 - Ensure that encryption is enabled for RDS Instances (Automated)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v1.4 > 3 - Logging > 3.01 - Ensure CloudTrail is enabled in all regions (Automated)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v1.4 > 3 - Logging > 3.02 - Ensure CloudTrail log file validation is enabled (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 3 - Logging > 3.03 - Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v1.4 > 3 - Logging > 3.04 - Ensure CloudTrail trails are integrated with CloudWatch Logs (Automated)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v1.4 > 3 - Logging > 3.05 - Ensure AWS Config is enabled in all regions (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

CIS v1.4 > 3 - Logging > 3.06 - Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Automated)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v1.4 > 3 - Logging > 3.07 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 3 - Logging > 3.08 - Ensure rotation for customer created CMKs is enabled (Automated)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v1.4 > 3 - Logging > 3.09 - Ensure VPC flow logging is enabled in all VPCs (Automated)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v1.4 > 3 - Logging > 3.10 - Ensure that Object-level logging for write events is enabled for S3 bucket (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 3 - Logging > 3.11 - Ensure that Object-level logging for read events is enabled for S3 bucket (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

CIS v1.4 > 4 - Monitoring > 4.01 - Ensure a log metric filter and alarm exist for unauthorized API calls (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

CIS v1.4 > 4 - Monitoring > 4.02 - Ensure a log metric filter and alarm exist for Management Console sign-in without MFA (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

CIS v1.4 > 4 - Monitoring > 4.03 - Ensure a log metric filter and alarm exist for usage of 'root' account (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 4 - Monitoring > 4.04 - Ensure a log metric filter and alarm exist for IAM policy changes (Automated)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.09 Log and Alert on Unsuccessful Administrative Account Login

CIS v1.4 > 4 - Monitoring > 4.05 - Ensure a log metric filter and alarm exist for CloudTrail configuration changes (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 4 - Monitoring > 4.06 - Ensure a log metric filter and alarm exist for AWS Management Console authentication failures (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v1.4 > 4 - Monitoring > 4.07 - Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 4 - Monitoring > 4.08 - Ensure a log metric filter and alarm exist for S3 bucket policy changes (Automated)

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v1.4 > 4 - Monitoring > 4.09 - Ensure a log metric filter and alarm exist for AWS Config configuration changes (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 4 - Monitoring > 4.10 - Ensure a log metric filter and alarm exist for security group changes (Automated)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v1.4 > 4 - Monitoring > 4.11 - Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 4 - Monitoring > 4.12 - Ensure a log metric filter and alarm exist for changes to network gateways (Automated)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.03 Use Automated Tools to Verify Standard Device Configurations and Detect Changes

CIS v1.4 > 4 - Monitoring > 4.13 - Ensure a log metric filter and alarm exist for route table changes (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 4 - Monitoring > 4.14 - Ensure a log metric filter and alarm exist for VPC changes (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 4 - Monitoring > 4.15 - Ensure a log metric filter and alarm exists for AWS Organizations changes (Automated)

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.05 Implement Automated Configuration Monitoring Systems

CIS v1.4 > 5 - Networking > 5.01 - Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v1.4 > 5 - Networking > 5.02 - Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v1.4 > 5 - Networking > 5.03 - Ensure the default security group of every VPC restricts all traffic (Automated)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v1.4 > 5 - Networking > 5.04 - Ensure routing tables for VPC peering are 'least access' (Manual)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v1.4 > 1 - Identity and Access Management

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS

CIS v1.4 > 2 - Storage

CIS v1.4 > 2 - Storage > 2.01 - Simple Storage Service (S3)

CIS

CIS v1.4 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2)

CIS

CIS v1.4 > 2 - Storage > 2.03 - Relational Database Service (RDS)

CIS

CIS

CIS v1.4 > 3 - Logging

CIS v1.4 > 4 - Monitoring

CIS

CIS v1.4 > 5 - Networking

CIS

CIS

CIS v2.0

CIS v2.0 > 1 - Identity and Access Management > 1.01 - Maintain current contact details

CIS

CIS v2.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered

CIS > Controls v7 > 19 Incident Response and Management > 19.03 Designate Management Personnel to Support Incident Handling

CIS v2.0 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account

CIS > Controls v7 > 19 Incident Response and Management

CIS v2.0 > 1 - Identity and Access Management > 1.04 - Ensure no 'root' user account access key exists

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 1 - Identity and Access Management > 1.05 - Ensure MFA is enabled for the 'root' user account

