Comments (5)
I'd like to see a rule that checks to ensure that EFS volumes are utilizing encryption at rest that can be configured to trigger on EFS volume creation events.
from aws-config-rules.
I would love to see rules that correlate to each of the applicable NIST SP 800-53 controls (obviously physical controls wouldn't apply). It's a moving target since they get updated every now and then, but having a managed rule to flip on for compliance would be great.
from aws-config-rules.
Thanks for the feedback.
@slashrun : Noted, I add the EFS volume encryption in our backlog.
@osintr0ze : Yes that would be great to have NIST I agree, it is such a big task to cover at once. We are thinking to do that iteratively. If you had 10 controls (either NIST, or Config Rules) you really wanted what would they be?
from aws-config-rules.
NIST 800-53 controls that could easily be turned into Config Rules would be:
-
CP-9: Information System Backup - Pretty much checking if backups are deployed (database snapshots, etc) and protected (confidentiality, integrity, and availability).
-
AU-2: Audit Events - auditing is turned on (CloudTrail, CloudWatch, Access Logs, VPC Flow Logs, etc.)
-
AU-7: Audit Reduction and Report Generation - audit review, analysis, and reporting is available and content is not altered - (CloudTrail forwarding to CloudWatch, Athena, Lambda, log validation turned on, etc.)
-
AU-10: Non-Repudiation - protects against an individual falsely denying having done something (IAM users, CloudTrail log user/role assumption, etc)
-
AU-11: Audit Record Retention - retain audit records for x time period (Lifecycle policies, log expiration in CloudWatch/CloudTrail S3 policies)
-
CA-2: Security Assessments - security assessment capability, implementation of security controls, reporting (AWS Config, State Manager > Compliance, reports generated)
-
CM-5: Access Restrictions for Change - enforce logical access restrictions associated with changes to the information system (IAM policies that are restricted to ReadOnly, etc)
-
CM-8: Information System Component Inventory - documents an inventory of information system components (generate a list of EC2 instances, endpoints, VPCs, etc)
-
SC-4: Information in Shared Resources - prevent unauthorized and unintended information transfer via shared system resources (S3 bucket policies, prevent public exposure)
-
SC-5: Denial of Service Protection - protect against effects of denial of service attacks (AWS Shield, etc)
from aws-config-rules.
Thanks a lot for the feedback. We are now providing the ability for you to post your aspirational rule, we will do our best to build it.
from aws-config-rules.
Related Issues (20)
- Using multiple conformance packs - how to de-dupe rules?
- parameters.json tags not working
- Conformance Pack for ISO 27001 HOT 8
- Scope By Resource Tags
- S3 bucket policy prohibited on web-server mode
- cloudtrail-enabled managed rule evaluates at a regional level
- Serverless best practice - LambdaInsideVpc
- Operational-Best-Practices-for-HIPAA-Security.yaml does not allow the no-unrestricted-route-to-igw Rule's routeTableIds Parameter to be set
- Python required tag for many resources
- Missing python code for ec2-imds-check
- Operational-Best-Practices-for-NZISM.yaml is too long to be used HOT 1
- Operational-Best-Practices-for-CMMC-2.0-Level-2: Conflicting Config Rules HOT 1
- multi-region-cloudtrail-enabled always fails
- Support “eks-endpoint-no-public-access” and “eks-secrets-encrypted” in the “us-west-1” region
- Update in Rule EC2_SECURITY_GROUP_NOT_USED
- Map Config Rules to CIS Benchmark Rules
- Error when applying Operational-Best-Practices-for-CCN-ENS-Medium
- NIST 800-171 / CMMC 2.0 Level 2 in AWS GovCloud HOT 4
- Getting [ERROR] KeyError: 'invokingEvent' while executing IAM_USER_MFA_ENABLED HOT 1
- Conformance Pack for FedRamp not deployable in GovCloud
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-config-rules.