{
  "Framework": "NIST-800-53-Revision-5",
  "Version": "",
  "Provider": "AWS",
  "Description": "The NIST 800-53 (Rev. 5) Low-Moderate-High framework represents the security controls and the associated assessment procedures that are defined in NIST SP 800-53 Revision 5 Recommended Security Controls for Federal Information Systems and Organizations. For any discrepancies that are noted in the content between this NIST SP 800-53 framework and the latest published NIST Special Publication SP 800-53 Revision 5, refer to the official published documents that are available at the NIST Computer Security Resource Center.",
  "Requirements": [
    {
      "Id": "ac_2_1",
      "Name": "AC-2(1) Automated System Account Management",
      "Description": "Support the management of system accounts using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "ac_2_1",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_2_3_a",
      "Name": "AC-2(3)(a)",
      "Description": "Support the management of system accounts using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "ac_2_3_a",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "SubGroup": "AC-2(3) Disable Accounts",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_3_b",
      "Name": "AC-2(3)(b)",
      "Description": "Disable accounts within [Assignment: organization-defined time period] when the accounts: (b) Are no longer associated with a user or individual.",
      "Attributes": [
        {
          "ItemId": "ac_2_3_b",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "SubGroup": "AC-2(3) Disable Accounts",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_3_c",
      "Name": "AC-2(3)(c)",
      "Description": "Disable accounts within [Assignment: organization-defined time period] when the accounts: (c) Are in violation of organizational policy.",
      "Attributes": [
        {
          "ItemId": "ac_2_3_c",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "SubGroup": "AC-2(3) Disable Accounts",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_3_d",
      "Name": "AC-2(3)(d)",
      "Description": "Disable accounts within [Assignment: organization-defined time period] when the accounts: (d) Have been inactive for [Assignment: organization-defined time period].",
      "Attributes": [
        {
          "ItemId": "ac_2_3_d",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "SubGroup": "AC-2(3) Disable Accounts",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_3",
      "Name": "AC-2(3) Disable Accounts",
      "Description": "Disable accounts within [Assignment: organization-defined time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [Assignment: organization-defined time period].",
      "Attributes": [
        {
          "ItemId": "ac_2_3",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_4",
      "Name": "AC-2(4) Automated Audit Actions",
      "Description": "Automatically audit account creation, modification, enabling, disabling, and removal actions.",
      "Attributes": [
        {
          "ItemId": "ac_2_4",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "ac_2_6",
      "Name": "AC-2(6) Dynamic Privilege Management",
      "Description": "Implement [Assignment: organization-defined dynamic privilege management capabilities].",
      "Attributes": [
        {
          "ItemId": "ac_2_6",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "ec2_instance_imdsv2_enabled",
        "emr_cluster_master_nodes_no_public_ip",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "ac_2_12_a",
      "Name": "AC-2(12)(a)",
      "Description": "Monitor system accounts for [Assignment: organization-defined atypical usage].",
      "Attributes": [
        {
          "ItemId": "ac_2_12_a",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "SubGroup": "AC-2(12) Account Monitoring",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ac_2_d_1",
      "Name": "AC-2(d)(1)",
      "Description": "d. Specify: 1. Authorized users of the system;personnel termination and transfer processes.",
      "Attributes": [
        {
          "ItemId": "ac_2_d_1",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ac_2_g",
      "Name": "AC-2(g)",
      "Description": "The organization: g. Monitors the use of information system accounts.",
      "Attributes": [
        {
          "ItemId": "ac_2_g",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_2_i_2",
      "Name": "AC-2(i)(2)",
      "Description": "i. Authorize access to the system based on: 2. Intended system usage.",
      "Attributes": [
        {
          "ItemId": "ac_2_¡_2",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges"
      ]
    },
    {
      "Id": "ac_2_j",
      "Name": "AC-2(j)",
      "Description": "The organization: j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "ac_2_j",
          "Section": "Access Control (AC)",
          "SubSection": "Account Management (AC-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ]
    },
    {
      "Id": "ac_3",
      "Name": "Access Enforcement (AC-3)",
      "Description": "Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.",
      "Attributes": [
        {
          "ItemId": "ac_3",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_profile_attached",
        "ec2_instance_public_ip",
        "ec2_instance_imdsv2_enabled",
        "emr_cluster_master_nodes_no_public_ip",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "ac_3_1",
      "Name": "AC-3(1) Restricted Access To Privileged Functions",
      "Description": "Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].",
      "Attributes": [
        {
          "ItemId": "ac_3_1",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "ac_3_2",
      "Name": "AC-3(2) Dual Authorization",
      "Description": "Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].",
      "Attributes": [
        {
          "ItemId": "ac_3_2",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ac_3_3",
      "Name": "AC-3(3) Mandatory Access Control",
      "Description": "Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within the system; (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1) Passing the information to unauthorized subjects or objects; (2) Granting its privileges to other subjects; (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components; (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and (5) Changing the rules governing access control; and (c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.",
      "Attributes": [
        {
          "ItemId": "ac_3_3",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_a",
      "Name": "AC-3(3)(a)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within the system.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_a",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_b_1",
      "Name": "AC-3(3)(b)(1)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1) Passing the information to unauthorized subjects or objects.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_b_1",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_b_2",
      "Name": "AC-3(3)(b)(2)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (2) Granting its privileges to other subjects.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_b_2",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_b_3",
      "Name": "AC-3(3)(b)(3)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_b_3",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_b_4",
      "Name": "AC-3(3)(b)(4)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_b_4",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_b_5",
      "Name": "AC-3(3)(b)(5)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (5) Changing the rules governing access.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_b_5",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_3_c",
      "Name": "AC-3(3)(c)",
      "Description": "Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.",
      "Attributes": [
        {
          "ItemId": "ac_3_3_c",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(3) Mandatory Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_4",
      "Name": "AC-3(4) Discretionary Access Control",
      "Description": "Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a) Pass the information to any other subjects or objects; (b) Grant its privileges to other subjects; (c) Change security attributes on subjects, objects, the system, or the system’s components; (d) Choose the security attributes to be associated with newly created or revised objects; or (e) Change the rules governing access control.",
      "Attributes": [
        {
          "ItemId": "ac_3_4",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_4_a",
      "Name": "AC-3(4)(a)",
      "Description": "Enforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a) Pass the information to any other subjects or objects.",
      "Attributes": [
        {
          "ItemId": "ac_3_4_a",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(4) Discretionary Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_4_b",
      "Name": "AC-3(4)(b)",
      "Description": "Enforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (b) Grant its privileges to other subjects.",
      "Attributes": [
        {
          "ItemId": "ac_3_4_b",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(4) Discretionary Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "secretsmanager_automatic_rotation_enabled",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_rotate_access_key_90_days",
        "iam_no_root_access_key",
        "iam_root_mfa_enabled",
        "iam_root_hardware_mfa_enabled",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_password_policy_minimum_length_14",
        "ec2_instance_imdsv2_enabled"
      ]
    },
    {
      "Id": "ac_3_4_c",
      "Name": "AC-3(4)(c)",
      "Description": "Enforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (c) Change security attributes on subjects, objects, the system, or the system’s components.",
      "Attributes": [
        {
          "ItemId": "ac_3_4_c",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(4) Discretionary Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_4_d",
      "Name": "AC-3(4)(d)",
      "Description": "Enforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (d) Choose the security attributes to be associated with newly created or revised objects.",
      "Attributes": [
        {
          "ItemId": "ac_3_4_d",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(4) Discretionary Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_4_e",
      "Name": "AC-3(4)(e)",
      "Description": "Enforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (e) Change the rules governing access.",
      "Attributes": [
        {
          "ItemId": "ac_3_4_e",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(4) Discretionary Access Control",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_7",
