Mitigate the risk of lost data by using the AWS Backup service to make backups of EBS volumes

Enforce EBS Volume Backups

main

Enforce Backups of EBS Volumes

Allow only approved ingress rules for AWS VPC Security Groups to ensure that only specific ports (22, 443, 3389) are accessible from individual IP addresses (bitmask =32) and specific CIDRs.

Enforce Unapproved Traffic is Blocked for AWS VPC Security Groups

Ensure secure and efficient inter-VPC communication and centralized network management.

Enforce AWS VPCs Have Transit Gateways Attached

Ensure that only authorized users and applications can perform actions within clusters.

Enforce RBAC for Azure AKS Managed Clusters

Ensure encrypted data transmitted over the network, protecting it from interception and unauthorized access.

Enforce HTTPS Traffic for Azure App Service Web Apps

Ensure web apps securely access Azure resources without the need for hard-coded credentials, reducing the risk of credential exposure and ensuring compliance.

Enforce Managed Service Identity for Azure App Service Web Apps

Ensure data is protected by using strong encryption protocols, reducing the risk of vulnerabilities associated with older TLS versions

Enforce Secure TLS Version for Azure App Service Web Apps

Ensure that applications run on supported, secure versions of these languages, reducing the risk of vulnerabilities, enhancing stability, and ensuring compliance.

Enforce Azure App Service Web Apps to Use Supported Java, PHP, and Python Versions

This section contains recommendations for configuring identity and access management related options.

AWS CIS v3.0.0 - Section 1 - IAM

AWS CIS v3.0.0 - Section 1 - Identity and Access Management

This section contains recommendations for configuring AWS Storage.

AWS CIS v3.0.0 - Section 2 - Storage

This section contains recommendations for configuring logging related options.

AWS CIS v3.0.0 - Section 3 - Logging

This section contains recommendations for configuring AWS monitoring features.

AWS CIS v3.0.0 - Section 4 - Monitoring

This section contains recommendations for configuring security-related aspects of AWS Virtual Private Cloud (VPC).

AWS CIS v3.0.0 - Section 5 - Networking

This measure allows you to restore DynamoDB tables to any point within the last 35 days, enhancing data recovery capabilities and ensuring compliance with data protection best practices and regulatory requirements.

Enforce Point-in-Time Recovery Is Enabled for AWS DynamoDB Tables

Mitigate the risk of unauthorized access, potential data breaches, and ensures compliance with security best practices and regulatory requirements.

Enforce AWS DMS Replication Instances Are Not Publicly Accessible

Prevent use of potentially vulnerable or malicious images, ensuring that only vetted and compliant resources are deployed.

Deny AWS EC2 Instances with Unapproved AMIs or Publisher Accounts

Ensures that sensitive or proprietary configurations and data are only accessible to authorized users, reducing the risk of unauthorized access and potential data breaches.

Enforce AWS EC2 AMIs Are Shared With Trusted Accounts

Ensure that all newly created EBS volumes are automatically encrypted, reducing the risk of unauthorized data access and breaches.

Enforce Default Encryption Is Enabled for New AWS EBS Volumes

Enforcing encryption at rest for AWS EBS volumes is critical to protect sensitive data from unauthorized access and potential breaches.

Enforce Encryption at Rest Is Enabled for AWS EBS Volumes

Mitigate the risk of unauthorized metadata exposure through vulnerabilities like Server-Side Request Forgery (SSRF).

Enforce IMDSv2 for AWS EC2 Instances

Automatically delete AWS EC2 instances that have been running for more than 90 days to ensure resource optimization and cost management.

Enforce AWS EC2 Instances Are Not Older Than 90 Days

Ensure that instances are isolated from the internet, reducing the risk of unauthorized access and potential data breaches, and enhancing security by restricting outbound traffic to approved and monitored channels.

Enforce AWS EC2 Instances Do Not Have Internet Access via Subnets

Ensure that all instances are easily identifiable based on their purpose, environment, and other criteria, facilitating cost tracking, security management, and adherence to organizational policies.

Enforce AWS EC2 Instances Use AMIs With Approved Tags

Ensure that only trusted, validated images are used, reducing the risk of security vulnerabilities and ensuring compliance with organizational policies and security standards.

Enforce AWS EC2 Instances Use Approved AMIs and Publisher Accounts

Ensure optimize resource utilization, manage expenses, and maintain consistent security and operational standards across the cloud environment.

