Check library
AWS security checks
306 checks. 1 has an explained page so far (linked below); the rest follow.
CIS Amazon Web Services Foundations v7.0.0
70 controls
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 2.2 | Maintain current AWS account contact details | Section 2 | Level 1 |
| 2.3 | Ensure security contact information is registered | Section 2 | Level 1 |
| 2.4 | Ensure no 'root' user account access key exists | Section 2 | Level 1 |
| 2.5 | Ensure MFA is enabled for the 'root' user account | Section 2 | Level 1 |
| 2.6 | Ensure hardware MFA is enabled for the 'root' user account | Section 2 | Level 2 |
| 2.7 | Eliminate use of the 'root' user for administrative and daily tasks | Section 2 | Level 1 |
| 2.8 | Ensure IAM password policy requires minimum length of 14 or greater | Section 2 | Level 1 |
| 2.9 | Ensure IAM password policy prevents password reuse | Section 2 | Level 1 |
| 2.10 | Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password | Section 2 | Level 1 |
| 2.11 | Ensure credentials unused for 45 days or more are disabled | Section 2 | Level 1 |
| 2.12 | Ensure access keys are rotated every 90 days or less | Section 2 | Level 1 |
| 2.13 | Ensure IAM users receive permissions only through groups | Section 2 | Level 1 |
| 2.14 | Ensure IAM policies that allow full "*:*" administrative privileges are not attached | Section 2 | Level 1 |
| 2.15 | Ensure a support role has been created to manage incidents with AWS Support | Section 2 | Level 1 |
| 2.16 | Ensure IAM instance roles are used for AWS resource access from instances | Section 2 | Level 2 |
| 2.17 | Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed | Section 2 | Level 1 |
| 2.18 | Ensure that IAM External Access Analyzer is enabled for all regions | Section 2 | Level 1 |
| 2.19 | Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments | Section 2 | Level 2 |
| 2.20 | Ensure access to AWSCloudShellFullAccess is restricted | Section 2 | Level 1 |
| 2.21 | Ensure AWS resource policies do not allow unrestricted access using "Principal": "*" | Section 2 | Level 1 |
| 2.1.1 | Ensure centralized root access in AWS Organizations | Section 2 | Level 2 |
| 2.1.2 | Ensure authorization guardrails for all AWS Organization accounts | Section 2 | Level 2 |
| 2.1.3 | Ensure Organizations management account is not used for workloads | Section 2 | Level 2 |
| 2.1.4 | Ensure Organizational Units are structured by environment and sensitivity | Section 2 | Level 2 |
| 2.1.5 | Ensure delegated admin manages AWS Organizations policies | Section 2 | Level 2 |
| 2.1.6 | Ensure delegated admins manage AWS Organizations-integrated services | Section 2 | Level 2 |
| 3.1.1 | Ensure S3 Bucket Policy is set to deny HTTP requests | Section 3 | Level 2 |
| 3.1.2 | Ensure MFA Delete is enabled on S3 buckets | Section 3 | Level 2 |
| 3.1.3 | Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary | Section 3 | Level 2 |
| 3.1.4 | Ensure that S3 is configured with 'Block Public Access' enabled | Section 3 | Level 1 |
| 3.2.1 | Ensure that encryption-at-rest is enabled for RDS instances | Section 3 | Level 1 |
| 3.2.2 | Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances | Section 3 | Level 1 |
| 3.2.3 | Ensure that RDS instances are not publicly accessible | Section 3 | Level 1 |
| 3.2.4 | Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS | Section 3 | Level 1 |
| 3.3.1 | Ensure that encryption is enabled for EFS file systems | Section 3 | Level 1 |
| 4.1 | Ensure CloudTrail is enabled in all regions | Section 4 | Level 1 |
| 4.2 | Ensure CloudTrail log file validation is enabled | Section 4 | Level 2 |
| 4.3 | Ensure AWS Config is enabled in all regions | Section 4 | Level 2 |
| 4.4 | Ensure that server access logging is enabled on the CloudTrail S3 bucket | Section 4 | Level 1 |