      "Name": "AC-3(7) Role-Based Access Control",
      "Description": "Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].",
      "Attributes": [
        {
          "ItemId": "ac_3_7",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "s3_bucket_public_access",
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "ec2_instance_imdsv2_enabled",
        "emr_cluster_master_nodes_no_public_ip",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "ac_3_8",
      "Name": "AC-3(8) Revocation Of Access Authorizations",
      "Description": "Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations].",
      "Attributes": [
        {
          "ItemId": "ac_3_8",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_10",
      "Name": "AC-3(10) Audited Override Of Access Control Mechanisms",
      "Description": "Employ an audited override of automated access mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].",
      "Attributes": [
        {
          "ItemId": "ac_3_10",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "ac_3_12_a",
      "Name": "AC-3(12)(a)",
      "Description": "Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions].",
      "Attributes": [
        {
          "ItemId": "ac_3_12_a",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(12)  Assert And Enforce Application Access",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_12_b",
      "Name": "AC-3(12)(b)",
      "Description": "Provide an enforcement mechanism to prevent unauthorized access;",
      "Attributes": [
        {
          "ItemId": "ac_3_12_b",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(12) Assert And Enforce Application Access",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ac_3_13",
      "Name": "AC-3(13) Attribute-Based Access Control",
      "Description": "Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].",
      "Attributes": [
        {
          "ItemId": "ac_3_13",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_15_a",
      "Name": "AC-3(15)(a)",
      "Description": "Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy.",
      "Attributes": [
        {
          "ItemId": "ac_3_15_a",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(15) Discretionary And Mandatory Access Control",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_3_15_b",
      "Name": "AC-3(15)(b)",
      "Description": "Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.",
      "Attributes": [
        {
          "ItemId": "ac_3_15_b",
          "Section": "Access Control (AC)",
          "SubSection": "Access Enforcement (AC-3)",
          "SubGroup": "AC-3(15) Discretionary And Mandatory Access Control",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_4",
      "Name": "Information Flow Enforcement (AC-4)",
      "Description": "Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].",
      "Attributes": [
        {
          "ItemId": "ac_4",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "ac_4_21",
      "Name": "AC-4(21) Physical Or Logical Separation Of Infomation Flows",
      "Description": "Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].",
      "Attributes": [
        {
          "ItemId": "ac_4_21",
          "Section": "Access Control (AC)",
          "SubSection": "Information Flow Enforcement (AC-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_waf_acl_attached",
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "elbv2_waf_acl_attached",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_4_22",
      "Name": "AC-4(22) Access Only",
      "Description": "Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.",
      "Attributes": [
        {
          "ItemId": "ac_4_22",
          "Section": "Access Control (AC)",
          "SubSection": "Information Flow Enforcement (AC-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "ac_4_26",
      "Name": "AC-4(26) Audit Filtering Actions",
      "Description": "When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.",
      "Attributes": [
        {
          "ItemId": "ac_4_26",
          "Section": "Access Control (AC)",
          "SubSection": "Information Flow Enforcement (AC-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "ac_4_28",
      "Name": "AC-4(28) Linear Filter Pipelines",
      "Description": "When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.",
      "Attributes": [
        {
          "ItemId": "ac_4_28",
          "Section": "Access Control (AC)",
          "SubSection": "Information Flow Enforcement (AC-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_5_b",
      "Name": "AC-5(b)",
      "Description": "Define system access authorizations to support separation of duties.",
      "Attributes": [
        {
          "ItemId": "ac_5_b",
          "Section": "Access Control (AC)",
          "SubSection": "Separation Of Duties (AC-5)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges"
      ]
    },
    {
      "Id": "ac_6",
      "Name": "Least Privilege (AC-6)",
      "Description": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.",
      "Attributes": [
        {
          "ItemId": "ac_6",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "ec2_instance_imdsv2_enabled",
        "emr_cluster_master_nodes_no_public_ip",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "ac_6_2",
      "Name": "AC-6(2)",
      "Description": "Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.",
      "Attributes": [
        {
          "ItemId": "ac_6_2",
          "Section": "Access Control (AC)",
          "SubSection": "Least Privilege (AC-6)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ac_6_3",
      "Name": "AC-6(3)",
      "Description": "Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system.",
      "Attributes": [
        {
          "ItemId": "ac_6_3",
          "Section": "Access Control (AC)",
          "SubSection": "Least Privilege (AC-6)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges"
      ]
    },
    {
      "Id": "ac_6_9",
      "Name": "AC-6(9)",
      "Description": "Log the execution of privileged functions.",
      "Attributes": [
        {
          "ItemId": "ac_6_9",
          "Section": "Access Control (AC)",
          "SubSection": "Least Privilege (AC-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "ac_6_10",
      "Name": "AC-6(10)",
      "Description": "Prevent non-privileged users from executing privileged functions.",
      "Attributes": [
        {
          "ItemId": "ac_6_10",
          "Section": "Access Control (AC)",
          "SubSection": "Least Privilege (AC-6)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ac_7_4",
      "Name": "AC-7(4) Use Of Alternate Authentication Factor",
      "Description": "Prevent non-privileged users from executing privileged functions.",
      "Attributes": [
        {
          "ItemId": "ac_7_4",
          "Section": "Access Control (AC)",
          "SubSection": "Unsuccessful Logon Attempts (AC-7)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ac_7_4_a",
      "Name": "AC-7(4)(a)",
      "Description": "Allow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.",
      "Attributes": [
        {
          "ItemId": "ac_7_4_a",
          "Section": "Access Control (AC)",
          "SubSection": "Unsuccessful Logon Attempts (AC-7)",
          "SubGroup": "AC-7(4) Use Of Alternate Authentication Factor",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ac_16_b",
      "Name": "AC-16(b)",
      "Description": "Ensure that the attribute associations are made and retained with the information.",
      "Attributes": [
        {
          "ItemId": "ac_16_b",
          "Section": "Access Control (AC)",
          "SubSection": "Security And Privacy Attributes (AC-16)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "ac_17_b",
      "Name": "AC-17(b)",
      "Description": "Authorize each type of remote access to the system prior to allowing such connections.",
      "Attributes": [
        {
          "ItemId": "ac_17_b",
          "Section": "Access Control (AC)",
          "SubSection": "Remote Access (AC-17)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_17_1",
      "Name": "AC-17(1) Monitoring And Control",
      "Description": "Employ automated mechanisms to monitor and control remote access methods.",
      "Attributes": [
        {
          "ItemId": "ac_17_1",
          "Section": "Access Control (AC)",
          "SubSection": "Remote Access (AC-17)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_17_2",
      "Name": "AC-17(2) Protection Of Confidentiality And Integrity Using Encryption",
      "Description": "Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.",
      "Attributes": [
        {
          "ItemId": "ac_17_2",
          "Section": "Access Control (AC)",
          "SubSection": "Remote Access (AC-17)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "ac_17_4_a",
      "Name": "AC-17(4)(a)",
      "Description": "Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs];",
      "Attributes": [
        {
          "ItemId": "ac_17_4_a",
          "Section": "Access Control (AC)",
          "SubSection": "Remote Access (AC-17)",
          "SubGroup": "AC-17(4) Privileged Commands And Access",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_17_9",
      "Name": "AC-17(9) Disconnect Or Disable Access",
      "Description": "Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].",
      "Attributes": [
        {
          "ItemId": "ac_17_9",
          "Section": "Access Control (AC)",
          "SubSection": "Remote Access (AC-17)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_17_10",
      "Name": "AC-17(10) Authenticate Remote Commands",
      "Description": "Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].",
      "Attributes": [
        {
          "ItemId": "ac_17_10",
          "Section": "Access Control (AC)",
          "SubSection": "Remote Access (AC-17)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "ac_24",
      "Name": "Access Control Decisions (AC-24)",
      "Description": "[Selection: Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.",
      "Attributes": [
        {
          "ItemId": "ac_24",
          "Section": "Access Control (AC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "ac_24_1",
      "Name": "AC-24(1)",
      "Description": "Transmit [Assignment: organization-defined access authorization information] using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control decisions.",
      "Attributes": [
        {
          "ItemId": "ac_24_1",
          "Section": "Access Control (AC)",
          "SubSection": "Access Control Decisions (AC-24)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "au_2_b",
      "Name": "AU-2(b)",
      "Description": "Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.",
      "Attributes": [
        {