Enforce AWS EC2 Instances Use Approved Instance Types

Automatically delete AWS EC2 snapshots that have been running for more than 60 days to ensure resource optimization and cost management.

Enforce AWS EC2 Snapshots Are Not Older Than 60 Days

Ensures that sensitive information is protected from unauthorized access, reducing the risk of data breaches and maintaining the integrity of your cloud environment.

Enforce AWS EC2 Snapshots Are Shared With Trusted Accounts

Ensure that aged AMIs are properly identified and classified, facilitating their management, compliance with organizational policies, and aiding in decisions related to their retention or deprecation.

Enforce Tags on AMIs if They Are Older Than 14 Days

Enforce policies to not have administrative access minimizes the risk of unauthorized access and potential misuse of administrative capabilities.

Enforce AWS IAM Policies Do Not Have Admin Privileges

Prevent accidental or unauthorized termination of instances, which can lead to data loss, application downtime, and potential security vulnerabilities

Enforce Termination Protection Is Enabled for AWS EC2 Instances

This measure helps in protecting data in transit by enforcing stronger encryption standards, thereby reducing the risk of data breaches and ensuring compliance.

Enforce TLS 1.2 SSL Policy for AWS EC2 Classic Load Balancer Listeners

This practice helps avoid unnecessary costs associated with unattached volumes, reduces the risk of data exposure, and ensures that all storage resources are actively managed and utilized.

Enforce AWS EBS Volumes Are Attached to EC2 Instances

This section contains recommendations for configuring Azure Identity and Access Management features.

Azure CIS v2.0.0 - Section 1 - Identity and Access Management

Azure CIS v2.0.0 - Section 1 - IAM

This section contains recommendations to consider for tenant-wide security policies and plans related to Microsoft Defender.

Azure CIS v2.0.0 - Section 2 - Microsoft Defender

This section covers security recommendations to follow to set storage account policies on an Azure Subscription. An Azure storage account provides a unique namespace to store and access Azure Storage data objects.

Azure CIS v2.0.0 - Section 3 - Storage Accounts

This section covers security recommendations to follow to set general database services policies on an Azure Subscription. Subsections will address specific database types.

Azure CIS v2.0.0 - Section 4 - Database Services

This section contains recommendations for configuring Azure logging and monitoring features.

Azure CIS v2.0.0 - Section 5 - Logging and Monitoring

This section covers security recommendations to follow in order to set networking policies on an Azure subscription.

Azure CIS v2.0.0 - Section 6 - Networking

This section contains recommendations for configuring Azure virtual machines.

Azure CIS v2.0.0 - Section 7 - Virtual Machines

This section covers security recommendations to follow for the configuration and use of Azure Key Vault.

Azure CIS v2.0.0 - Section 8 - Key Vault

This section covers security recommendations for Azure App Service.

Azure CIS v2.0.0 - Section 9 - App Service

Ensures that all installed extensions have been vetted for security and compliance, reducing the risk of vulnerabilities, unauthorized access, and ensuring adherence to organizational policies.

Enforce Approved Extensions Are Installed on Azure Compute Virtual Machines

Ensure that all allocated storage is actively used and monitored, reducing the risk of unnecessary expenses and potential security vulnerabilities associated with unattached disks.

Enforce Azure Compute Disks Are Attached to Virtual Machines

Enforce Azure Compute Virtual Machines Use Approved AMIs From Trusted Publishers

Ensures that data remains confidential and secure, even if the physical storage media is compromised.

Enforce Encryption at Rest Is Enabled for Azure Compute Disks

Ensure that only trusted and authorized networks can access the database, reducing the risk of unauthorized access, data breaches, and ensuring compliance.

Enforce Azure Cosmos DB Database Accounts Are Accessible to Selected Networks

The Guardrails Event Poller are responsible polling Audit Logs (Azure Monitor) at intervals specified and retrieves the latest events (Succeeded) for processing.

Enable Event Pollers for Azure Subscriptions

Enable Azure CIS v2.0.0 reporting in guardrails to check security best practices.

Enable Reporting for Azure CIS v2.0.0

Ensure that only approved and necessary ports are used, reducing the risk of unauthorized access and potential attacks, and enhancing overall security.

Enforce Azure Load Balancer to Use Only Approved Ports

Ensure remote administrative access is blocked unless explicitly allowed, reducing the risk of malicious attacks and enhancing overall security posture.

