{
  "Framework": "NIST-800-53-Revision-4",
  "Version": "",
  "Provider": "AWS",
  "Description": "NIST 800-53 is a regulatory standard that defines the minimum baseline of security controls for all U.S. federal information systems except those related to national security. The controls defined in this standard are customizable and address a diverse set of security and privacy requirements.",
  "Requirements": [
    {
      "Id": "ac_2_1",
      "Name": "AC-2(1) Automated System Account Management",
      "Description": "Access control policies (e.g., identity or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses non-privileged) are addressed in requirement 3.1.2.",
      "Attributes": [
        {
          "ItemId": "ac_2_1",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "iam_password_policy_reuse_24",
        "iam_rotate_access_key_90_days",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ac_2_3",
      "Name": "AC-2(3) Disable Inactive Accounts",
      "Description": "The information system automatically disables inactive accounts after 90 days for user accounts.",
      "Attributes": [
        {
          "ItemId": "ac_2_3",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_4",
      "Name": "AC-2(4) Automated Audit Actions",
      "Description": "The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].",
      "Attributes": [
        {
          "ItemId": "ac_2_4",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ac_2_12",
      "Name": "AC-2(12) Account Monitoring",
      "Description": "Monitors and reports atypical usage of information system accounts to organization-defined personnel or roles.",
      "Attributes": [
        {
          "ItemId": "ac_2_12",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ac_2",
      "Name": "Account Management (AC-2)",
      "Description": "Manage system accounts, group memberships, privileges, workflow, notifications, deactivations, and authorizations.",
      "Attributes": [
        {
          "ItemId": "ac_2",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "guardduty_is_enabled",
        "iam_password_policy_reuse_24",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ac_3",
      "Name": "Access Enforcement (AC-3)",
      "Description": "The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.",
      "Attributes": [
        {
          "ItemId": "ac_3",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_url_public",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_bucket_public_access"
      ]
    },
    {
      "Id": "ac_4",
      "Name": "Information Flow Enforcement (AC-4)",
      "Description": "The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on organization-defined information flow control policies.",
      "Attributes": [
        {
          "ItemId": "ac_4",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "acm_certificates_expiration_check",
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_5",
      "Name": "Separation Of Duties (AC-5)",
      "Description": "Separate duties of individuals to prevent malevolent activity. automate separation of duties and access authorizations.",
      "Attributes": [
        {
          "ItemId": "ac_5",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges"
      ]
    },
    {
      "Id": "ac_6_10",
      "Name": "AC-6(10) Prohibit Non-Privileged Users From Executing Privileged Functions",
      "Description": "The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.",
      "Attributes": [
        {
          "ItemId": "ac_6_10",
          "Section": "Access Control (AC)",
          "SubSection": "Least Privilege (AC-6)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ac_6",
      "Name": "Least Privilege (AC-6)",
      "Description": "The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.",
      "Attributes": [
        {
          "ItemId": "ac_6",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "ec2_instance_imdsv2_enabled",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "ac_17_1",
      "Name": "AC-17(1) Automated Monitoring/Control",
      "Description": "The information system monitors and controls remote access methods.",
      "Attributes": [
        {
          "ItemId": "ac_17_1",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ac_17_2",
      "Name": "AC-17(2) Protection Of Confidentiality/Integrity Using Encryption",
      "Description": "The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.",
      "Attributes": [
        {
          "ItemId": "ac_17_2",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "acm_certificates_expiration_check",
        "elb_ssl_listeners",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "ac_17_3",
      "Name": "AC-17(3) Managed Access Control Points",
      "Description": "The information system routes all remote accesses through organization-defined managed network access control points.",
      "Attributes": [
        {
          "ItemId": "ac_17_3",
          "Section": "Access Control (AC)",
          "Service": "vpc"
        }
      ],
      "Checks": []
    },
    {
      "Id": "ac_21",
      "Name": "Information Sharing (AC-21)",
      "Description": "Facilitate information sharing. Enable authorized users to grant access to partners.",
      "Attributes": [
        {