| 4.5 | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Section 4 | Level 2 |
| 4.6 | Ensure rotation for customer-created symmetric CMKs is enabled | Section 4 | Level 2 |
| 4.7 | Ensure VPC flow logging is enabled in all VPCs | Section 4 | Level 2 |
| 4.8 | Ensure that object-level logging for write events is enabled for S3 buckets | Section 4 | Level 2 |
| 4.9 | Ensure that object-level logging for read events is enabled for S3 buckets | Section 4 | Level 2 |
| 4.10 | Ensure all AWS-managed web front-end services have access logging enabled | Section 4 | Level 1 |
| 5.1 | Ensure unauthorized API calls are monitored | Section 5 | Level 2 |
| 5.2 | Ensure management console sign-in without MFA is monitored | Section 5 | Level 1 |
| 5.3 | Ensure usage of the 'root' account is monitored | Section 5 | Level 1 |
| 5.4 | Ensure IAM policy changes are monitored | Section 5 | Level 1 |
| 5.5 | Ensure CloudTrail configuration changes are monitored | Section 5 | Level 1 |
| 5.6 | Ensure AWS Management Console authentication failures are monitored | Section 5 | Level 2 |
| 5.7 | Ensure disabling or scheduled deletion of customer created CMKs is monitored | Section 5 | Level 2 |
| 5.8 | Ensure S3 bucket policy changes are monitored | Section 5 | Level 1 |
| 5.9 | Ensure AWS Config configuration changes are monitored | Section 5 | Level 2 |
| 5.10 | Ensure security group changes are monitored | Section 5 | Level 2 |
| 5.11 | Ensure Network Access Control List (NACL) changes are monitored | Section 5 | Level 2 |
| 5.12 | Ensure changes to network gateways are monitored | Section 5 | Level 1 |
| 5.13 | Ensure route table changes are monitored | Section 5 | Level 1 |
| 5.14 | Ensure VPC changes are monitored | Section 5 | Level 1 |
| 5.15 | Ensure AWS Organizations changes are monitored | Section 5 | Level 1 |
| 5.16 | Ensure AWS Security Hub is enabled | Section 5 | Level 2 |
| 6.2 | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports | Section 6 | Level 1 |
| 6.3 | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports | Section 6 | Level 1 |
| 6.4 | Ensure no security groups allow ingress from ::/0 to remote server administration ports | Section 6 | Level 1 |
| 6.5 | Ensure the default security group of every VPC restricts all traffic | Section 6 | Level 2 |
| 6.6 | Ensure routing tables for VPC peering are "least access" | Section 6 | Level 2 |
| 6.7 | Ensure that the EC2 Metadata Service only allows IMDSv2 | Section 6 | Level 1 |
| 6.8 | Ensure VPC Endpoints are used for access to AWS Services | Section 6 | Level 2 |
| 6.1.1 | Ensure EBS volume encryption is enabled in all regions | Section 6 | Level 1 |
| 6.1.2 | Ensure CIFS access is restricted to trusted networks to prevent unauthorized access | Section 6 | Level 1 |
CIS AWS Compute Services v2.0.0
82 controls · individual check pages follow once each section's service is confirmed
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 2.3 | Ensure Tag Policies are Enabled | Section 2 | Level 1 |
| 2.4 | Ensure an Organizational EC2 Tag Policy has been Created | Section 2 | Level 1 |
| 2.5 | Ensure no AWS EC2 Instances are Older than 180 days | Section 2 | Level 1 |
| 2.6 | Ensure detailed monitoring is enable for production EC2 Instances | Section 2 | Level 2 |
| 2.7 | Ensure Default EC2 Security groups are not being used. | Section 2 | Level 1 |
| 2.8 | Ensure the Use of IMDSv2 is Enforced on All Existing Instances | Section 2 | Level 2 |
| 2.9 | Ensure use of AWS Systems Manager to manage EC2 instances | Section 2 | Level 2 |
| 2.10 | Ensure unused ENIs are removed | Section 2 | Level 1 |
| 2.11 | Ensure instances stopped for over 90 days are removed | Section 2 | Level 1 |