          "ItemId": "au_2_b",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Event Logging (AU-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3_1",
      "Name": "AU-3(1) Additional Audit Information",
      "Description": "Generate audit records containing the following additional information: [Assignment: organization-defined additional information].",
      "Attributes": [
        {
          "ItemId": "au_3_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "au_3_a",
      "Name": "AU-3(a)",
      "Description": "Ensure that audit records contain information that establishes the following: a. What type of event occurred.",
      "Attributes": [
        {
          "ItemId": "au_3_a",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3_b",
      "Name": "AU-3(b)",
      "Description": "Ensure that audit records contain information that establishes the following: b. When the event occurred.",
      "Attributes": [
        {
          "ItemId": "au_3_b",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3_c",
      "Name": "AU-3(c)",
      "Description": "Ensure that audit records contain information that establishes the following: c. Where the event occurred.",
      "Attributes": [
        {
          "ItemId": "au_3_c",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3_d",
      "Name": "AU-3(d)",
      "Description": "Ensure that audit records contain information that establishes the following: d. Source of the event.",
      "Attributes": [
        {
          "ItemId": "au_3_d",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3_e",
      "Name": "AU-3(e)",
      "Description": "Ensure that audit records contain information that establishes the following: e. Outcome of the event.",
      "Attributes": [
        {
          "ItemId": "au_3_e",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_3_f",
      "Name": "AU-3(f)",
      "Description": "Ensure that audit records contain information that establishes the following: e. Outcome of the event.",
      "Attributes": [
        {
          "ItemId": "au_3_f",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Content of Audit Records (AU-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "au_4_1",
      "Name": "AU-4(1) Transfer To Alternate Storage",
      "Description": "Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.",
      "Attributes": [
        {
          "ItemId": "au_4_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Log Stprage Capacity (AU-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled"
      ]
    },
    {
      "Id": "au_6_1",
      "Name": "AU-6(1) Automated Process Integration",
      "Description": "Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "au_6_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "au_6_3",
      "Name": "AU-6(3) Correlate Audit Record Repositories",
      "Description": "Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.",
      "Attributes": [
        {
          "ItemId": "au_6_3",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_6_4",
      "Name": "AU-6(4) Central Review And Analysis",
      "Description": "Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.",
      "Attributes": [
        {
          "ItemId": "au_6_4",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_6_5",
      "Name": "AU-6(5) Central Review And Analysis",
      "Description": "Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.",
      "Attributes": [
        {
          "ItemId": "au_6_5",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "au_6_6",
      "Name": "AU-6(6) Correletion With Physical Monitoring",
      "Description": "Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.",
      "Attributes": [
        {
          "ItemId": "au_6_6",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_6_9",
      "Name": "AU-6(9) Correletion With From Nontechnical Sources",
      "Description": "Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.",
      "Attributes": [
        {
          "ItemId": "au_6_9",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Review, Analysis And Reporting (AU-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_7_1",
      "Name": "AU-7(1) Automatic Processing",
      "Description": "Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].",
      "Attributes": [
        {
          "ItemId": "au_7_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Reduction And Report Generation (AU-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled"
      ]
    },
    {
      "Id": "au_8_b",
      "Name": "AU-8(b)",
      "Description": "Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.",
      "Attributes": [
        {
          "ItemId": "au_8_b",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Time Stamps (AU-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_9_a",
      "Name": "AU-9(a)",
      "Description": "Protect audit information and audit logging tools from unauthorized access, modification, and deletion.",
      "Attributes": [
        {
          "ItemId": "au_9_a",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Protection of Audit Information (AU-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "au_9_2",
      "Name": "AU-9(2) Store On Separate Physical Systems Or Components",
      "Description": "Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.",
      "Attributes": [
        {
          "ItemId": "au_9_2",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Protection of Audit Information (AU-9)",
          "Service": "s3"
        }
      ],
      "Checks": [
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "au_9_3",
      "Name": "AU-9(3) Cryptographic Protection",
      "Description": "Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.",
      "Attributes": [
        {
          "ItemId": "au_9_3",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Protection of Audit Information (AU-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "cloudtrail_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "au_9_7",
      "Name": "AU-9(7) Store On Component With Different Operation Systems",
      "Description": "Store audit information on a component running a different operating system than the system or component being audited.",
      "Attributes": [
        {
          "ItemId": "au_9_7",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Protection of Audit Information (AU-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled"
      ]
    },
    {
      "Id": "au_10",
      "Name": "Non-Repudiation (AU-10)",
      "Description": "Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation].",
      "Attributes": [
        {
          "ItemId": "au_10",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "opensearch_service_domains_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "au_11",
      "Name": "Audit Record Retention (AU-11)",
      "Description": "Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.",
      "Attributes": [
        {
          "ItemId": "au_11",
          "Section": "Audit and Accountability (AU)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "au_11_1",
      "Name": "AU-11(1) Long-Term Retrieval Capability",
      "Description": "Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.",
      "Attributes": [
        {
          "ItemId": "au_11_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Retention (AU-11)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "au_12_a",
      "Name": "AU-12(a)",
      "Description": "Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components].",
      "Attributes": [
        {
          "ItemId": "au_12_a",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Generation (AU-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_12_c",
      "Name": "AU-12(c)",
      "Description": "Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.",
      "Attributes": [
        {
          "ItemId": "au_12_c",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Generation (AU-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_12_1",
      "Name": "AU-12(1) System-Wide And Time-Correlated Audit Trial",
      "Description": "Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail].",
      "Attributes": [
        {
          "ItemId": "au_12_1",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Generation (AU-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_12_2",
      "Name": "AU-12(2) Standardized Formats",
      "Description": "Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.",
      "Attributes": [
        {
          "ItemId": "au_12_2",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Generation (AU-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_12_3",
      "Name": "AU-12(3) Changes By Authorized Individuals",
      "Description": "Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].",
      "Attributes": [
        {
          "ItemId": "au_12_3",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Generation (AU-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_12_4",
      "Name": "AU-12(4) Query Parameter Audits Of Personally Identifiable Information",
      "Description": "Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.",
      "Attributes": [
        {
          "ItemId": "au_12_4",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Audit Record Generation (AU-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_14_a",
      "Name": "AU-14(a)",
      "Description": "Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances].",
      "Attributes": [
        {
          "ItemId": "au_14_a",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Session Audit (AU-14)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_14_b",
      "Name": "AU-14(b)",
      "Description": "Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.",
      "Attributes": [
        {
          "ItemId": "au_14_b",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Session Audit (AU-14)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_14_3",
      "Name": "AU-14(3) Remote Viewing And Listening",
      "Description": "Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.",
      "Attributes": [
        {
          "ItemId": "au_14_3",
          "Section": "Audit and Accountability (AU)",
          "SubSection": "Session Audit (AU-14)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "au_16",
      "Name": "Cross-Organizational Audit Logging (AU-16)",
      "Description": "Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.",
      "Attributes": [
        {
          "ItemId": "au_16",
          "Section": "Audit and Accountability (AU)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_cloudwatch_logging_enabled"
      ]
    },
    {
      "Id": "ca_2_2",
      "Name": "CA-2(2) Specialized Assessments",
      "Description": "Include as part of control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]].",
      "Attributes": [
        {
          "ItemId": "ca_2_2",