Enforce Azure Network Security Groups to Reject All Ingress, RDP, and SSH Inbound Access

Ensure that storage containers are not publicly accessible, organizations can safeguard sensitive data.

Enforce Azure Storage Containers Block Public Access

Ensure that infrequently accessed data is stored in a cost-effective manner, reducing overall storage expenses while maintaining accessibility, and aligning with best practices for data management and cost optimization.

Enforce Cool Access Tier for Azure Storage Accounts

Ensure data is protected by using strong encryption protocols, reducing the risk of vulnerabilities associated with older TLS versions.

Enforce Secure TLS Version for Azure Storage Accounts

Ensure that only authenticated and authorized users can interact with the stored data, thus enhancing security and compliance with data protection regulations.

Enforce Azure Storage Account Blob Containers Block Public Access

Protect sensitive and proprietary data from unauthorized access and potential breaches.

Enforce GCP BigQuery Datasets Are Not Publicly Accessible

This section covers recommendations addressing Identity and Access Management on Google Cloud Platform.

GCP CIS v2.0.0 - Section 1 - Identity and Access Management

This section covers recommendations addressing Logging and Monitoring on Google Cloud Platform.

GCP CIS v2.0.0 - Section 2 - Logging and Monitoring

This section covers recommendations addressing networking on Google Cloud Platform.

GCP CIS v2.0.0 - Section 3 - Networking

This section covers recommendations addressing virtual machines on Google Cloud Platform.

GCP CIS v2.0.0 - Section 4 - Virtual Machines

This section covers recommendations addressing storage on Google Cloud Platform.

GCP CIS v2.0.0 - Section 5 - Storage

This section covers security recommendations to follow to secure Cloud SQL database services.

GCP CIS v2.0.0 - Section 6 - Cloud SQL Database Services

Restrict the use of universally accessible SSH keys, thereby reducing the risk of unauthorized access.

Enforce Block Project-Wide SSH Keys for GCP Compute Engine Instances

Enforce GCP Compute Engine Disks Are Attached to Instances

This section addresses Google CloudPlatform BigQuery. BigQuery is a serverless, highly-scalable, and cost-effective cloud data warehouse with an in-memory BI Engine and machine learning built in.

GCP CIS v2.0.0 - Section 7 - BigQuery

Enforcing disks to not be older than 7 days is critical to ensure that data storage is continuously refreshed and aligned with the latest security and performance standards.

Enforce GCP Compute Engine Disks Are Not Older Than 7 Days

Enforcing instances to not be older than 7 days is important to ensure that instances are regularly updated and patched, minimizing the risk of vulnerabilities and security exploits.

Enforce GCP Compute Engine Instances Are Not Older Than 7 Days

Limiting instances to internal IP addresses only minimizes exposure to the internet, thereby protecting sensitive data and systems from unauthorized access and potential threats.

Enforce GCP Compute Engine Instances Do Not Use External IP Addresses

Enforce instances to not use specific machine types helps prevent the use of machine types that may be unsuitable for certain workloads, excessively costly, or lacking necessary security features, thereby optimizing resource utilization and maintaining a secure environment.

Enforce GCP Compute Engine Instances Do Not Use Specific Machine Types

Ensure that all instances adhere to organizational standards, reducing the risk of vulnerabilities.

Enforce GCP Compute Engine Instances Use Only Approved Images

The Guardrails Event Handlers are responsible for conveying events from GCP Logging back to Guardrails for processing. This is a requirement for Guardrails to process and respond in real-time.

Enable Event Handlers for GCP Projects

This measure restricts role assumption to trusted accounts and services, reducing the risk of unauthorized access, enhancing security, and ensuring compliance with organizational policies.

Enforce AWS IAM Roles Restrict Access

Ensure that only authorized actions can be performed on KMS keys, reducing the risk of unauthorized access and misuse, thereby enhancing overall security and compliance with best practices.

Enforce AWS KMS Keys Allow Only Approved Action Permissions

Ensuring that keys are rotated minimizes the risk of key compromise and limits the potential impact of a security breach.

Enforce Rotation Is Enabled for AWS KMS Keys

Ensure that Lambda functions can interact securely with resources within the VPC, utilize VPC security groups and network ACLs, and prevent unauthorized access by restricting outbound internet access.

Enforce AWS Lambda Functions Are in a VPC

Prevent unauthorized users from invoking functions, which can lead to security vulnerabilities and potential data breaches.

