Mitigate the risk of lost data by using the AWS Backup service to make backups of EBS volumes

Enforce EBS Volume Backups

main

Enforce Backups of EBS Volumes

This section contains recommendations for configuring identity and access management related options.

AWS CIS v3.0.0 - Section 1 - IAM

AWS CIS v3.0.0 - Section 1 - Identity and Access Management

This section contains recommendations for configuring AWS Storage.

AWS CIS v3.0.0 - Section 2 - Storage

This section contains recommendations for configuring logging related options.

AWS CIS v3.0.0 - Section 3 - Logging

This section contains recommendations for configuring AWS monitoring features.

AWS CIS v3.0.0 - Section 4 - Monitoring

This section contains recommendations for configuring security-related aspects of AWS Virtual Private Cloud (VPC).

AWS CIS v3.0.0 - Section 5 - Networking

Mitigate the risk of unauthorized access, potential data breaches, and ensures compliance with security best practices and regulatory requirements.

Enforce AWS DMS Replication Instances Are Not Publicly Accessible

This section covers recommendations addressing storage on Google Cloud Platform.

GCP CIS v2.0.0 - Section 5 - Storage

This measure minimizes the attack surface by eliminating potential entry points for unauthorized access and reducing the risk of data breaches, thereby ensuring compliance with security best practices.

Enforce AWS VPC Elastic IPs Are Deleted

This measure allows you to restore DynamoDB tables to any point within the last 35 days, enhancing data recovery capabilities and ensuring compliance with data protection best practices and regulatory requirements.

Enforce Point-in-Time Recovery Is Enabled for AWS DynamoDB Tables

This section covers security recommendations to follow to secure Cloud SQL database services.

GCP CIS v2.0.0 - Section 6 - Cloud SQL Database Services

Prevent use of potentially vulnerable or malicious images, ensuring that only vetted and compliant resources are deployed.

Deny AWS EC2 Instances with Unapproved AMIs or Publisher Accounts

Ensures that sensitive or proprietary configurations and data are only accessible to authorized users, reducing the risk of unauthorized access and potential data breaches.

Enforce AWS EC2 AMIs Are Shared With Trusted Accounts

This section addresses Google CloudPlatform BigQuery. BigQuery is a serverless, highly-scalable, and cost-effective cloud data warehouse with an in-memory BI Engine and machine learning built in.

GCP CIS v2.0.0 - Section 7 - BigQuery

This practice helps improve security by ensuring that application load balancers are not exposed to the internet unless explicitly required, reducing the attack surface and potential security risks.

Enforce AWS Application Load Balancers Are Internal

Ensure that all newly created EBS volumes are automatically encrypted, reducing the risk of unauthorized data access and breaches.

Enforce Default Encryption Is Enabled for New AWS EBS Volumes

Enforcing encryption at rest for AWS EBS volumes is critical to protect sensitive data from unauthorized access and potential breaches.

Enforce Encryption at Rest Is Enabled for AWS EBS Volumes

Restrict the use of universally accessible SSH keys, thereby reducing the risk of unauthorized access.

Enforce Block Project-Wide SSH Keys for GCP Compute Engine Instances

Mitigate the risk of unauthorized metadata exposure through vulnerabilities like Server-Side Request Forgery (SSRF).

Enforce IMDSv2 for AWS EC2 Instances

Automatically delete AWS EC2 instances that have been running for more than 90 days to ensure resource optimization and cost management.

Enforce AWS EC2 Instances Are Not Older Than 90 Days

Ensure that instances are isolated from the internet, reducing the risk of unauthorized access and potential data breaches, and enhancing security by restricting outbound traffic to approved and monitored channels.

Enforce AWS EC2 Instances Do Not Have Internet Access via Subnets

Ensure that all allocated storage is actively used and monitored, reducing the risk of unnecessary expenses and potential security vulnerabilities associated with unattached disks.

Enforce GCP Compute Engine Disks Are Attached to Instances

Ensure that all instances are easily identifiable based on their purpose, environment, and other criteria, facilitating cost tracking, security management, and adherence to organizational policies.

Enforce AWS EC2 Instances Use AMIs With Approved Tags

Ensure that only trusted, validated images are used, reducing the risk of security vulnerabilities and ensuring compliance with organizational policies and security standards.

Enforce AWS EC2 Instances Use Approved AMIs and Publisher Accounts

Ensure optimize resource utilization, manage expenses, and maintain consistent security and operational standards across the cloud environment.

Enforce AWS EC2 Instances Use Approved Instance Types

Enforcing disks to not be older than 7 days is critical to ensure that data storage is continuously refreshed and aligned with the latest security and performance standards.