          "Section": "Assessment, Authorization, And Monitoring (CA)",
          "SubSection": "Control Assessments (CA-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "rds_instance_enhanced_monitoring_enabled"
      ]
    },
    {
      "Id": "ca_2_d",
      "Name": "CA-2(d)",
      "Description": "Assess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements.",
      "Attributes": [
        {
          "ItemId": "ca_2_d",
          "Section": "Assessment, Authorization, And Monitoring (CA)",
          "SubSection": "Control Assessments (CA-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ca_7",
      "Name": "Continuous Monitoring (CA-7)",
      "Description": "Continuously monitor configuration management processes. Determine security impact, environment and operational risks.",
      "Attributes": [
        {
          "ItemId": "ca_7",
          "Section": "Assessment, Authorization, And Monitoring (CA)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
      ]
    },
    {
      "Id": "ca_7_b",
      "Name": "CA-7(b)",
      "Description": "Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness.",
      "Attributes": [
        {
          "ItemId": "ca_7_b",
          "Section": "Assessment, Authorization, And Monitoring (CA)",
          "SubSection": "Continuous Monitoring (CA-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "ca_7_4_c",
      "Name": "CA-7(4)(c)",
      "Description": "Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (c) Change monitoring.",
      "Attributes": [
        {
          "ItemId": "ca_7_4_c",
          "Section": "Assessment, Authorization, And Monitoring (CA)",
          "SubSection": "Continuous Monitoring (CA-7)",
          "SubGroup": "CA-7(4) Risk Monitoring",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection"
      ]
    },
    {
      "Id": "ca_9_b",
      "Name": "CA-9(b)",
      "Description": "Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated.",
      "Attributes": [
        {
          "ItemId": "ca_9_b",
          "Section": "Assessment, Authorization, And Monitoring (CA)",
          "SubSection": "Internal System Connections (CA-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "cm_2_a",
      "Name": "CM-2(a)",
      "Description": "Develop, document, and maintain under configuration control, a current baseline configuration of the system.",
      "Attributes": [
        {
          "ItemId": "cm_2_a",
          "Section": "Configuration Management (CM)",
          "SubSection": "Baseline Configuration (CM-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "elbv2_deletion_protection",
        "ssm_managed_compliant_patching",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "cm_2_b",
      "Name": "CM-2(b)",
      "Description": "Review and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency]; 2. When required due to [Assignment: organization-defined circumstances]; and 3. When system components are installed or upgraded.",
      "Attributes": [
        {
          "ItemId": "cm_2_b",
          "Section": "Configuration Management (CM)",
          "SubSection": "Baseline Configuration (CM-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_2_b_1",
      "Name": "CM-2(b)(1)",
      "Description": "Review and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "cm_2_b_1",
          "Section": "Configuration Management (CM)",
          "SubSection": "Baseline Configuration (CM-2)",
          "SubGroup": "CM-2(b)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_2_b_2",
      "Name": "CM-2(b)(2)",
      "Description": "Review and update the baseline configuration of the system: 2. When required due to [Assignment: organization-defined circumstances].",
      "Attributes": [
        {
          "ItemId": "cm_2_b_2",
          "Section": "Configuration Management (CM)",
          "SubSection": "Baseline Configuration (CM-2)",
          "SubGroup": "CM-2(b)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_2_b_3",
      "Name": "CM-2(b)(3)",
      "Description": "Review and update the baseline configuration of the system: 3 When system components are installed or upgraded.",
      "Attributes": [
        {
          "ItemId": "cm_2_b_3",
          "Section": "Configuration Management (CM)",
          "SubSection": "Baseline Configuration (CM-2)",
          "SubGroup": "CM-2(b)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_2_2",
      "Name": "CM-2(2) Automation Support For Accuracy And Currency",
      "Description": "Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "cm_2_2",
          "Section": "Configuration Management (CM)",
          "SubSection": "Baseline Configuration (CM-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "elbv2_deletion_protection",
        "ssm_managed_compliant_patching",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "cm_3_3",
      "Name": "CM-3(3) Automated Change Implementation",
      "Description": "Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "cm_3_3",
          "Section": "Configuration Management (CM)",
          "SubSection": "Configuration Change Control (CM-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_3_a",
      "Name": "CM-3(a)",
      "Description": "Determine and document the types of changes to the system that are configuration-controlled.",
      "Attributes": [
        {
          "ItemId": "cm_3_a",
          "Section": "Configuration Management (CM)",
          "SubSection": "Configuration Change Control (CM-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection"
      ]
    },
    {
      "Id": "cm_5_1_a",
      "Name": "CM-5(1)(a)",
      "Description": "Enforce access restrictions using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "cm_5_1_a",
          "Section": "Configuration Management (CM)",
          "SubSection": "Access Restrictions For Change (CM-5)",
          "SubGroup": "CM-5(1) Automated Access Enforcement And Audit Records",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_profile_attached",
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_root_hardware_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "cm_5_1_b",
      "Name": "CM-5(1)(b)",
      "Description": "Automatically generate audit records of the enforcement actions.",
      "Attributes": [
        {
          "ItemId": "cm_5_1_b",
          "Section": "Configuration Management (CM)",
          "SubSection": "Access Restrictions For Change (CM-5)",
          "SubGroup": "CM-5(1) Automated Access Enforcement And Audit Records",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "cm_6",
      "Name": "Configuration Settings (CM-6)",
      "Description": "The organization: (i) establishes mandatory configuration settings for information technology products employed within the information system; (ii) configures the security settings of information technology products to the most restrictive mode consistent with operational requirements; (iii) documents the configuration settings; and (iv) enforces the configuration settings in all components of the information system.",
      "Attributes": [
        {
          "ItemId": "cm_6",
          "Section": "Configuration Management (CM)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_6_a",
      "Name": "CM-6(a)",
      "Description": "Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations].",
      "Attributes": [
        {
          "ItemId": "cm_6_a",
          "Section": "Configuration Management (CM)",
          "SubSection": "Configuration Settings (CM-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_kms_encryption_enabled",
        "cloudtrail_log_file_validation_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "ec2_instance_profile_attached",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "kms_cmk_rotation_enabled",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_server_access_logging_enabled",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "ec2_securitygroup_default_restrict_traffic",
        "vpc_flow_logs_enabled",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "cm_7_b",
      "Name": "CM-7(b)",
      "Description": "Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].",
      "Attributes": [
        {
          "ItemId": "cm_7_b",
          "Section": "Configuration Management (CM)",
          "SubSection": "Least Functionality (CM-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "cm_8_1",
      "Name": "CM-8(1) Updates During Installation And Removals",
      "Description": "Update the inventory of system components as part of component installations, removals, and system updates.",
      "Attributes": [
        {
          "ItemId": "cm_8_1",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_2",
      "Name": "CM-8(2) Automated Maintenance",
      "Description": "Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "cm_8_2",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm"
      ]
    },
    {
      "Id": "cm_8_3_a",
      "Name": "CM-8(3)(a)",
      "Description": "Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "cm_8_3_a",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "SubGroup": "CM-8(3) Automated Unauthorized Component Detection",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "guardduty_is_enabled",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_6",
      "Name": "CM-8(6) Assessed Configurations And Approved Deviations",
      "Description": "Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.",
      "Attributes": [
        {
          "ItemId": "cm_8_6",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ec2_instance_older_than_specific_days",
        "elbv2_deletion_protection",
        "ssm_managed_compliant_patching",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "cm_8_a",
      "Name": "CM-8(a)",
      "Description": "Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability].",
      "Attributes": [
        {
          "ItemId": "cm_8_a",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_a_1",
      "Name": "CM-8(a)(1)",
      "Description": "Develop and document an inventory of system components that: 1. Accurately reflects the system.",
      "Attributes": [
        {
          "ItemId": "cm_8_a_1",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "SubGroup": "CM-8(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_a_2",
      "Name": "CM-8(a)(2)",
      "Description": "Develop and document an inventory of system components that: 2. Includes all components within the system.",
      "Attributes": [
        {
          "ItemId": "cm_8_a_2",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "SubGroup": "CM-8(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_a_3",
      "Name": "CM-8(a)(3)",
      "Description": "Develop and document an inventory of system components that: 3. Does not include duplicate accounting of components or components assigned to any other system.",
      "Attributes": [
        {