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

CIS v2.0 > 1 - Identity and Access Management > 1.06 - Ensure hardware MFA is enabled for the 'root' user account

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v2.0 > 1 - Identity and Access Management > 1.07 - Eliminate use of the 'root' user for administrative and daily tasks

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v2.0 > 1 - Identity and Access Management > 1.08 - Ensure IAM password policy requires minimum length of 14 or greater

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

CIS v2.0 > 1 - Identity and Access Management > 1.09 - Ensure IAM password policy prevents password reuse

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 1 - Identity and Access Management > 1.10 - Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.04 Use Unique Passwords

CIS v2.0 > 1 - Identity and Access Management > 1.11 - Do not setup access keys during initial user setup for all IAM users that have a console password

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v2.0 > 1 - Identity and Access Management > 1.12 - Ensure credentials unused for 45 days or greater are disabled

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 1 - Identity and Access Management > 1.13 - Ensure there is only one active access key available for any single IAM user

CIS > Controls v7 > 16 Account Monitoring and Control > 16.09 Disable Dormant Accounts

CIS v2.0 > 1 - Identity and Access Management > 1.14 - Ensure access keys are rotated every 90 days or less

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

CIS v2.0 > 1 - Identity and Access Management > 1.15 - Ensure IAM Users Receive Permissions Only Through Groups

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 1 - Identity and Access Management > 1.16 - Ensure IAM policies that allow full "*:*" administrative privileges are not attached

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 1 - Identity and Access Management > 1.17 - Ensure a support role has been created to manage incidents with AWS Support

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

CIS v2.0 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v2.0 > 1 - Identity and Access Management > 1.19 - Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v2.0 > 1 - Identity and Access Management > 1.20 - Ensure that IAM Access analyzer is enabled for all regions

CIS > Controls v7 > 13 Data Protection

CIS v2.0 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 1 - Identity and Access Management > 1.22 - Ensure access to AWSCloudShellFullAccess is restricted

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

CIS v2.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.01 - Ensure S3 Bucket Policy is set to deny HTTP requests

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v2.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.02 - Ensure MFA Delete is enabled on S3 buckets

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.04 Encrypt All Sensitive Information in Transit

CIS v2.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure all data in Amazon S3 has been discovered, classified and secured when required

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

CIS v2.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2) > 2.02.01 - Ensure EBS Volume Encryption is Enabled in all Regions

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.01 - Ensure that encryption-at-rest is enabled for RDS Instances

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v2.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.02 - Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v2.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.03 - Ensure that public access is not given to RDS Instance

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.05 Deploy Automated Software Patch Management Tools

CIS v2.0 > 2 - Storage > 2.04 - Elastic File System (EFS) > 2.04.01 - Ensure that encryption is enabled for EFS file systems

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 3 - Logging > 3.01 - Ensure CloudTrail is enabled in all regions

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v2.0 > 3 - Logging > 3.02 - Ensure CloudTrail log file validation is enabled

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 3 - Logging > 3.03 - Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v2.0 > 3 - Logging > 3.04 - Ensure CloudTrail trails are integrated with CloudWatch Logs

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 3 - Logging > 3.05 - Ensure AWS Config is enabled in all regions

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

CIS v2.0 > 3 - Logging > 3.06 - Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v2.0 > 3 - Logging > 3.07 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 3 - Logging > 3.08 - Ensure rotation for customer created symmetric CMKs is enabled

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v2.0 > 3 - Logging > 3.09 - Ensure VPC flow logging is enabled in all VPCs

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v2.0 > 3 - Logging > 3.10 - Ensure that Object-level logging for write events is enabled for S3 bucket

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 3 - Logging > 3.11 - Ensure that Object-level logging for read events is enabled for S3 bucket

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

CIS v2.0 > 4 - Monitoring > 4.01 - Ensure unauthorized API calls are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

CIS v2.0 > 4 - Monitoring > 4.02 - Ensure management console sign-in without MFA is monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

CIS v2.0 > 4 - Monitoring > 4.03 - Ensure usage of 'root' account is monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 4 - Monitoring > 4.04 - Ensure IAM policy changes are monitored

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.09 Log and Alert on Unsuccessful Administrative Account Login

CIS v2.0 > 4 - Monitoring > 4.05 - Ensure CloudTrail configuration changes are monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 4 - Monitoring > 4.06 - Ensure AWS Management Console authentication failures are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v2.0 > 4 - Monitoring > 4.07 - Ensure disabling or scheduled deletion of customer created CMKs is monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 4 - Monitoring > 4.08 - Ensure S3 bucket policy changes are monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v2.0 > 4 - Monitoring > 4.09 - Ensure AWS Config configuration changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 4 - Monitoring > 4.10 - Ensure security group changes are monitored