          "ItemId": "ac_21",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "au_2",
      "Name": "Event Logging (AU-2)",
      "Description": "Automate security audit function with other organizational entities. Enable mutual support of audit of auditable events.",
      "Attributes": [
        {
          "ItemId": "au_2",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3",
      "Name": "Content of Audit Records (AU-3)",
      "Description": "The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.",
      "Attributes": [
        {
          "ItemId": "au_3",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_6_1",
      "Name": "AU-6(1) Process Integration",
      "Description": "The organization employs automated mechanisms to integrate audit review, analysis,and reporting processes to support organizational processes for investigation and response to suspicious activities.",
      "Attributes": [
        {
          "ItemId": "au_6_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "au_6_3",
      "Name": "AU-6(3) Correlate Audit Repositories",
      "Description": "The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.",
      "Attributes": [
        {
          "ItemId": "au_6_3",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "au_7_1",
      "Name": "AU-7(1) Automatic Processing",
      "Description": "The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].",
      "Attributes": [
        {
          "ItemId": "au_7_1",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudtrail_cloudwatch_logging_enabled"
      ]
    },
    {
      "Id": "au_9_2",
      "Name": "AU-9(2) Audit Backup On Separate Physical Systems / Components",
      "Description": "The information system backs up audit records [Assignment: organization-defined frequency] onto a physically different system or system component than the system or component being audited.",
      "Attributes": [
        {
          "ItemId": "au_9_2",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Protection of Audit Information (AU-9)",
          "Service": "s3"
        }
      ],
      "Checks": []
    },
    {
      "Id": "au_9",
      "Name": "Protection of Audit Information (AU-9)",
      "Description": "The information system protects audit information and audit tools from unauthorized access, modification, and deletion.",
      "Attributes": [
        {
          "ItemId": "au_9",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_kms_encryption_enabled",
        "cloudwatch_log_group_kms_encryption_enabled"
      ]
    },
    {
      "Id": "au_11",
      "Name": "Audit Record Retention (AU-11)",
      "Description": "The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.",
      "Attributes": [
        {
          "ItemId": "au_11",
          "Section": "Audit and Accountability (AU)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "au_12",
      "Name": "Audit Generation (AU-12)",
      "Description": "Audit events defined in AU-2. Allow trusted personnel to select which events to audit. Generate audit records for events.",
      "Attributes": [
        {
          "ItemId": "au_12",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "ca_7",
      "Name": "Continuous Monitoring (CA-7)",
      "Description": "Continuously monitor configuration management processes. Determine security impact, environment and operational risks.",
      "Attributes": [
        {
          "ItemId": "ca_7",
          "Section": "Security Assessment And Authorization (CA)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "ec2_instance_imdsv2_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "cm_2",
      "Name": "Baseline Configuration (CM-2)",
      "Description": "The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.",
      "Attributes": [
        {
          "ItemId": "cm_2",
          "Section": "Configuration Management (CM)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "elbv2_deletion_protection",
        "ssm_managed_compliant_patching",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "cm_7",
      "Name": "Least Functionality (CM-7)",
      "Description": "The organization configures the information system to provide only essential capabilities and prohibits or restricts the use of the functions, ports, protocols, and/or services.",
      "Attributes": [
        {
          "ItemId": "cm_7",
          "Section": "Configuration Management (CM)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_1",
      "Name": "CM-8(1) Updates During Installation / Removals",
      "Description": "The organization develops and documents an inventory of information system components that accurately reflects the current information system, includes all components within the authorization boundary of the information system, is at the level of granularity deemed necessary for tracking and reporting and reviews and updates the information system component inventory.",
      "Attributes": [
        {
          "ItemId": "cm_8_1",
          "Section": "Configuration Management (CM)",
          "SubSection": "Information System Component Inventory (CM-8)",
          "Service": "ec2"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm"
      ]
    },
    {
      "Id": "cm_8_3",
      "Name": "CM-8(3) Automated Unauthorized Component Detection",