          "ItemId": "cm_8_a_3",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "SubGroup": "CM-8(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_a_4",
      "Name": "CM-8(a)(4)",
      "Description": "Develop and document an inventory of system components that: 4. Is at the level of granularity deemed necessary for tracking and reporting.",
      "Attributes": [
        {
          "ItemId": "cm_8_a_4",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "SubGroup": "CM-8(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_a_5",
      "Name": "CM-8(a)(5)",
      "Description": "Develop and document an inventory of system components that: 5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability].",
      "Attributes": [
        {
          "ItemId": "cm_8_a_5",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "SubGroup": "CM-8(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_8_b",
      "Name": "CM-8(b)",
      "Description": "Review and update the system component inventory [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "cm_8_b",
          "Section": "Configuration Management (CM)",
          "SubSection": "System Component Inventory (CM-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "cm_9_b",
      "Name": "CM-9(b)",
      "Description": "Develop, document, and implement a configuration management plan for the system that: b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items.",
      "Attributes": [
        {
          "ItemId": "cm_9_b",
          "Section": "Configuration Management (CM)",
          "SubSection": "Configuration Management Plan (CM-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_kms_encryption_enabled",
        "cloudtrail_log_file_validation_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "kms_cmk_rotation_enabled",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_server_access_logging_enabled",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "ec2_securitygroup_default_restrict_traffic",
        "vpc_flow_logs_enabled",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
      "Id": "cm_12_b",
      "Name": "CM-12(b)",
      "Description": "Identify and document the users who have access to the system and system components where the information is processed and stored.",
      "Attributes": [
        {
          "ItemId": "cm_12_b",
          "Section": "Configuration Management (CM)",
          "SubSection": "Information Location (CM-12)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "cp_1_a_1_b",
      "Name": "CP-1(a)(1)(b)",
      "Description": "a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] contingency planning policy that: (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.",
      "Attributes": [
        {
          "ItemId": "cp_1_a_1_b",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Policy And Procedures (CP-1)",
          "SubGroup": "CP-1(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_1_a_2",
      "Name": "CP-1(a)(2)",
      "Description": "a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls.",
      "Attributes": [
        {
          "ItemId": "cp_1_a_2",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Policy And Procedures (CP-1)",
          "SubGroup": "CP-1(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_1_2",
      "Name": "CP-1(2)",
      "Description": "Implement transaction recovery for systems that are transaction-based.",
      "Attributes": [
        {
          "ItemId": "cp_1_2",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Policy And Procedures (CP-1)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "rds_instance_backup_enabled",
        "dynamodb_tables_pitr_enabled",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_2_a",
      "Name": "CP-2(a)",
      "Description": "a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingency roles, responsibilities, assigned individuals with contact information; 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6. Addresses the sharing of contingency information; and 7. Is reviewed and approved by [Assignment: organization-defined personnel or roles]",
      "Attributes": [
        {
          "ItemId": "cp_2_a",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_2_a_6",
      "Name": "CP-2(a)(6)",
      "Description": "Develop a contingency plan for the system that: 6. Addresses the sharing of contingency information.",
      "Attributes": [
        {
          "ItemId": "cp_2_a_6",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "SubGroup": "CP-2(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_2_a_7",
      "Name": "CP-2(a)(7)",
      "Description": "Develop a contingency plan for the system that: 7. Is reviewed and approved by [Assignment: organization-defined personnel or roles].",
      "Attributes": [
        {
          "ItemId": "cp_2_a_7",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "SubGroup": "CP-2(a)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_2_d",
      "Name": "CP-2(d)",
      "Description": "Review the contingency plan for the system [Assignment: organization-defined frequency]",
      "Attributes": [
        {
          "ItemId": "cp_2_d",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_2_e",
      "Name": "CP-2(e)",
      "Description": "Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing.",
      "Attributes": [
        {
          "ItemId": "cp_2_e",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_2_5",
      "Name": "CP-2(5) Continue Mission And Business Functions",
      "Description": "Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites.",
      "Attributes": [
        {
          "ItemId": "cp_2_5",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "elbv2_deletion_protection",
        "rds_instance_backup_enabled",
        "rds_instance_deletion_protection",
        "rds_instance_backup_enabled",
        "rds_instance_multi_az",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_2_6",
      "Name": "CP-2(6) Alternate Processing And Storage Sites",
      "Description": "Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites.",
      "Attributes": [
        {
          "ItemId": "cp_2_6",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Contingency Plan (CP-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "cp_6_a",
      "Name": "CP-6(a)",
      "Description": "Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information.",
      "Attributes": [
        {
          "ItemId": "cp_6_a",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Alternate Storage Sites (CP-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_6_1",
      "Name": "CP-6(1) Separation From Primary Site",
      "Description": "Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.",
      "Attributes": [
        {
          "ItemId": "cp_6_1",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Alternate Storage Sites (CP-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_6_2",
      "Name": "CP-6(2) Recovery Time And Recovery Point Objectives",
      "Description": "Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.",
      "Attributes": [
        {
          "ItemId": "cp_6_2",
          "Section": "Contingency Planning (CP)",
          "SubSection": "Alternate Storage Sites (CP-6)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_multi_az",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_9_a",
      "Name": "CP-9(a)",
      "Description": "Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].",
      "Attributes": [
        {
          "ItemId": "cp_9_a",
          "Section": "Contingency Planning (CP)",
          "SubSection": "System Backup (CP-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "redshift_cluster_automatic_upgrades",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_9_b",
      "Name": "CP-9(b)",
      "Description": "Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].",
      "Attributes": [
        {
          "ItemId": "cp_9_b",
          "Section": "Contingency Planning (CP)",
          "SubSection": "System Backup (CP-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "redshift_cluster_automatic_upgrades",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_9_c",
      "Name": "CP-9(c)",
      "Description": "Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].",
      "Attributes": [
        {
          "ItemId": "cp_9_c",
          "Section": "Contingency Planning (CP)",
          "SubSection": "System Backup (CP-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "rds_instance_backup_enabled",
        "dynamodb_tables_pitr_enabled",
        "redshift_cluster_automatic_upgrades",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_9_d",
      "Name": "CP-9(d)",
      "Description": "Protect the confidentiality, integrity, and availability of backup information.",
      "Attributes": [
        {
          "ItemId": "cp_9_d",
          "Section": "Contingency Planning (CP)",
          "SubSection": "System Backup (CP-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_kms_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "cp_9_8",
      "Name": "CP-9(8) Cryptographic Protection",
      "Description": "Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].",
      "Attributes": [
        {
          "ItemId": "cp_9_8",
          "Section": "Contingency Planning (CP)",
          "SubSection": "System Backup (CP-9)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "rds_instance_storage_encrypted",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption"
      ]
    },
    {
      "Id": "cp_10",
      "Name": "System Recovery And Reconstitution (CP-10)",
      "Description": "Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.",
      "Attributes": [
        {
          "ItemId": "cp_10",
          "Section": "Contingency Planning (CP)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_multi_az",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "cp_10_2",
      "Name": "CP-10(2) Transaction Recovery",
      "Description": "Implement transaction recovery for systems that are transaction-based.",
      "Attributes": [
        {
          "ItemId": "cp_10_2",
          "Section": "Contingency Planning (CP)",
          "SubSection": "System Recovery And Reconstitution (CP-10)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "ia_2",
      "Name": "Identification and Authentication (Organizational users) (IA-2)",
      "Description": "The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).",
      "Attributes": [
        {
          "ItemId": "ia_2",
          "Section": "Identification and Authentication (IA)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ia_2_1",
      "Name": "IA-2(1) Multi-Factor Authentication To Privileged Accounts",
      "Description": "Implement multi-factor authentication for access to privileged accounts.",
      "Attributes": [
        {
          "ItemId": "ia_2_1",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2_2",
