Policy Packs

guardrails-samples

This section contains recommendations for configuring AWS Storage.

AWS CIS v3.0.0 - Section 2 - Storage

main

aws_ec2_ec2_account_attributes_ebs_encryption_by_default

Define the EBS Encryption by Default settings required for `AWS &gt; EC2 &gt; Account Attributes`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [EBS Encryption by Default](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest) control compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EC2 &gt; Account Attributes &gt; EBS Encryption by Default  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

ec2AccountAttributesEbsEncryptionByDefault

AWS > EC2 > Account Attributes > EBS Encryption by Default

aws_ec2_instance_approved

Determine the action to take when an AWS EC2 instance is not approved based on `AWS &gt; EC2 &gt; Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

instanceApproved

AWS > EC2 > Instance > Approved

aws_ec2_root_volume_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; EC2 &gt; Instance.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(AWS &gt; EC2 &gt; Instance &gt; Approved &gt; Root Volume Encryption at Rest &gt; *),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

rootVolumeEncryptionAtRest

AWS > EC2 > Instance > Approved > Root Volume Encryption at Rest

aws_ec2_volume_approved

Determine the action to take when an AWS EC2 volume is not approved based on `AWS &gt; EC2 &gt; Volume &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

volumeApproved

AWS > EC2 > Volume > Approved

aws_ec2_volume_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; EC2 &gt; Volume`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EC2 &gt; Volume &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

volumeEncryptionAtRest

AWS > EC2 > Volume > Approved > Encryption at Rest

aws_efs_file_system_approved

Determine the action to take when an AWS EFS filesystem is not approved based on `AWS &gt; EFS &gt; FileSystem &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

fileSystemApproved

AWS > EFS > FileSystem > Approved

aws_efs_file_system_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; EFS &gt; FileSystem`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EFS &gt; FileSystem &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

fileSystemEncryptionAtRest

AWS > EFS > FileSystem > Approved > Encryption at Rest

aws_efs_mount_target_approved

Determine the action to take when an AWS EFS mount target is not approved based on `AWS &gt; EFS &gt; Mount Target &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

mountTargetApproved

AWS > EFS > Mount Target > Approved

aws_efs_mount_target_approved_custom

Determine whether the AWS EFS mount target is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an AWS EFS mount target is not approved, it will be subject to the action specified in the `AWS &gt; EFS &gt; Mount Target &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

mountTargetApprovedCustom

AWS > EFS > Mount Target > Approved > Custom

aws_rds_db_instance_approved

Determine the action to take when an AWS RDS db instance is not approved based on `AWS &gt; RDS &gt; DB Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

dbInstanceApproved

AWS > RDS > DB Instance > Approved

aws_rds_db_instance_auto_minor_version_upgrade

Configure Auto Minor Version Upgrade settings on an `AWS &gt; RDS &gt; DB Instance`.&#92;n

dbInstanceAutoMinorVersionUpgrade

AWS > RDS > DB Instance > Auto Minor Version Upgrade

aws_rds_db_instance_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; RDS &gt; DB Instance`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; RDS &gt; DB Instance &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

dbInstanceEncryptionAtRest

AWS > RDS > DB Instance > Approved > Encryption at Rest

aws_rds_db_instance_publicly_accessible

Ensure the RDS instance is not publicly accessible.

dbInstancePubliclyAccessible

AWS > RDS > DB Instance > Publicly Accessible

aws_s3_encryption_in_transit

Define the Encryption in Transit settings required for `AWS &gt; S3 &gt; Bucket`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource&#92;n(AWS &gt; S3 &gt; Bucket &gt; Encryption in Transit), raises an alarm, and takes the defined enforcement action.&#92;n&#92;nThe Encryption in Transit control examines the bucket&#39;s policy to find a match for the below statement. An exact match across all statement fields is required for encryption in transit to be considered enabled.&#92;n```&#92;n{&#92;n  Sid: &quot;MustBeEncryptedInTransit&quot;,&#92;n  Effect: &quot;Deny&quot;,&#92;n  Principal: &quot;*&quot;,&#92;n  Action: &quot;s3:*&quot;,&#92;n  Resource: [&#39;arn:${partition}:s3:::${bucketName}&#39;, &#39;arn:${partition}:s3:::${bucketName}/*&#39;],&#92;n  Condition: {&#92;n    Bool: {&#92;n      &quot;aws:SecureTransport&quot;: &quot;false&quot;&#92;n    }&#92;n  }&#92;n}&#92;n```&#92;n