      "Description": "The organization employs automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the information system and takes actions (disables network access by such components, isolates the components etc) when unauthorized components are detected.",
      "Attributes": [
        {
          "ItemId": "cm_8_3",
          "Section": "Configuration Management (CM)",
          "SubSection": "Information System Component Inventory (CM-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cp_9",
      "Name": "Information System Backup (CP-9)",
      "Description": "The organization conducts backups of user-level information, system-level information and information system documentation including security-related documentation contained in the information system and protects the confidentiality, integrity, and availability of backup information at storage locations.",
      "Attributes": [
        {
          "ItemId": "cp_9",
          "Section": "Contingency Planning (CP)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled"
      ]
    },
    {
      "Id": "cp_10",
      "Name": "Information System Recovery And Reconstitution (CP-10)",
      "Description": "The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.",
      "Attributes": [
        {
          "ItemId": "cp_10",
          "Section": "Contingency Planning (CP)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "elbv2_deletion_protection",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_multi_az",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "ia_2_1",
      "Name": "IA-2(1) Network Access To Privileged Accounts",
      "Description": "The information system implements multi-factor authentication for network access to privileged accounts.",
      "Attributes": [
        {
          "ItemId": "ia_2_1",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2_2",
      "Name": "IA-2(2) Network Access To Non-Privileged Accounts",
      "Description": "The information system implements multifactor authentication for network access to non-privileged accounts.",
      "Attributes": [
        {
          "ItemId": "ia_2_2",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2_11",
      "Name": "IA-2(11) Remote Access - Separate Device",
      "Description": "The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [Assignment: organization-defined strength of mechanism requirements].",
      "Attributes": [
        {
          "ItemId": "ia_2_11",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2",
      "Name": "Identification and Authentication (Organizational users) (IA-2)",
      "Description": "The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).",
      "Attributes": [
        {
          "ItemId": "ia_2",
          "Section": "Identification and Authentication (IA)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_password_policy_reuse_24"
      ]
    },
    {
      "Id": "ia_5_1",
      "Name": "IA-5(1) Password-Based Authentication",
      "Description": "The information system, for password-based authentication that enforces minimum password complexity, stores and transmits only cryptographically-protected passwords, enforces password minimum and maximum lifetime restrictions, prohibits password reuse, allows the use of a temporary password for system logons with an immediate change to a permanent password etc.",
      "Attributes": [
        {
          "ItemId": "ia_5_1",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_reuse_24"
      ]
    },
    {
      "Id": "ia_5_4",
      "Name": "IA-5(4) Automated Support For Password Strength Determination",
      "Description": "The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].",
      "Attributes": [
        {
          "ItemId": "ia_5_4",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_reuse_24"
      ]
    },
    {
      "Id": "ia_5_7",
      "Name": "IA-5(7) No Embedded Unencrypted Static Authenticators",
      "Description": "The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.",
      "Attributes": [
        {
          "ItemId": "ia_5_7",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "codebuild"
        }
      ],
      "Checks": []
    },
    {
      "Id": "ir_4_1",
      "Name": "IR-4(1) Automated Incident Handling Processes",
      "Description": "The organization employs automated mechanisms to support the incident handling process.",
      "Attributes": [
        {
          "ItemId": "ir_4_1",
          "Section": "Incident Response (IR)",
          "SubSection": "Incident Handling (IR-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_no_high_severity_findings"
      ]
    },
    {
      "Id": "ir_6_1",
      "Name": "IR-6(1) Automated Reporting",
      "Description": "The organization employs automated mechanisms to assist in the reporting of security incidents.",
      "Attributes": [
        {
          "ItemId": "ir_6_1",
          "Section": "Incident Response (IR)",
          "SubSection": "Incident Reporting (IR-6)",
          "Service": "guardduty"
        }
      ],
      "Checks": [
        "guardduty_no_high_severity_findings"
      ]
    },
    {
      "Id": "ir_7_1",
      "Name": "IR-7(1) Automation Support For Availability Of Information / Support",
      "Description": "The organization employs automated mechanisms to increase the availability of incident response-related information and support.",