| 2.12 | Ensure EBS volumes attached to an EC2 instance is marked for deletion upon instance termination | Section 2 | Level 1 |
| 2.13 | Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data | Section 2 | Level 1 |
| 2.14 | Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches | Section 2 | Level 1 |
| 2.1.1 | Ensure Consistent Naming Convention is used for Organizational AMI | Section 2 | Level 1 |
| 2.1.2 | Ensure Amazon Machine Images (AMIs) are encrypted | Section 2 | Level 1 |
| 2.1.3 | Ensure Only Approved Amazon Machine Images (AMIs) are Used | Section 2 | Level 1 |
| 2.1.4 | Ensure Images (AMI) are not older than 90 days | Section 2 | Level 1 |
| 2.1.5 | Ensure Images are not Publicly Available | Section 2 | Level 1 |
| 2.2.1 | Ensure EBS volume encryption is enabled | Section 2 | Level 1 |
| 2.2.2 | Ensure Public Access to EBS Snapshots is Disabled | Section 2 | Level 1 |
| 2.2.3 | Ensure EBS volume snapshots are encrypted | Section 2 | Level 1 |
| 2.2.4 | Ensure unused EBS volumes are removed | Section 2 | Level 1 |
| 2.2.5 | Ensure attached EBS volumes are encrypted | Section 2 | Level 1 |
| 3.1 | Ensure Amazon ECS task definitions using 'host' network mode do not allow privileged or root user access to the host | Section 3 | Level 1 |
| 3.2 | Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS services | Section 3 | Level 1 |
| 3.3 | Ensure Amazon ECS task definitions do not have 'pidMode' set to 'host' | Section 3 | Level 1 |
| 3.4 | Ensure Amazon ECS task definitions do not have 'privileged' set to 'true' | Section 3 | Level 1 |
| 3.5 | Ensure 'readonlyRootFilesystem' is set to 'true' for Amazon ECS task definitions | Section 3 | Level 1 |
| 3.6 | Ensure secrets are not passed as container environment variables in Amazon ECS task definitions | Section 3 | Level 1 |
| 3.7 | Ensure logging is configured for Amazon ECS task definitions | Section 3 | Level 1 |
| 3.8 | Ensure Amazon ECS Fargate services are using the latest Fargate platform version | Section 3 | Level 1 |
| 3.9 | Ensure monitoring is enabled for Amazon ECS clusters | Section 3 | Level 2 |
| 3.10 | Ensure Amazon ECS services are tagged | Section 3 | Level 1 |
| 3.11 | Ensure Amazon ECS clusters are tagged | Section 3 | Level 1 |
| 3.12 | Ensure Amazon ECS task definitions are tagged | Section 3 | Level 1 |
| 3.13 | Ensure only trusted images are used with Amazon ECS | Section 3 | Level 1 |
| 3.14 | Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS task sets | Section 3 | Level 1 |
| 3.15 | Ensure ECS task definitions use awsvpc network mode | Section 3 | Level 2 |
| 3.16 | Ensure ECS Exec sessions have audit logging enabled | Section 3 | Level 1 |
| 5.1 | Apply updates to any apps running in Lightsail | Section 5 | Level 1 |
| 5.2 | Change default Administrator login names and passwords for applications | Section 5 | Level 1 |
| 5.3 | Disable SSH and RDP ports for Lightsail instances when not needed. | Section 5 | Level 1 |
| 5.4 | Ensure SSH is restricted to only IP address that should have this access. | Section 5 | Level 1 |
| 5.5 | Ensure RDP is restricted to only IP address that should have this access. | Section 5 | Level 1 |
| 5.6 | Disable IPv6 Networking if not in use within your organization. | Section 5 | Level 1 |
| 5.7 | Ensure you are using an IAM policy to manage access to buckets in Lightsail. | Section 5 | Level 1 |
| 5.8 | Ensure Lightsail instances are attached to the buckets | Section 5 | Level 1 |
| 5.9 | Ensure that your Lightsail buckets are not publicly accessible | Section 5 | Level 1 |
| 5.10 | Enable storage bucket access logging | Section 5 | Level 1 |
| 5.11 | Ensure your Windows Server based lightsail instances are updated with the latest security patches. | Section 5 | Level 1 |