Enforce GCP Compute Engine Disks Are Not Older Than 7 Days

This practice helps improve security by ensuring that Load Balancer listeners do not use HTTP protocol.

Enforce AWS Load Balancer Listeners Do Not Use HTTP

Enforcing instances to not be older than 7 days is important to ensure that instances are regularly updated and patched, minimizing the risk of vulnerabilities and security exploits.

Enforce GCP Compute Engine Instances Are Not Older Than 7 Days

Limiting instances to internal IP addresses only minimizes exposure to the internet, thereby protecting sensitive data and systems from unauthorized access and potential threats.

Enforce GCP Compute Engine Instances Do Not Use External IP Addresses

This practice helps improve security by ensuring that Network Load Balancers are not exposed to the internet unless explicitly required, reducing the attack surface and potential security risks.

Enforce AWS Network Load Balancers Are Internal

Enforce that AWS EC2 snapshots are active, but set to CHECK if the snapshot is attached to an AMI for safety.

Enforce AWS EC2 Snapshots Active - Check if AMI Attached

Automatically delete AWS EC2 snapshots that have been running for more than 60 days to ensure resource optimization and cost management.

Enforce AWS EC2 Snapshots Are Not Older Than 60 Days

Enforce instances to not use specific machine types helps prevent the use of machine types that may be unsuitable for certain workloads, excessively costly, or lacking necessary security features, thereby optimizing resource utilization and maintaining a secure environment.

Enforce GCP Compute Engine Instances Do Not Use Specific Machine Types

Ensures that sensitive information is protected from unauthorized access, reducing the risk of data breaches and maintaining the integrity of your cloud environment.

Enforce AWS EC2 Snapshots Are Shared With Trusted Accounts

Ensure that aged AMIs are properly identified and classified, facilitating their management, compliance with organizational policies, and aiding in decisions related to their retention or deprecation.

Enforce Tags on AMIs if They Are Older Than 14 Days

Ensure that all instances adhere to organizational standards, reducing the risk of vulnerabilities.

Enforce GCP Compute Engine Instances Use Only Approved Images

Prevent accidental or unauthorized termination of instances, which can lead to data loss, application downtime, and potential security vulnerabilities

Enforce Termination Protection Is Enabled for AWS EC2 Instances

The Guardrails Event Handlers are responsible for conveying events from GCP Logging back to Guardrails for processing. This is a requirement for Guardrails to process and respond in real-time.

Enable Event Handlers for GCP Projects

Ensure that IAM actions, such as creating, modifying, or deleting resources, can only be performed from trusted and approved networks.

Deny all AWS IAM actions from Unapproved Networks

The Guardrails Event Poller are responsible polling GCP Logging at intervals specified and retrieves the latest events for processing.

Enable Event Poller for GCP Projects

This measure helps in protecting data in transit by enforcing stronger encryption standards, thereby reducing the risk of data breaches and ensuring compliance.

Enforce TLS 1.2 SSL Policy for AWS EC2 Classic Load Balancer Listeners

This practice helps avoid unnecessary costs associated with unattached volumes, reduces the risk of data exposure, and ensures that all storage resources are actively managed and utilized.

Enforce AWS EBS Volumes Are Attached to EC2 Instances

Enable GCP CIS v2.0.0 reporting in guardrails to check security best practices.

Enable Reporting for GCP CIS v2.0.0

Ensure that only authorized and verified domains can interact with your project's IAM policies.

Enforce Trusted Domains to Access GCP IAM Project Policy

Automatically delete AWS EC2 volumes that have been running for more than 90 days to ensure resource optimization and cost management.

Enforce AWS EBS Volumes Are Not Older Than 90 Days

By Ensuring that only approved volume types are used, organizations can maintain consistent performance standards, manage expenses effectively, and mitigate risks associated with unauthorized or inappropriate storage configurations.

Enforce AWS EBS Volumes Use Specific Volume Types

Regular key rotation ensures that any potentially exposed or compromised keys are rendered obsolete, thereby protecting access to GCP resources and ensuring compliance.

Enforce GCP IAM User-Managed Service Account Keys Are Rotated Every 90 Days

Enforcing scan on push for repositories helps detect vulnerabilities and security issues in images before they are deployed, reducing the risk of running compromised or insecure containers in your environment.

Enforce Scan on Push Is Enabled for AWS ECR Repositories

Enforce service accounts belong to trusted domains and users mitigates the risk of unauthorized access, data breaches, and malicious activities by ensuring that service accounts are managed within a secure and trusted environment.