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v2.0 > 4 - Monitoring > 4.11 - Ensure Network Access Control Lists (NACL) changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 4 - Monitoring > 4.12 - Ensure changes to network gateways are monitored

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.03 Use Automated Tools to Verify Standard Device Configurations and Detect Changes

CIS v2.0 > 4 - Monitoring > 4.13 - Ensure route table changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 4 - Monitoring > 4.14 - Ensure VPC changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 4 - Monitoring > 4.15 - Ensure AWS Organizations changes are monitored

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.05 Implement Automated Configuration Monitoring Systems

CIS v2.0 > 4 - Monitoring > 4.16 - Ensure AWS Security Hub is enabled

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v2.0 > 5 - Networking > 5.01 - Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.03 Use Automated Tools to Verify Standard Device Configurations and Detect Changes

CIS v2.0 > 5 - Networking > 5.02 - Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v2.0 > 5 - Networking > 5.03 - Ensure no security groups allow ingress from ::/0 to remote server administration ports

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v2.0 > 5 - Networking > 5.04 - Ensure the default security group of every VPC restricts all traffic

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v2.0 > 5 - Networking > 5.05 - Ensure routing tables for VPC peering are 'least access'

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 5 - Networking > 5.06 - Ensure that EC2 Metadata Service only allows IMDSv2

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v2.0 > 1 - Identity and Access Management

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS

CIS v2.0 > 2 - Storage

CIS v2.0 > 2 - Storage > 2.01 - Simple Storage Service (S3)

CIS

CIS v2.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2)

CIS

CIS v2.0 > 2 - Storage > 2.03 - Relational Database Service (RDS)

CIS

CIS v2.0 > 2 - Storage > 2.04 - Elastic File System (EFS)

CIS

CIS

CIS v2.0 > 3 - Logging

CIS v2.0 > 4 - Monitoring

CIS

CIS v2.0 > 5 - Networking

CIS

CIS

CIS v3.0

CIS v3.0 > 1 - Identity and Access Management > 1.01 - Maintain current contact details

CIS

CIS v3.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered

CIS > Controls v7 > 19 Incident Response and Management > 19.03 Designate Management Personnel to Support Incident Handling

CIS v3.0 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account

CIS > Controls v7 > 19 Incident Response and Management

CIS v3.0 > 1 - Identity and Access Management > 1.04 - Ensure no 'root' user account access key exists

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 1 - Identity and Access Management > 1.05 - Ensure MFA is enabled for the 'root' user account

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

CIS v3.0 > 1 - Identity and Access Management > 1.06 - Ensure hardware MFA is enabled for the 'root' user account

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v3.0 > 1 - Identity and Access Management > 1.07 - Eliminate use of the 'root' user for administrative and daily tasks

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v3.0 > 1 - Identity and Access Management > 1.08 - Ensure IAM password policy requires minimum length of 14 or greater

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

CIS v3.0 > 1 - Identity and Access Management > 1.09 - Ensure IAM password policy prevents password reuse

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 1 - Identity and Access Management > 1.10 - Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.04 Use Unique Passwords

CIS v3.0 > 1 - Identity and Access Management > 1.11 - Do not setup access keys during initial user setup for all IAM users that have a console password

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

CIS v3.0 > 1 - Identity and Access Management > 1.12 - Ensure credentials unused for 45 days or greater are disabled

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 1 - Identity and Access Management > 1.13 - Ensure there is only one active access key available for any single IAM user

CIS > Controls v7 > 16 Account Monitoring and Control > 16.09 Disable Dormant Accounts

CIS v3.0 > 1 - Identity and Access Management > 1.14 - Ensure access keys are rotated every 90 days or less

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

CIS v3.0 > 1 - Identity and Access Management > 1.15 - Ensure IAM Users Receive Permissions Only Through Groups

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 1 - Identity and Access Management > 1.16 - Ensure IAM policies that allow full "*:*" administrative privileges are not attached

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 1 - Identity and Access Management > 1.17 - Ensure a support role has been created to manage incidents with AWS Support

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

CIS v3.0 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v3.0 > 1 - Identity and Access Management > 1.19 - Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v3.0 > 1 - Identity and Access Management > 1.20 - Ensure that IAM Access analyzer is enabled for all regions