      "Name": "IA-2(2) Multi-Factor Authentication To Non-Privileged Accounts",
      "Description": "Implement multi-factor authentication for access to non-privileged accounts.",
      "Attributes": [
        {
          "ItemId": "ia_2_2",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2_6",
      "Name": "IA-2(6) Acces To Accounts — Separate Device",
      "Description": "Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate from the system gaining access; and (b) The device meets [Assignment: organization-defined strength of mechanism requirements].",
      "Attributes": [
        {
          "ItemId": "ia_2_6",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2_6_a",
      "Name": "IA-2(6)(a)",
      "Description": "Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate from the system gaining access.",
      "Attributes": [
        {
          "ItemId": "ia_2_6_a",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "SubGroup": "IA-2(6) Acces To Accounts — Separate Device",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_2_8",
      "Name": "IA-2(8) Access To Accounts — Replay Resistant",
      "Description": "Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].",
      "Attributes": [
        {
          "ItemId": "ia_2_8",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification and Authentication (Organizational users) (IA-2)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
      "Id": "ia_3_3_b",
      "Name": "IA-3(3)(b)",
      "Description": "Audit lease information when assigned to a device.",
      "Attributes": [
        {
          "ItemId": "ia_3_3_b",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Device Identification And Authentication (IA-3)",
          "SubGroup": "IA-3(3) Dynamic Address Allocation",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "apigateway_restapi_logging_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "ia_4_b",
      "Name": "IA-4(b)",
      "Description": "Manage system identifiers by: b. Selecting an identifier that identifies an individual, group, role, service, or device.",
      "Attributes": [
        {
          "ItemId": "ia_4_b",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identifier Management (IA-4)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ia_4_d",
      "Name": "IA-4(d)",
      "Description": "Manage system identifiers by: d. Preventing reuse of identifiers for [Assignment: organization-defined time period].",
      "Attributes": [
        {
          "ItemId": "ia_4_d",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identifier Management (IA-4)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_4_4",
      "Name": "IA-4(4)",
      "Description": "Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status].",
      "Attributes": [
        {
          "ItemId": "ia_4_4",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identifier Management (IA-4)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ia_4_8",
      "Name": "IA-4(8)",
      "Description": "Generate pairwise pseudonymous identifiers.",
      "Attributes": [
        {
          "ItemId": "ia_4_8",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identifier Management (IA-4)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ia_5",
      "Name": "Authenticator Management (IA-5)",
      "Description": "Authenticate users and devices. Automate administrative control. Enforce restrictions. Protect against unauthorized use.",
      "Attributes": [
        {
          "ItemId": "ia_5",
          "Section": "Identification and Authentication (IA)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_b",
      "Name": "IA-5(b)",
      "Description": "Manage system authenticators by: b. Establishing initial authenticator content for any authenticators issued by the organization.",
      "Attributes": [
        {
          "ItemId": "ia_5_b",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_c",
      "Name": "IA-5(c)",
      "Description": "Manage system authenticators by: c. Ensuring that authenticators have sufficient strength of mechanism for their intended use.",
      "Attributes": [
        {
          "ItemId": "ia_5_c",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_d",
      "Name": "IA-5(d)",
      "Description": "Manage system authenticators by: d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators.",
      "Attributes": [
        {
          "ItemId": "ia_5_d",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_f",
      "Name": "IA-5(f)",
      "Description": "Manage system authenticators by: f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur.",
      "Attributes": [
        {
          "ItemId": "ia_5_f",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_h",
      "Name": "IA-5(h)",
      "Description": "Manage system authenticators by: h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators.",
      "Attributes": [
        {
          "ItemId": "ia_5_h",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_1_c",
      "Name": "IA-5(1)(c)",
      "Description": "For password-based authentication: (c) Transmit passwords only over cryptographically-protected channels.",
      "Attributes": [
        {
          "ItemId": "ia_5_1_c",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(1) Password-Based Authentication",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "ia_5_1_f",
      "Name": "IA-5(1)(f)",
      "Description": "For password-based authentication: (f) Allow user selection of long passwords and passphrases, including spaces and all printable characters.",
      "Attributes": [
        {
          "ItemId": "ia_5_1_f",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(1) Password-Based Authentication",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_1_g",
      "Name": "IA-5(1)(g)",
      "Description": "For password-based authentication: (g) Employ automated tools to assist the user in selecting strong password authenticators.",
      "Attributes": [
        {
          "ItemId": "ia_5_1_g",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(1) Password-Based Authentication",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_1_h",
      "Name": "IA-5(1)(h)",
      "Description": "For password-based authentication: (h) Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].",
      "Attributes": [
        {
          "ItemId": "ia_5_1_h",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(1) Password-Based Authentication",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_1_h",
      "Name": "IA-5(1)(h)",
      "Description": "For password-based authentication: (h) Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].",
      "Attributes": [
        {
          "ItemId": "ia_5_1_h",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(1) Password-Based Authentication",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_8",
      "Name": "IA-5(8) Multiple System Accounts",
      "Description": "Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.",
      "Attributes": [
        {
          "ItemId": "ia_5_8",
          "Section": "Identification and Authentication (IA)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_no_root_access_key"
      ]
    },
    {
      "Id": "ia_5_18_a",
      "Name": "IA-5(18)(a)",
      "Description": "Employ [Assignment: organization-defined password managers] to generate and manage passwords.",
      "Attributes": [
        {
          "ItemId": "ia_5_18_a",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(18) Password Managers",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_5_18_b",
      "Name": "IA-5(18)(b)",
      "Description": "Protect the passwords using [Assignment: organization-defined controls].",
      "Attributes": [
        {
          "ItemId": "ia_5_18_b",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Authenticator Management (IA-5)",
          "SubGroup": "IA-5(18) Password Managers",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ia_8_2_b",
      "Name": "IA-8(2)(b)",
      "Description": "Document and maintain a list of accepted external authenticators.",
      "Attributes": [
        {
          "ItemId": "ia_8_2_b",
          "Section": "Identification and Authentication (IA)",
          "SubSection": "Identification And Authentication (Non-Organizational Users) (IA-8)",
          "SubGroup": "IA-8(2) Acceptance Of External Authenticators",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ir_4_a",
      "Name": "IR-4(a)",
      "Description": "Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.",
      "Attributes": [
        {
          "ItemId": "ir_4_a",
          "Section": "Incident Response (IR)",
          "SubSection": "Incident Handling (IR-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_no_high_severity_findings"
      ]
    },
    {
      "Id": "ma_4_c",
      "Name": "MA-4(c)",
      "Description": "Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.",
      "Attributes": [
        {
          "ItemId": "ma_4_c",
          "Section": "Maintenance (MA)",
          "SubSection": "Nonlocal Maintenance (MA-4)",
          "Service": "iam"
        }
      ],
      "Checks": [
        "iam_password_policy_minimum_length_14"
      ]
    },
    {
      "Id": "ma_4_1_a",
      "Name": "MA-4(1)(a)",
      "Description": "Log [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions.",
      "Attributes": [
        {
          "ItemId": "ma_4_1_a",
          "Section": "Maintenance (MA)",
          "SubSection": "Nonlocal Maintenance (MA-4)",
          "SubGroup": "MA-4(1) Logging And Review",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "mp_2",
      "Name": "Media Access (MP-2)",
      "Description": "Restrict access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].",
      "Attributes": [
        {
          "ItemId": "mp_2",
          "Section": "Media Protection (MP)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "ec2_instance_imdsv2_enabled",
        "emr_cluster_master_nodes_no_public_ip",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "pe_6_2",
      "Name": "PE-6(2) Monitoring Physical Access",
      "Description": "Recognize [Assignment: organization-defined classes or types of intrusions] and initiate [Assignment: organization-defined response actions] using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "pe_6_2",
          "Section": "Physical And Environmental Protection (PE)",
          "SubSection": "Monitoring Physical Access (PE-6)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "pe_6_4",
      "Name": "PE-6(4) Monitoring Physical Access",
      "Description": "Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces containing one or more components of the system].",
      "Attributes": [
        {
          "ItemId": "pe_6_4",
          "Section": "Physical And Environmental Protection (PE)",
          "SubSection": "Monitoring Physical Access (PE-6)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "pm_11_b",