| 5.12 | Change the auto-generated password for Windows based instances. | Section 5 | Level 1 |
| 6.1 | Ensure you are using VPC Endpoints for source code access | Section 6 | Level 1 |
| 8.1 | Ensure AWS Batch is configured with AWS Cloudwatch Logs. | Section 8 | Level 1 |
| 8.2 | Ensure Batch roles are configured for cross-service confused deputy prevention | Section 8 | Level 1 |
| 10.1 | Ensure Managed Platform updates is configured | Section 10 | Level 1 |
| 10.2 | Ensure Persistent logs is setup and configured to S3 | Section 10 | Level 1 |
| 10.3 | Ensure access logs are enabled. | Section 10 | Level 1 |
| 10.4 | Ensure that HTTPS is enabled on load balancer | Section 10 | Level 1 |
| 11.1 | Ensure customer-managed keys are used to encrypt AWS Fargate ephemeral storage data for Amazon ECS | Section 11 | Level 2 |
| 12.1 | Ensure AWS Config is Enabled for Lambda and Serverless | Section 12 | Level 2 |
| 12.2 | Ensure Cloudwatch Lambda insights is enabled | Section 12 | Level 1 |
| 12.3 | Ensure AWS Secrets manager is configured and being used by Lambda for databases | Section 12 | Level 1 |
| 12.4 | Ensure least privilege is used with Lambda function access | Section 12 | Level 1 |
| 12.5 | Ensure every Lambda function has its own IAM Role | Section 12 | Level 1 |
| 12.6 | Ensure Lambda functions are not exposed to everyone. | Section 12 | Level 1 |
| 12.7 | Ensure Lambda functions are referencing active execution roles. | Section 12 | Level 1 |
| 12.8 | Ensure that Code Signing is enabled for Lambda functions. | Section 12 | Level 1 |
| 12.9 | Ensure there are no Lambda functions with admin privileges within your AWS account | Section 12 | Level 1 |
| 12.10 | Ensure Lambda functions do not allow unknown cross account access via permission policies. | Section 12 | Level 1 |
| 12.11 | Ensure that the runtime environment versions used for your Lambda functions do not have end of support dates. | Section 12 | Level 1 |
| 12.12 | Ensure encryption in transit is enabled for Lambda environment variables | Section 12 | Level 1 |
| 12.13 | Ensure Lambda layers are not shared publicly | Section 12 | Level 1 |
| 12.14 | Ensure Lambda recursive invocation detection is enabled | Section 12 | Level 1 |
| 12.15 | Ensure Lambda function URLs do not use wildcard CORS origins | Section 12 | Level 1 |
| 12.16 | Ensure AWS Lambda Function URLs are configured to use AWS IAM authentication | Section 12 | Level 1 |
| 12.17 | Ensure Lambda functions accessing private resources or sensitive data are deployed within a customer managed VPC | Section 12 | Level 2 |
| 16.1 | Ensure communications between your applications and clients is encrypted. | Section 16 | Level 1 |
| 17.1 | Ensure Image Builder distribution configurations do not publicly share AMIs | Section 17 | Level 1 |
| 17.2 | Ensure Image Builder pipelines do not disable the built-in security cleanup script | Section 17 | Level 2 |
| 18.1 | Ensure ECR repositories have image scanning enabled | Section 18 | Level 1 |
| 18.2 | Ensure ECR repositories have lifecycle policies configured | Section 18 | Level 2 |
| 18.3 | Ensure ECR repositories use immutable image tags | Section 18 | Level 1 |
| 18.4 | Ensure private ECR repositories do not allow public access via resource policies | Section 18 | Level 1 |
CIS AWS Database Services v2.0.0
98 controls · individual check pages follow once each section's service is confirmed
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 2.1 | Ensure the Use of Security Groups | Section 2 | Level 1 |
| 2.2 | Ensure Data at Rest is Encrypted | Section 2 | Level 1 |
| 2.3 | Ensure Data in Transit Encryption is Enforced | Section 2 | Level 1 |
| 2.4 | Ensure IAM Roles and Policies are Created | Section 2 | Level 1 |
| 2.5 | Ensure Database Audit Logging is Enabled | Section 2 | Level 1 |