CIS > Controls v7 > 13 Data Protection

CIS v3.0 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v3.0 > 1 - Identity and Access Management > 1.22 - Ensure access to AWSCloudShellFullAccess is restricted

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.01 - Ensure S3 Bucket Policy is set to deny HTTP requests

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.02 - Ensure MFA Delete is enabled on S3 buckets

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.04 Encrypt All Sensitive Information in Transit

CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure all data in Amazon S3 has been discovered, classified and secured when required

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

CIS v3.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2) > 2.02.01 - Ensure EBS Volume Encryption is Enabled in all Regions

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.01 - Ensure that encryption-at-rest is enabled for RDS Instances

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.02 - Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.03 - Ensure that public access is not given to RDS Instance

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.05 Deploy Automated Software Patch Management Tools

CIS v3.0 > 2 - Storage > 2.04 - Elastic File System (EFS) > 2.04.01 - Ensure that encryption is enabled for EFS file systems

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v3.0 > 3 - Logging > 3.01 - Ensure CloudTrail is enabled in all regions

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v3.0 > 3 - Logging > 3.02 - Ensure CloudTrail log file validation is enabled

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 3 - Logging > 3.03 - Ensure AWS Config is enabled in all regions

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v3.0 > 3 - Logging > 3.04 - Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v3.0 > 3 - Logging > 3.05 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 3 - Logging > 3.06 - Ensure rotation for customer created symmetric CMKs is enabled

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v3.0 > 3 - Logging > 3.07 - Ensure VPC flow logging is enabled in all VPCs

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

CIS v3.0 > 3 - Logging > 3.08 - Ensure that Object-level logging for write events is enabled for S3 bucket

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 3 - Logging > 3.09 - Ensure that Object-level logging for read events is enabled for S3 bucket

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

CIS v3.0 > 4 - Monitoring > 4.01 - Ensure unauthorized API calls are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

CIS v3.0 > 4 - Monitoring > 4.02 - Ensure management console sign-in without MFA is monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

CIS v3.0 > 4 - Monitoring > 4.03 - Ensure usage of 'root' account is monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 4 - Monitoring > 4.04 - Ensure IAM policy changes are monitored

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.09 Log and Alert on Unsuccessful Administrative Account Login

CIS v3.0 > 4 - Monitoring > 4.05 - Ensure CloudTrail configuration changes are monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 4 - Monitoring > 4.06 - Ensure AWS Management Console authentication failures are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

CIS v3.0 > 4 - Monitoring > 4.07 - Ensure disabling or scheduled deletion of customer created CMKs is monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 4 - Monitoring > 4.08 - Ensure S3 bucket policy changes are monitored

CIS > Controls v7 > 16 Account Monitoring and Control

CIS v3.0 > 4 - Monitoring > 4.09 - Ensure AWS Config configuration changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 4 - Monitoring > 4.10 - Ensure security group changes are monitored

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

CIS v3.0 > 4 - Monitoring > 4.11 - Ensure Network Access Control Lists (NACL) changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 4 - Monitoring > 4.12 - Ensure changes to network gateways are monitored

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.03 Use Automated Tools to Verify Standard Device Configurations and Detect Changes

CIS v3.0 > 4 - Monitoring > 4.13 - Ensure route table changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 4 - Monitoring > 4.14 - Ensure VPC changes are monitored

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 4 - Monitoring > 4.15 - Ensure AWS Organizations changes are monitored

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.05 Implement Automated Configuration Monitoring Systems

CIS v3.0 > 4 - Monitoring > 4.16 - Ensure AWS Security Hub is enabled

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

CIS v3.0 > 5 - Networking > 5.01 - Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.03 Use Automated Tools to Verify Standard Device Configurations and Detect Changes

CIS v3.0 > 5 - Networking > 5.02 - Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v3.0 > 5 - Networking > 5.03 - Ensure no security groups allow ingress from ::/0 to remote server administration ports

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v3.0 > 5 - Networking > 5.04 - Ensure the default security group of every VPC restricts all traffic

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS v3.0 > 5 - Networking > 5.05 - Ensure routing tables for VPC peering are 'least access'

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v3.0 > 5 - Networking > 5.06 - Ensure that EC2 Metadata Service only allows IMDSv2

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

CIS v3.0 > 1 - Identity and Access Management

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

CIS

CIS v3.0 > 2 - Storage

CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3)

CIS

CIS v3.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2)

CIS