      "Name": "PM-11(b)",
      "Description": "Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes.",
      "Attributes": [
        {
          "ItemId": "pm_11_b",
          "Section": "Program Management (PM)",
          "SubSection": "Mission And Business Process Defination (PM-11)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "pm_14_a_1",
      "Name": "PM-14(a)(1)",
      "Description": "a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: 1. Are developed and maintained.",
      "Attributes": [
        {
          "ItemId": "pm_14_a_1",
          "Section": "Program Management (PM)",
          "SubSection": "Testing, Training, And Monitoring (PM-14)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "pm_14_b",
      "Name": "PM-14(b)",
      "Description": "Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.",
      "Attributes": [
        {
          "ItemId": "pm_14_b",
          "Section": "Program Management (PM)",
          "SubSection": "Testing, Training, And Monitoring (PM-14)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "pm_16",
      "Name": "Threat Awareness Program (PM-16)",
      "Description": "Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.",
      "Attributes": [
        {
          "ItemId": "pm_16",
          "Section": "Program Management (PM)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "pm_17_b",
      "Name": "PM-17(b)",
      "Description": "Review and update the policy and procedures [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "pm_17_b",
          "Section": "Program Management (PM)",
          "SubSection": "Protecting Controlled Unclassified Information On External Systems (PM-17)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "cloudtrail_log_file_validation_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "pm_21_b",
      "Name": "PM-21(b)",
      "Description": "Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.",
      "Attributes": [
        {
          "ItemId": "pm_21_b",
          "Section": "Program Management (PM)",
          "SubSection": "Accounting Of Disclosures (PM-21)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "pm_31",
      "Name": "Continuous Monitoring Strategy (PM-31)",
      "Description": "Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics]; b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "pm_31",
          "Section": "Program Management (PM)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "ra_1_a",
      "Name": "RA-1(a)",
      "Description": "Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls.",
      "Attributes": [
        {
          "ItemId": "ra_1_a",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Policy And Procedures (RA-1)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_1_a_1",
      "Name": "RA-1(a)(1)",
      "Description": "Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems.",
      "Attributes": [
        {
          "ItemId": "ra_1_a_1",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Policy And Procedures (RA-1)",
          "SubGroup": "RA-1(a)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_1_a_2",
      "Name": "RA-1(a)(2)",
      "Description": "a. Establish and maintain a cyber threat hunting capability to: 2. Detect, track, and disrupt threats that evade existing controls.",
      "Attributes": [
        {
          "ItemId": "ra_1_a_2",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Policy And Procedures (RA-1)",
          "SubGroup": "RA-1(a)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_3_4",
      "Name": "RA-3(4) Predictive Cyber Analytics",
      "Description": "Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities].",
      "Attributes": [
        {
          "ItemId": "ra_3_4",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Risk Assessment (RA-3)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_3_a_1",
      "Name": "RA-3(a)(1)",
      "Description": "a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system.",
      "Attributes": [
        {
          "ItemId": "ra_3_a_1",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Risk Assessment (RA-3)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "ra_5_a",
      "Name": "RA-5(a)",
      "Description": "Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported.",
      "Attributes": [
        {
          "ItemId": "ra_5_a",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Vulnerability Monitoring And Scanning (RA-5)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_5_4",
      "Name": "RA-5(4) Discoverable Information",
      "Description": "Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].",
      "Attributes": [
        {
          "ItemId": "ra_5_4",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Vulnerability Monitoring And Scanning (RA-5)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_10_a",
      "Name": "RA-10(a)",
      "Description": "Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existings.",
      "Attributes": [
        {
          "ItemId": "ra_10_a",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Threat Hunting (RA-10)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_10_a_1",
      "Name": "RA-10(a)(1)",
      "Description": "Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existings.",
      "Attributes": [
        {
          "ItemId": "ra_10_a_1",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Threat Hunting (RA-10)",
          "SubGroup": "RA-10(a)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "ra_10_a_2",
      "Name": "RA-10(a)(2)",
      "Description": "a. Establish and maintain a cyber threat hunting capability to: 2. Detect, track, and disrupt threats that evade existings.",
      "Attributes": [
        {
          "ItemId": "ra_10_a_2",
          "Section": "Risk Assessment (RA)",
          "SubSection": "Threat Hunting (RA-10)",
          "SubGroup": "RA-10(a)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "sa_1_1",
      "Name": "SA-1(1)",
      "Description": "Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.",
      "Attributes": [
        {
          "ItemId": "sa_1_1",
          "Section": "System and Services Acquisition (SA)",
          "SubSection": "Policy And Procedures (SA-1)",
          "Service": "cloudtrail"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "sa_9_6",
      "Name": "SA-9(6) Organization-Controlled Cryptographic Keys",
      "Description": "Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.",
      "Attributes": [
        {
          "ItemId": "sa_9_6",
          "Section": "System and Services Acquisition (SA)",
          "SubSection": "External System Services (SA-9)",
          "Service": "kms"
        }
      ],
      "Checks": [
        "kms_cmk_rotation_enabled"
      ]
    },
    {
      "Id": "sa_10_1",
      "Name": "SA-10(1) Software And Firmware Integrity Verification",
      "Description": "Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.",
      "Attributes": [
        {
          "ItemId": "sa_10_1",
          "Section": "System and Services Acquisition (SA)",
          "SubSection": "Developer Configuration Management (SA-10)",
          "Service": "kms"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "sa_15_a_4",
      "Name": "SA-15(a)(4)",
      "Description": "a. Require the developer of the system, system component, or system service to follow a documented development process that: 4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development.",
      "Attributes": [
        {
          "ItemId": "sa_15_a_4",
          "Section": "System and Services Acquisition (SA)",
          "SubSection": "Development Process, Standards, And Tools (SA-15)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection"
      ]
    },
    {
      "Id": "sc_5_1",
      "Name": "SC-5(1) Restrict Ability TO Attack Other Systems",
      "Description": "Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignment: organization-defined denial-of-service attacks].",
      "Attributes": [
        {
          "ItemId": "sc_5_1",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Denial Of Service Protection (SC-5)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "sc_5_2",
      "Name": "SC-5(2) Capacity, Bandwidth, And Redundancy",
      "Description": "Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.",
      "Attributes": [
        {
          "ItemId": "sc_5_2",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Denial Of Service Protection (SC-5)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "elbv2_deletion_protection",
        "rds_instance_backup_enabled",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "redshift_cluster_automatic_upgrades",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "sc_5_3_a",
      "Name": "SC-5(3)(a)",
      "Description": "Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [Assignment: organization-defined monitoring tools].",
      "Attributes": [
        {
          "ItemId": "sc_5_3_a",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Denial Of Service Protection (SC-5)",
          "SubGroup": "SC-5(3) Detection And Monitoring",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "sc_5_3_b",
      "Name": "SC-5(3)(b)",
      "Description": "Monitor the following system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks: [Assignment: organization-defined system resources].",
      "Attributes": [
        {
          "ItemId": "sc_5_3_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Denial Of Service Protection (SC-5)",
          "SubGroup": "SC-5(3) Detection And Monitoring",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "sc_5_a",
      "Name": "SC-5(a)",
      "Description": "[Selection: Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events].",
      "Attributes": [
        {
          "ItemId": "sc_5_a",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Denial Of Service Protection (SC-5)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "sc_5_b",
      "Name": "SC-5(b)",
      "Description": "Employ the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event].",
      "Attributes": [
        {
          "ItemId": "sc_5_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Denial Of Service Protection (SC-5)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "sc_6",
      "Name": "Resource Availability (SC-6)",
      "Description": "Protect the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more): priority; quota; [Assignment: organization-defined controls]].",
      "Attributes": [
        {
          "ItemId": "sc_6",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "sc_7_2",
      "Name": "SC-7(2) Public Access",
      "Description": "Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.",
      "Attributes": [
        {
          "ItemId": "sc_7_2",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "sc_7_3",
      "Name": "SC-7(3) Access Points",