      "Attributes": [
        {
          "ItemId": "ir_7_1",
          "Section": "Incident Response (IR)",
          "SubSection": "Incident Response Assistance (IR-7)",
          "Service": "guardduty"
        }
      ],
      "Checks": [
        "guardduty_no_high_severity_findings"
      ]
    },
    {
      "Id": "ra_5",
      "Name": "Vulnerability Scanning (RA-5)",
      "Description": "Scan for system vulnerabilities. Share vulnerability information and security controls that eliminate vulnerabilities.",
      "Attributes": [
        {
          "ItemId": "ra_5",
          "Section": "Risk Assessment (RA)",
          "Service": "guardduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
      ]
    },
    {
      "Id": "sa_3",
      "Name": "System Development Life Cycle (SA-3)",
      "Description": "The organization manages the information system using organization-defined system development life cycle, defines and documents information security roles and responsibilities throughout the system development life cycle, identifies individuals having information security roles and responsibilities and integrates the organizational information security risk management process into system development life cycle activities.",
      "Attributes": [
        {
          "ItemId": "sa_3",
          "Section": "System and Services Acquisition (SA)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm"
      ]
    },
    {
      "Id": "sa_10",
      "Name": "Developer Configuration Management (SA-10)",
      "Description": "The organization requires the developer of the information system, system component, or information system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation]; b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].",
      "Attributes": [
        {
          "ItemId": "sa_10",
          "Section": "System and Services Acquisition (SA)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "sc_2",
      "Name": "Application Partitioning (SC-2)",
      "Description": "The information system separates user functionality (including user interface services) from information system management functionality.",
      "Attributes": [
        {
          "ItemId": "sc_2",
          "Section": "System and Communications Protection (SC)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges"
      ]
    },
    {
      "Id": "sc_4",
      "Name": "Information In Shared Resources (SC-4)",
      "Description": "The information system prevents unauthorized and unintended information transfer via shared system resources.",
      "Attributes": [
        {
          "ItemId": "sc_4",
          "Section": "System and Communications Protection (SC)",
          "Service": "ebs"
        }
      ],
      "Checks": []
    },
    {
      "Id": "sc_5",
      "Name": "Denial Of Service Protection (SC-5)",
      "Description": "The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or references to sources for such information] by employing [Assignment: organization-defined security safeguards].",
      "Attributes": [
        {
          "ItemId": "sc_5",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "sc_7_3",
      "Name": "SC-7(3) Access Points",
      "Description": "The organization limits the number of external network connections to the information system.",
      "Attributes": [
        {
          "ItemId": "sc_7_3",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7",
      "Name": "Boundary Protection (SC-7)",
      "Description": "The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.",
      "Attributes": [
        {
          "ItemId": "sc_7",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "elbv2_waf_acl_attached",
        "elb_ssl_listeners",
        "emr_cluster_master_nodes_no_public_ip",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_8_1",
      "Name": "SC-8(1) Cryptographic Or Alternate Physical Protection",
      "Description": "The information system implements cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission unless otherwise protected by [Assignment: organization-defined alternative physical safeguards].",
      "Attributes": [
        {
          "ItemId": "sc_8_1",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Confidentiality And Integrity (SC-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_8",
      "Name": "Transmission Confidentiality And Integrity (SC-8)",
      "Description": "The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted information.",
      "Attributes": [
        {
          "ItemId": "sc_8",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_12",
      "Name": "Cryptographic Key Establishment And Management (SC-12)",
      "Description": "The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].",
      "Attributes": [
        {
          "ItemId": "sc_12",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "acm_certificates_expiration_check",
        "kms_cmk_rotation_enabled"
      ]
    },
    {
      "Id": "sc_13",
      "Name": "Cryptographic Protection (SC-13)",
      "Description": "The information system implements [Assignment: organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.",
      "Attributes": [
        {
          "ItemId": "sc_13",
          "Section": "System and Communications Protection (SC)",
