Policy Settings
The AWS CIS v3.0.0 - Section 3 - Logging policy pack has 16 policy settings:
| Policy | Setting | Note |
|---|---|---|
| AWS > CloudTrail > Trail > Encryption at Rest | Check: Encryption at Rest > Customer Managed Key | AWS CIS v3.0.0 - Controls: 3.5 |
| AWS > CloudTrail > Trail > Encryption at Rest > Customer Managed Key | alias/turbot/default | AWS CIS v3.0.0 - Controls: 3.5 |
| AWS > CloudTrail > Trail > Log File Validation | Check: Enabled | AWS CIS v3.0.0 - Controls: 3.2 |
| AWS > Config > Configuration Recording | Check: Configured | AWS CIS v3.0.0 - Controls: 3.3 |
| AWS > KMS > Key > Rotation | Check: Enabled | AWS CIS v3.0.0 - Controls: 3.6 |
| AWS > S3 > Bucket > Access Logging | Check: Enabled to Access Logging > Bucket | AWS CIS v3.0.0 - Controls: 3.4 |
| AWS > S3 > Bucket > Access Logging > Bucket | Calculated | AWS CIS v3.0.0 - Controls: 3.4 |
| AWS > Turbot > Audit Trail | Check: Configured | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > Turbot > Audit Trail > CloudTrail > Trail > Encryption Key | Calculated | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > Turbot > Audit Trail > CloudTrail > Trail > Event Selectors | event_selector { read_write_type = "All" include_management_events = true data_resource { type = "AWS::S3::Object" values = ["arn:aws:s3"] } } | AWS CIS v3.0.0 - Controls: 3.1 & 3.8 & 3.9 |
| AWS > Turbot > Audit Trail > CloudTrail > Trail > Global Region | us-east-1 | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > Turbot > Audit Trail > CloudTrail > Trail > S3 Bucket | Calculated | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > Turbot > Audit Trail > CloudTrail > Trail > Type | A multi-region trail in the `Trail > Global Region` in each account | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > Turbot > Logging > Bucket | Check: Configured | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > Turbot > Logging > Bucket > Encryption in Transit | Enabled | AWS CIS v3.0.0 - Controls: 3.1 |
| AWS > VPC > VPC > Flow Logging | Check: Configured per `Flow Logging > *` | AWS CIS v3.0.0 - Controls: 3.7 |