| 2.6 | Ensure Passwords are Regularly Rotated | Section 2 | Level 1 |
| 2.7 | Ensure Least Privilege Access | Section 2 | Level 1 |
| 2.8 | Ensure Automatic Backups and Retention Policies are configured | Section 2 | Level 1 |
| 2.9 | Ensure Database is not Publicly accessible | Section 2 | Level 1 |
| 2.10 | Ensure Database has IAM Auth is Enabled | Section 2 | Level 2 |
| 2.11 | Ensure Database has delete protection enabled | Section 2 | Level 1 |
| 3.1 | Ensure to Choose the Appropriate Database Engine | Section 3 | Level 1 |
| 3.2 | Ensure to Create The Appropriate Deployment Configuration | Section 3 | Level 1 |
| 3.3 | Ensure to Create a Virtual Private Cloud (VPC) | Section 3 | Level 1 |
| 3.4 | Ensure to Configure Security Groups | Section 3 | Level 1 |
| 3.5 | Enable Encryption at Rest | Section 3 | Level 1 |
| 3.6 | Enable Encryption in Transit | Section 3 | Level 1 |
| 3.7 | Ensure to Implement Access Control and Authentication | Section 3 | Level 1 |
| 3.8 | Ensure to Regularly Patch Systems | Section 3 | Level 1 |
| 3.9 | Ensure Monitoring and Logging is Enabled | Section 3 | Level 1 |
| 3.10 | Ensure to Enable Backup and Recovery | Section 3 | Level 1 |
| 3.11 | Ensure to Regularly Review Security Configuration | Section 3 | Level 1 |
| 3.12 | Ensure Database is not Publicly accessible | Section 3 | Level 1 |
| 3.13 | Ensure Database has IAM Auth is Enabled | Section 3 | Level 2 |
| 3.14 | Ensure Database has delete protection enabled | Section 3 | Level 1 |
| 4.1 | Ensure AWS Identity and Access Management (IAM) is in use | Section 4 | Level 1 |
| 4.2 | Ensure Fine-Grained Access Control is implemented | Section 4 | Level 1 |
| 4.3 | Ensure DynamoDB Encryption at Rest | Section 4 | Level 1 |
| 4.4 | Ensure DynamoDB Encryption in Transit | Section 4 | Level 1 |
| 4.5 | Ensure VPC Endpoints are configured | Section 4 | Level 1 |
| 4.6 | Ensure DynamoDB Streams and AWS Lambda for Automated Compliance Checking is Enabled | Section 4 | Level 1 |
| 4.7 | Ensure Monitor and Audit Activity is enabled | Section 4 | Level 1 |
| 4.8 | Ensure Database has delete protection enabled | Section 4 | Level 1 |
| 4.9 | Ensure Database has Backup enabled | Section 4 | Level 1 |
| 5.1 | Ensure Secure Access to ElastiCache | Section 5 | Level 1 |
| 5.2 | Ensure Network Security is Enabled | Section 5 | Level 1 |
| 5.3 | Ensure Encryption at Rest and in Transit is configured | Section 5 | Level 1 |
| 5.4 | Ensure Automatic Updates and Patching are Enabled | Section 5 | Level 1 |
| 5.5 | Ensure Virtual Private Cloud (VPC) is Enabled | Section 5 | Level 1 |
| 5.6 | Ensure Monitoring and Logging is Enabled | Section 5 | Level 1 |
| 5.7 | Ensure Security Configurations are Reviewed Regularly | Section 5 | Level 1 |
| 5.8 | Ensure Authentication and Access Control is Enabled | Section 5 | Level 1 |
| 5.9 | Ensure Audit Logging is Enabled | Section 5 | Level 1 |
| 5.10 | Ensure Security Configurations are Reviewed Regularly | Section 5 | Level 1 |
| 5.11 | Ensure ElastiCache has Cluster Mode Enabled | Section 5 | Level 2 |
| 5.12 | Ensure ElastiCache is deployed across multiple Availability Zones (AZs) | Section 5 | Level 2 |
| 5.13 | Ensure ElastiCache has automatic backups enabled | Section 5 | Level 1 |
| 6.1 | Ensure Network Security is Enabled | Section 6 | Level 1 |
| 6.2 | Ensure Data at Rest and in Transit is Encrypted | Section 6 | Level 1 |
| 6.3 | Ensure Authentication and Access Control is Enabled | Section 6 | Level 1 |
| 6.4 | Ensure Audit Logging is Enabled | Section 6 | Level 1 |
| 6.5 | Ensure Security Configurations are Reviewed Regularly | Section 6 | Level 1 |
| 6.6 | Ensure Monitoring and Alerting is Enabled | Section 6 | Level 1 |