Enforce GCP IAM User-Managed Service Accounts Belong To Trusted Domains And Users

Minimize the risk of unauthorized access and potential misuse of administrative capabilities.

Enforce GCP IAM User-Managed Service Accounts Do Not Have Admin Privileges

Ensure that all data stored within file systems is encrypted, protecting it from unauthorized access and potential data breaches.

Enforce Encryption at Rest Is Enabled for AWS EFS File Systems

Ensure that GuardDuty findings and data are shared only with authorized accounts, enhancing security by preventing unauthorized access to sensitive security information.

Enforce AWS GuardDuty Detectors Have Membership Only to Specific Accounts

Ensures that users belong to approved domains reduces the risk of unauthorized access, data breaches, and malicious activities by ensuring that user accounts are managed within a secure and trusted environment.

Enforce GCP IAM Users Belong To Approved Domains

The Guardrails Event Poller is an alternative to the Event Handlers, and is a polling mechanism for obtaining relevant events from AWS and updating CMDB.

Enable Event Poller for AWS Accounts

Mitigate the risk of key compromise, ensuring that even if a key is exposed, its usage window is limited, thereby enhancing the overall security posture.

Check If GCP KMS Crypto Keys Are Rotated Regularly

Ensure crypto keys are only accessible to authorized users and services, thereby preventing potential data breaches and maintaining compliance.

Enforce GCP KMS Cryptographic Keys Are Not Publicly Accessible

Enforce GCP KMS Crypto Keys Are Not Publicly Accessible

The Guardrails Event Handlers are responsible for conveying events from AWS CloudTrail back to Guardrails for processing. This is a requirement for Guardrails to process and respond in real-time.

Enable Global Event Handlers for AWS Accounts

Ensure that secrets, such as passwords and API keys, are encrypted, thereby safeguarding them from unauthorized access and potential breaches.

Enforce Encryption for Secrets Is Enabled for GCP GKE Clusters

Ensure that service roles are properly configured and used, allowing AWS services to interact with your resources securely, minimizing the risk of unauthorized actions.

Enable AWS IAM Service Roles

Ensure that the data transmitted between clients and load-balanced applications is encrypted, protecting it from interception and unauthorized access.

Check GCP Network Load Balancers Enforce HTTPS for Encrypted Web Traffic

Ensure that all actions taken within your AWS environment are consistently logged, enhancing security monitoring, supporting incident response, and ensuring compliance with regulatory requirements.

Enable Multi-Region CloudTrail Trails for AWS Accounts

Enable Regional Event Handlers for AWS Accounts

Encourage the creation of tailored VPC networks with specific configurations and security controls, reducing the risk of misconfigurations and enhancing overall network security.

Enforce Default VPC Network Is Not Used in GCP Projects

Enable AWS CIS v3.0.0 reporting in guardrails to check security best practices.

Enable Reporting for AWS CIS v3.0.0

Prevent potential security breaches and enhance overall account security by requiring a second form of verification.

Check MFA Is Enabled for AWS IAM Root Accounts

Reduce the risk of compromised credentials by ensuring keys are regularly rotated.

Enforce AWS IAM Access Keys Are Not Older Than 90 Days

Ensure that passwords meet specific complexity, length, and rotation requirements, reducing the risk of unauthorized access and aligning with best practices and regulatory compliance.

Enforce AWS IAM Account Password Policy Settings

This measure adds an extra layer of protection by requiring a second form of verification, reducing the risk of unauthorized access.

Enforce MFA Is Enabled for AWS IAM Users

Enforce policies to not have administrative access minimizes the risk of unauthorized access and potential misuse of administrative capabilities.

Enforce AWS IAM Policies Do Not Have Admin Privileges

This measure restricts role assumption to trusted accounts and services, reducing the risk of unauthorized access, enhancing security, and ensuring compliance with organizational policies.

Enforce AWS IAM Roles Restrict Access

Ensure that only authorized actions can be performed on KMS keys, reducing the risk of unauthorized access and misuse, thereby enhancing overall security and compliance with best practices.

Enforce AWS KMS Keys Allow Only Approved Action Permissions

Ensure that only necessary and specific ports are open for inbound traffic, minimizing the risk of unauthorized access and potential attacks.

Enforce GCP VPC Network Firewall Rules with Port Ranges to Block Incoming Traffic

Ensuring that keys are rotated minimizes the risk of key compromise and limits the potential impact of a security breach.

Enforce Rotation Is Enabled for AWS KMS Keys

Ensure that no outbound traffic is permitted, preventing data exfiltration and unauthorized communication with external systems.