Enforce AWS Lambda Functions Restrict Public Access

Ensure proper resource management, cost tracking, and compliance with organizational policies by enabling the identification and classification of Lambda functions based on their purpose, environment, and other relevant criteria.

Enforce AWS Lambda Functions Use Approved Tags

Ensure that CloudWatch log groups are encrypted for enhanced security.

Enforce Encryption at Rest Is Enabled for AWS Log Groups

Ensure that sensitive data within snapshots is accessible only to authorized accounts, reducing the risk of unauthorized access and data breaches.

Enforce AWS RDS DB Cluster Manual Snapshots Are Shared With Approved Accounts

This measure prevents unauthorized internet access to your RDS instances, reducing the risk of data breaches and enhancing compliance with security best practices and regulatory requirements.

Enforce AWS RDS DB Instances Are Not Publicly Accessible

Ensure that RDS instances comply with organizational policies, meet performance and security requirements, and align with best practices for cost management and resource utilization.

Enforce AWS RDS DB Instances Use Specific Engines and Instance Classes

Ensure that all data is encrypted when stored, protecting it from unauthorized access and potential breaches, and ensuring compliance with security best practices.

Enforce Encryption at Rest Is Enabled for RDS DB Instances

Enforce AWS RDS Manual DB Cluster Snapshots Are Shared With Trusted Accounts

Enforce AWS RDS Manual DB Instance Snapshots Are Shared With Trusted Accounts

This measure prevents unauthorized internet access to your Redshift clusters, reducing the risk of data breaches and enhancing compliance with security best practices and regulatory requirements.

Enforce AWS Redshift Clusters Are Not Publicly Accessible

Ensure that all data is encrypted during transmission, safeguarding it from interception and unauthorized access, thereby enhancing overall security and compliance with best practices.

Enforce Encryption in Transit Is Enabled for AWS Redshift Clusters

Enforce AWS Redshift Manual Cluster Snapshots Are Shared With Trusted Accounts

Ensure that S3 bucket access logging is enabled and follows a specific naming convention for enhanced security and auditing.

Enforce Access Logging Is Enabled for AWS S3 Buckets

Ensure that only trusted and authorized accounts are used for replicating data, reducing the risk of unauthorized data access or replication.

Enforce Approved Replication Accounts for AWS S3 Buckets

Prevent unintended exposure of sensitive data to the public internet for S3 accounts.

Enforce Block Public Access Is Enabled for AWS S3 Accounts

Prevent unintended exposure of sensitive data to the public internet for S3 buckets.

Enforce Block Public Access Is Enabled for AWS S3 Buckets

ensures that bucket names adhere to DNS naming conventions, preventing issues with accessibility and interoperability, and ensuring smooth integration with various AWS services and applications.

Enforce AWS S3 Buckets Use DNS-Compliant Names

Ensure that security best practices, such as HTTPS and access controls are applied to CloudFront distributions, reducing the risk of unauthorized access and data breaches.

Enforce CloudFront Distribution for AWS S3 Buckets Is Secured

Enforcing the use of Creator and Creation Time tags provides critical metadata that helps in identifying the origin and creation time of S3 buckets.

Enforce Creator and Creation Time Tags for AWS S3 Buckets

Safeguard sensitive data that is stored in the S3 buckets, protecting it from unauthorized access and potential breaches.

Enforce Encryption at Rest Is Enabled for AWS S3 Buckets

Encrypt data during transmission, safeguarding it from interception and unauthorized access.

Enforce Encryption in Transit Is Enabled for AWS S3 Buckets

Ensure that only authorized users and services have access to your data.

Enforce Trusted Access for ACLs on AWS S3 Buckets

Ensure that S3 bucket policies do not allow access to all AWS users or non-trusted AWS accounts for enhanced security.

Enforce Trusted Access for Policies on AWS S3 Buckets

This measure ensures data integrity, facilitates disaster recovery, and supports compliance with data retention policies by maintaining multiple versions of objects, enabling recovery in case of accidental deletions or overwrites.

Enforce Versioning Is Enabled for AWS S3 Buckets

Encryption at rest for topics helps safeguard data confidentiality by automatically encrypting all messages stored in them, thereby reducing the risk of data breaches and complying with regulatory requirements.

Enforce Encryption at Rest Is Enabled for AWS SNS Topics

Ensure that only authorized entities can interact with your SQS queues, reducing the risk of unauthorized access, message tampering, and potential data breaches, while ensuring compliance with security best practices.

Categories

Providers