| 6.7 | Ensure MemoryDB has automatic backups enabled | Section 6 | Level 1 |
| 7.1 | Ensure Network Architecture Planning | Section 7 | Level 1 |
| 7.2 | Ensure VPC Security is Configured | Section 7 | Level 1 |
| 7.3 | Ensure Encryption at Rest is Enabled | Section 7 | Level 1 |
| 7.4 | Ensure Encryption in Transit is Enabled | Section 7 | Level 1 |
| 7.5 | Ensure to Implement Access Control and Authentication | Section 7 | Level 1 |
| 7.6 | Ensure Audit Logging is Enabled | Section 7 | Level 1 |
| 7.7 | Ensure Regular Updates and Patches | Section 7 | Level 1 |
| 7.8 | Ensure to Implement Monitoring and Alerting | Section 7 | Level 1 |
| 7.9 | Ensure to Implement Backup and Disaster Recovery | Section 7 | Level 1 |
| 7.10 | Ensure to Configure Backup Window | Section 7 | Level 1 |
| 7.11 | Ensure to Conduct Security Assessments | Section 7 | Level 1 |
| 7.12 | Ensure DocumentDB has delete protection enabled | Section 7 | Level 1 |
| 8.1 | Ensure Keyspace Security is Configured | Section 8 | Level 1 |
| 8.2 | Ensure Network Security is Enabled | Section 8 | Level 1 |
| 8.3 | Ensure Data at Rest and in Transit is Encrypted | Section 8 | Level 1 |
| 8.4 | Ensure Amazon Keyspaces tables have Point-in-Time Recovery (PITR) enabled | Section 8 | Level 1 |
| 9.1 | Ensure Network Security is Enabled | Section 9 | Level 1 |
| 9.2 | Ensure Data at Rest is Encrypted | Section 9 | Level 1 |
| 9.3 | Ensure Data in Transit is Encrypted | Section 9 | Level 1 |
| 9.4 | Ensure Authentication and Access Control is Enabled | Section 9 | Level 1 |
| 9.5 | Ensure Audit Logging is Enabled | Section 9 | Level 1 |
| 9.6 | Ensure Security Configurations are Reviewed Regularly | Section 9 | Level 1 |
| 9.7 | Ensure Monitoring and Alerting is Enabled | Section 9 | Level 1 |
| 9.8 | Ensure Neptune Database is not Publicly accessible | Section 9 | Level 1 |
| 9.9 | Ensure Neptune Database has automatic backups enabled | Section 9 | Level 1 |
| 9.10 | Ensure Database has delete protection enabled | Section 9 | Level 1 |
| 9.11 | Ensure Neptune DB instances are deployed across multiple Availability Zones (AZs) | Section 9 | Level 2 |
| 10.1 | Ensure Data Ingestion is Secure | Section 10 | Level 1 |
| 10.2 | Ensure Data at Rest is Encrypted | Section 10 | Level 1 |
| 10.3 | Ensure Encryption in Transit is Configured | Section 10 | Level 1 |
| 10.4 | Ensure Access Control and Authentication is Enabled | Section 10 | Level 1 |
| 10.5 | Ensure Fine-Grained Access Control is Enabled | Section 10 | Level 1 |
| 10.6 | Ensure Audit Logging is Enabled | Section 10 | Level 1 |
| 10.7 | Ensure Regular Updates and Patches are Installed | Section 10 | Level 1 |
| 10.8 | Ensure Monitoring and Alerting is Enabled | Section 10 | Level 1 |
| 10.9 | Ensure to Review and Update the Security Configuration | Section 10 | Level 1 |
| 10.10 | Ensure Database has automated Backups enabled | Section 10 | Level 1 |
| 11.1 | Ensure to Implement Identity and Access Management (IAM) | Section 11 | Level 1 |
| 11.2 | Ensure Network Access is Secure | Section 11 | Level 1 |
| 11.3 | Ensure Data at Rest is Encrypted | Section 11 | Level 1 |
| 11.4 | Ensure Data in Transit is Encrypted | Section 11 | Level 1 |
| 11.5 | Ensure to Implement Access Control and Authentication | Section 11 | Level 1 |
| 11.6 | Ensure Monitoring and Logging is Enabled | Section 11 | Level 1 |
| 11.7 | Ensure to Enable Backup and Recovery | Section 11 | Level 1 |
CIS AWS Storage Services v1.0.0
56 controls · individual check pages follow once each section's service is confirmed
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 1.1 | AWS Storage Backups | Section 1 | Level 2 |
| 1.2 | Ensure securing AWS Backups | Section 1 | Level 2 |
| 1.3 | Ensure to create backup template and name | Section 1 | Level 2 |