Enforce GCP Network Firewall to Block All Egress Access

Ensure that Lambda functions can interact securely with resources within the VPC, utilize VPC security groups and network ACLs, and prevent unauthorized access by restricting outbound internet access.

Enforce AWS Lambda Functions Are in a VPC

Enforcing flow logging for GCP VPC subnetworks is essential for monitoring and analyzing network traffic, helping to identify potential security threats, performance issues, and ensuring compliance with security policies.

Enforce Flow Logging is Enabled for GCP VPC Subnetworks

Prevent unauthorized users from invoking functions, which can lead to security vulnerabilities and potential data breaches.

Enforce AWS Lambda Functions Restrict Public Access

Enforce Logging Is Enabled for GCP Network Firewalls

Ensure that each project within the organization uses purpose-built VPC networks with specific configurations and security controls, reducing the risk of misconfigurations.

Check Creation of Default VPC Network Is Disabled for GCP Projects

Ensure that only recently created buckets are in use, reducing the risk of using outdated configurations and improving data security and compliance with best practices

Enforce GCP Storage Buckets Are Not Older Than 7 Days

Ensure proper resource management, cost tracking, and compliance with organizational policies by enabling the identification and classification of Lambda functions based on their purpose, environment, and other relevant criteria.

Enforce AWS Lambda Functions Use Approved Tags

Ensure that CloudWatch log groups are encrypted for enhanced security.

Enforce Encryption at Rest Is Enabled for AWS Log Groups

Ensure that sensitive data within snapshots is accessible only to authorized accounts, reducing the risk of unauthorized access and data breaches.

Enforce AWS RDS DB Cluster Manual Snapshots Are Shared With Approved Accounts

Ensure that only authorized users and applications can access the data, reducing the risk of data breaches and maintaining compliance.

Enforce GCP Storage Buckets Are Not Publicly Accessible

This measure prevents unauthorized internet access to your RDS instances, reducing the risk of data breaches and enhancing compliance with security best practices and regulatory requirements.

Enforce AWS RDS DB Instances Are Not Publicly Accessible

Ensure that all network flow logs are stored securely in S3 buckets, facilitating detailed analysis, anomaly detection, and compliance with security best practices and regulatory requirements.

Enforce Flow Logging to S3 Buckets Is Enabled for AWS VPCs

Enforcing the use of Creator and Creation Time labels provide critical metadata that helps in identifying the origin and creation time of storage buckets.

Enforce Creator and Creation Time Labels for GCP Storage Buckets

Ensure that RDS instances comply with organizational policies, meet performance and security requirements, and align with best practices for cost management and resource utilization.

Enforce AWS RDS DB Instances Use Specific Engines and Instance Classes

Enforcing encryption at rest for GCP Storage Buckets is essential to protect sensitive data from unauthorized access and potential breaches by ensuring that all data is automatically encrypted before being stored.

Enforce Encryption at Rest Is Enabled for GCP Storage Buckets

Ensure that all data is encrypted when stored, protecting it from unauthorized access and potential breaches, and ensuring compliance with security best practices.

Enforce Encryption at Rest Is Enabled for RDS DB Instances

Ensure consistent and centralized management of access permissions, reducing the risk of unauthorized access and potential data breaches.

Enforce Uniform Access Is Enabled for GCP Storage Buckets

Enforce AWS RDS Manual DB Cluster Snapshots Are Shared With Trusted Accounts

Enforcing read member privileges base permissions for GitHub organizations ensures controlled access to repositories, minimizing the risk of unauthorized changes and enhancing security.

Enforce Base Permissions Is Set to Read for GitHub Organizations

Enforce AWS RDS Manual DB Instance Snapshots Are Shared With Trusted Accounts

Enforcing a default branch name for GitHub repositories ensures consistency, improves workflow organization, and aligns with best practices for collaboration and version control.

Enforce Default Branch Name for GitHub Repositories

This measure prevents unauthorized internet access to your Redshift clusters, reducing the risk of data breaches and enhancing compliance with security best practices and regulatory requirements.

Enforce AWS Redshift Clusters Are Not Publicly Accessible

Enforcing branch deletion upon merge in GitHub repositories helps maintain a clean and organized repository structure by preventing unused branches from accumulating.

Enforce Delete Branch On Merge is Enabled for GitHub Repositories

Ensure that all data is encrypted during transmission, safeguarding it from interception and unauthorized access, thereby enhancing overall security and compliance with best practices.

Enforce Encryption in Transit Is Enabled for AWS Redshift Clusters

Enforcing dependabot alerts in GitHub repositories is essential to ensure vulnerabilities in dependencies are identified and addressed, safeguarding code integrity and security.

Categories

Providers