encryptionInTransit

AWS > S3 > Bucket > Encryption in Transit

aws_s3_s3_bucket_public_access_block

Configure the AWS S3 buckets Bucket Level Public Access Block

s3BucketPublicAccessBlock

AWS > S3 > Bucket > Public Access Block

aws_s3_s3_bucket_public_access_block_settings

Define the Public Access Block that can be used to restrict the bucket access. This policy provides a default for Public Access Block in AWS S3 Bucket, however you can explicitly override the setting.&#92;n&#92;n**Block Public ACLs:** Block public access to buckets and objects granted through new access control lists (ACLs).&lt;br/&gt;&#92;n**Block Public Bucket Policies:** Block public access to buckets and objects granted through new public bucket or access point policies.&lt;br/&gt;&#92;n**Ignore Public ACLs:** Block public access to buckets and objects granted through any access control lists (ACLs).&lt;br/&gt;&#92;n**Restrict Public Bucket Policies:** Block public and cross-account access to buckets and objects through any public bucket or access point policies.&lt;br/&gt;&#92;n&#92;n

Policy	Setting	Note
AWS > EC2 > Account Attributes > EBS Encryption by Default	Check: AWS managed key or higher	AWS CIS v3.0.0 - Control: 2.2.1
AWS > EC2 > Instance > Approved	Check: Approved	AWS CIS v3.0.0 - Control: 2.2.1
AWS > EC2 > Instance > Approved > Root Volume Encryption at Rest	AWS managed key or higher	AWS CIS v3.0.0 - Control: 2.2.1
AWS > EC2 > Volume > Approved	Check: Approved	AWS CIS v3.0.0 - Control: 2.2.1
AWS > EC2 > Volume > Approved > Encryption at Rest	AWS managed key or higher	AWS CIS v3.0.0 - Control: 2.2.1
AWS > EFS > FileSystem > Approved	Check: Approved	AWS CIS v3.0.0 - Control: 2.4.1
AWS > EFS > FileSystem > Approved > Encryption at Rest	AWS managed key or higher	AWS CIS v3.0.0 - Control: 2.4.1
AWS > EFS > Mount Target > Approved	Check: Approved	AWS CIS v3.0.0 - Control: 2.4.1
AWS > EFS > Mount Target > Approved > Custom	Calculated	AWS CIS v3.0.0 - Control: 2.4.1
AWS > RDS > DB Instance > Approved	Check: Approved	AWS CIS v3.0.0 - Control: 2.3.1
AWS > RDS > DB Instance > Approved > Encryption at Rest	AWS managed key or higher	AWS CIS v3.0.0 - Control: 2.3.1
AWS > RDS > DB Instance > Auto Minor Version Upgrade	Check: Enabled	AWS CIS v3.0.0 - Control: 2.3.2
AWS > RDS > DB Instance > Publicly Accessible	Check: DB Instance is not publicly accessible	AWS CIS v3.0.0 - Control: 2.3.3
AWS > S3 > Bucket > Encryption in Transit	Check: Enabled	AWS CIS v3.0.0 - Control: 2.1.1
AWS > S3 > Bucket > Public Access Block	Check: Per `Public Access Block > Settings`	AWS CIS v3.0.0 - Control: 2.1.4
AWS > S3 > Bucket > Public Access Block > Settings	- Block Public ACLs - Block Public Bucket Policies - Ignore Public ACLs - Restrict Public Bucket Policies	AWS CIS v3.0.0 - Control: 2.1.4

Policy Settings