| 1.4 | Ensure to create AWS IAM Policies | Section 1 | Level 2 |
| 1.5 | Ensure to create IAM roles for Backup | Section 1 | Level 2 |
| 1.6 | Ensure AWS Backup with Service Linked Roles | Section 1 | Level 2 |
| 2.1 | Ensure creating EC2 instance with EBS | Section 2 | Level 2 |
| 2.2 | Ensure configuring Security Groups | Section 2 | Level 2 |
| 2.3 | Ensure the proper configuration of EBS storage | Section 2 | Level 2 |
| 2.4 | Ensure the creation of a new volume | Section 2 | Level 2 |
| 2.5 | Ensure creating snapshots of EBS volumes | Section 2 | Level 2 |
| 2.6 | Ensure Proper IAM Configuration for EC2 Instances | Section 2 | Level 2 |
| 2.7 | Ensure creating IAM User | Section 2 | Level 2 |
| 2.8 | Ensure the Creation of IAM Groups | Section 2 | Level 2 |
| 2.9 | Ensure Granular Policy Creation | Section 2 | Level 2 |
| 2.10 | Ensure Resource Access via Tag-based Policies | Section 2 | Level 2 |
| 2.11 | Ensure Secure Password Policy Implementation | Section 2 | Level 2 |
| 2.12 | Ensure Monitoring EC2 and EBS with CloudWatch | Section 2 | Level 2 |
| 2.13 | Ensure creating an SNS subscription | Section 2 | Level 2 |
| 3.1 | EFS | Section 3 | Level 2 |
| 3.2 | Ensure Implementation of EFS | Section 3 | Level 2 |
| 3.3 | Ensure EFS and VPC Integration | Section 3 | Level 2 |
| 3.4 | Ensure controlling Network access to EFS Services | Section 3 | Level 2 |
| 3.5 | Ensure using Security Groups for VPC | Section 3 | Level 2 |
| 3.6 | Ensure Secure Ports | Section 3 | Level 2 |
| 3.7 | Ensure File-Level Access Control with Mount Targets | Section 3 | Level 2 |
| 3.8 | Ensure managing mount target security groups | Section 3 | Level 2 |
| 3.9 | Ensure using VPC endpoints - EFS | Section 3 | Level 2 |
| 3.10 | Ensure managing AWS EFS access points | Section 3 | Level 2 |
| 3.11 | Ensure accessing Points and IAM Policies | Section 3 | Level 2 |
| 3.12 | Ensure configuring IAM for AWS Elastic Disaster Recovery | Section 3 | Level 2 |
| 4.1 | FSX (AWS Elastic File Cache) | Section 4 | Level 2 |
| 4.2 | Amazon Elastic File Cache | Section 4 | Level 2 |
| 4.3 | Ensure the creation of an FSX Bucket | Section 4 | Level 2 |
| 4.4 | Ensure the creation of Elastic File Cache | Section 4 | Level 2 |
| 4.5 | Ensure installation and configuration of Lustre Client | Section 4 | Level 2 |
| 4.6 | Ensure EC2 Kernel compatibility with Lustre | Section 4 | Level 2 |
| 4.7 | Ensure mounting FSx cache | Section 4 | Level 2 |
| 4.8 | Ensure exporting cache to S3 | Section 4 | Level 2 |
| 4.9 | Ensure cleaning up FSx Resources | Section 4 | Level 2 |
| 5.1 | Amazon Simple Storage Service | Section 5 | Level 2 |
| 5.2 | Ensure direct data addition to S3 | Section 5 | Level 2 |
| 5.3 | Ensure Storage Classes are Configured | Section 5 | Level 2 |
| 6.1 | Ensure Elastic Disaster Recovery is Configured | Section 6 | Level 2 |
| 6.2 | Ensure AWS Disaster Recovery Configuration | Section 6 | Level 2 |
| 6.3 | Ensure functionality of Endpoint Detection and Response (EDR) | Section 6 | Level 2 |
| 6.4 | Ensure configuration of replication settings | Section 6 | Level 2 |
| 6.5 | Ensure proper IAM configuration for AWS Elastic Disaster Recovery | Section 6 | Level 2 |
| 6.6 | Ensure installation of the AWS Replication Agent | Section 6 | Level 2 |
| 6.7 | Ensure proper configuration of the Launch Settings | Section 6 | Level 2 |
| 6.8 | Ensure execution of a recovery drill | Section 6 | Level 2 |
| 6.9 | Ensure Continuous Disaster Recovery Operations | Section 6 | Level 2 |
| 6.10 | Ensure execution of a Disaster Recovery Failover | Section 6 | Level 2 |
| 6.11 | Ensure execution of a failback | Section 6 | Level 2 |
| 6.12 | Ensure CloudWatch Metrics for AWS EDR | Section 6 | Level 2 |
| 6.13 | Ensure working of EDR | Section 6 | Level 2 |