          "Service": "dynamodb"
        }
      ],
      "Checks": [
        "dynamodb_tables_kms_cmk_encryption_enabled"
      ]
    },
    {
      "Id": "sc_23",
      "Name": "Session Authenticity (SC-23)",
      "Description": "The information system protects the authenticity of communications sessions.",
      "Attributes": [
        {
          "ItemId": "sc_23",
          "Section": "System and Communications Protection (SC)",
          "Service": "elb"
        }
      ],
      "Checks": []
    },
    {
      "Id": "sc_28",
      "Name": "Protection Of Information At Rest (SC-28)",
      "Description": "The information system protects the [Selection (one or more): confidentiality; integrity] of [Assignment: organization-defined information at rest].",
      "Attributes": [
        {
          "ItemId": "sc_28",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_kms_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "si_2_2",
      "Name": "SI-2(2) Automates Flaw Remediation Status",
      "Description": "The organization employs automated mechanisms to determine the state of information system components with regard to flaw remediation.",
      "Attributes": [
        {
          "ItemId": "si_2_2",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Flaw Remediation (SI-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_4_1",
      "Name": "SI-4(1) System-Wide Intrusion Detection System",
      "Description": "The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.",
      "Attributes": [
        {
          "ItemId": "si_4_1",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Information System Monitoring (SI-4)",
          "Service": "guardduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_2",
      "Name": "SI-4(2) Automated Tools For Real-Time Analysis",
      "Description": "The organization employs automated tools to support near real-time analysis of events.",
      "Attributes": [
        {
          "ItemId": "si_4_2",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Information System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "ec2_instance_imdsv2_enabled",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "si_4_4",
      "Name": "SI-4(4) Inbound and Outbound Communications Traffic",
      "Description": "The information system monitors inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions.",
      "Attributes": [
        {
          "ItemId": "si_4_4",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Information System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "si_4_5",
      "Name": "SI-4(5) System-Generated Alerts",
      "Description": "The information system alerts organization-defined personnel or roles when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].",
      "Attributes": [
        {
          "ItemId": "si_4_5",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Information System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "si_4_16",
      "Name": "SI-4(16) Correlate Monitoring Information",
      "Description": "The organization correlates information from monitoring tools employed throughout the information system.",
      "Attributes": [
        {
          "ItemId": "si_4_16",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Information System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "si_4",
      "Name": "Information System Monitoring (SI-4)",
      "Description": "The organization: a.Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and 2.Unauthorized local, network, and remote connections; b. Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods]; c. Deploys monitoring devices: 1. Strategically within the information system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g. Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].",
      "Attributes": [
        {
          "ItemId": "si_4",
          "Section": "System and Information Integrity (SI)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "ec2_instance_imdsv2_enabled",
        "elbv2_waf_acl_attached",
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "si_7_1",
      "Name": "SI-7(1) Integrity Checks",
      "Description": "The information system performs an integrity check of security relevant events at least monthly.",
      "Attributes": [
        {
          "ItemId": "si_7_1",
          "Section": "System and Information Integrity (SI)",
          "SubSection": "Software, Firmware, and Information Integrity (SI-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled",
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_7",
      "Name": "Software, Firmware, and Information Integrity (SI-7)",
      "Description": "The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].",
      "Attributes": [
        {
          "ItemId": "si_7",
          "Section": "System and Information Integrity (SI)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "si_12",
      "Name": "Information Handling and Retention (SI-12)",
      "Description": "The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.",
      "Attributes": [
        {
          "ItemId": "si_12",
          "Section": "System and Information Integrity (SI)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "s3_bucket_object_versioning"
      ]
    }
  ]
}