      "Description": "Limit the number of external network connections to the system.",
      "Attributes": [
        {
          "ItemId": "sc_7_3",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "sc_7_4_b",
      "Name": "SC-7(4)(b)",
      "Description": "Establish a traffic flow policy for each managed interface.",
      "Attributes": [
        {
          "ItemId": "sc_7_4_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "SubGroup": "SC-7(4) External Telecommunications Services",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_7_4_g",
      "Name": "SC-7(4)(g)",
      "Description": "Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks.",
      "Attributes": [
        {
          "ItemId": "sc_7_4_g",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "SubGroup": "SC-7(4) External Telecommunications Services",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_7_5",
      "Name": "SC-7(5) Deny By Default — Allow By Exception",
      "Description": "Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].",
      "Attributes": [
        {
          "ItemId": "sc_7_5",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "s3_bucket_secure_transport_policy",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_7",
      "Name": "SC-7(7) Split Tunneling For Remote Devices",
      "Description": "Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].",
      "Attributes": [
        {
          "ItemId": "sc_7_7",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_9_a",
      "Name": "SC-7(9)(a)",
      "Description": "Detect and deny outgoing communications traffic posing a threat to external systems.",
      "Attributes": [
        {
          "ItemId": "sc_7_9_a",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "SubGroup": "SC-7(9) Restrict Threatening Outgoing Communications Traffic",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "sc_7_9_b",
      "Name": "SC-7(9)(b)",
      "Description": "Audit the identity of internal users associated with denied communications.",
      "Attributes": [
        {
          "ItemId": "sc_7_9_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "SubGroup": "SC-7(9) Restrict Threatening Outgoing Communications Traffic",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "sc_7_11",
      "Name": "SC-7(11) Restrict Incoming communications Traffic",
      "Description": "Only allow incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].",
      "Attributes": [
        {
          "ItemId": "sc_7_11",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_12",
      "Name": "SC-7(12) Host-Based Protection",
      "Description": "Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].",
      "Attributes": [
        {
          "ItemId": "sc_7_12",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "acm_certificates_expiration_check",
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_16",
      "Name": "SC-7(16) Prevent Discovery Of System Components",
      "Description": "Prevent the discovery of specific system components that represent a managed interface.",
      "Attributes": [
        {
          "ItemId": "sc_7_16",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "acm_certificates_expiration_check",
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_20",
      "Name": "SC-7(20) Prevent Discovery Of System Components",
      "Description": "Prevent the discovery of specific system components that represent a managed interface.",
      "Attributes": [
        {
          "ItemId": "sc_7_20",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "sc_7_21",
      "Name": "SC-7(21) Isolation Of System Components",
      "Description": "Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].",
      "Attributes": [
        {
          "ItemId": "sc_7_21",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_24_b",
      "Name": "SC-7(24)(b)",
      "Description": "For systems that process personally identifiable information: (b) Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system.",
      "Attributes": [
        {
          "ItemId": "sc_7_24_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "SubGroup": "SC-7(24) Personally Identifiable Information",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_25",
      "Name": "SC-7(25) Unclassified National Security System Connections",
      "Description": "Prohibit the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].",
      "Attributes": [
        {
          "ItemId": "sc_7_25",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
      "Id": "sc_7_26",
      "Name": "SC-7(26) Classified National Security System Connections",
      "Description": "Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device].",
      "Attributes": [
        {
          "ItemId": "sc_7_26",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
      "Id": "sc_7_27",
      "Name": "SC-7(27) Unclassified Non-National Security System Connections",
      "Description": "Prohibit the direct connection of [Assignment: organization-defined unclassified non-national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].",
      "Attributes": [
        {
          "ItemId": "sc_7_27",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
      "Id": "sc_7_28",
      "Name": "SC-7(28) Connections To Public Networks",
      "Description": "Prohibit the direct connection of [Assignment: organization-defined system] to a public network.",
      "Attributes": [
        {
          "ItemId": "sc_7_28",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
      "Id": "sc_7_a",
      "Name": "SC-7(a)",
      "Description": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system.",
      "Attributes": [
        {
          "ItemId": "sc_7_a",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_7_b",
      "Name": "SC-7(b)",
      "Description": "Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks.",
      "Attributes": [
        {
          "ItemId": "sc_7_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "sc_7_c",
      "Name": "SC-7(c)",
      "Description": "Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.",
      "Attributes": [
        {
          "ItemId": "sc_7_c",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Boundary Protection (SC-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
      ]
    },
    {
      "Id": "sc_8",
      "Name": "Transmission Confidentiality And Integrity (SC-8)",
      "Description": "Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.",
      "Attributes": [
        {
          "ItemId": "sc_8",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_8_1",
      "Name": "SC-8(1) Cryptographic Protection",
      "Description": "Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.",
      "Attributes": [
        {
          "ItemId": "sc_8_1",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Confidentiality And Integrity (SC-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elbv2_insecure_ssl_ciphers",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_8_2",
      "Name": "SC-8(2) Pre- And Post-Transmission Handling",
      "Description": "Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.",
      "Attributes": [
        {
          "ItemId": "sc_8_2",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Confidentiality And Integrity (SC-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_8_3",
      "Name": "SC-8(3) Cryptographic Protection For Message Externals",
      "Description": "Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].",
      "Attributes": [
        {
          "ItemId": "sc_8_3",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Confidentiality And Integrity (SC-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "cloudtrail_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "sc_8_4",
      "Name": "SC-8(4) Conceal Or Ramdomize Communications",
      "Description": "Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].",
      "Attributes": [
        {
          "ItemId": "sc_8_4",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Confidentiality And Integrity (SC-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "cloudtrail_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "sc_8_5",
      "Name": "SC-8(5) Protected Distribution System",
      "Description": "Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.",
      "Attributes": [
        {
          "ItemId": "sc_8_5",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Confidentiality And Integrity (SC-8)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_12",
      "Name": "Cryptographic Key Establishment And Management (SC-12)",
      "Description": "Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].",
      "Attributes": [
        {
          "ItemId": "sc_12",
          "Section": "System and Communications Protection (SC)",
          "Service": "kms"
        }
      ],
      "Checks": [
        "kms_cmk_rotation_enabled"
      ]
    },
    {
      "Id": "sc_12_2",
      "Name": "SC-12(2) Symmetric Keys",
      "Description": "Produce, control, and distribute symmetric cryptographic keys using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.",
      "Attributes": [
        {
          "ItemId": "sc_12_2",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Cryptographic Key Establishment And Management (SC-12)",
          "Service": "kms"
        }
      ],
      "Checks": [
        "kms_cmk_rotation_enabled"
      ]
    },
    {
      "Id": "sc_12_6",
      "Name": "SC-12(6) Physical Control Of Keys",
      "Description": "Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.",
      "Attributes": [
        {
          "ItemId": "sc_12_6",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Cryptographic Key Establishment And Management (SC-12)",
          "Service": "kms"
        }
      ],
      "Checks": [
        "kms_cmk_rotation_enabled"
      ]
    },
    {
      "Id": "sc_13_a",
      "Name": "SC-13(a)",
      "Description": "Determine the [Assignment: organization-defined cryptographic uses].",
      "Attributes": [
        {
          "ItemId": "sc_13_a",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Cryptographic Protection (SC-13)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "cloudtrail_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "sc_16_1",
      "Name": "SC-16(1) Integrity Verification",
      "Description": "Verify the integrity of transmitted security and privacy attributes.",
      "Attributes": [
        {
          "ItemId": "sc_16_1",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Transmission Of Security And Privacy Attributes (SC-16)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "sc_22",
      "Name": "Architecture And Provisioning For Name/Address Resolution Service (SC-22)",
      "Description": "Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.",
      "Attributes": [
        {
          "ItemId": "sc_22",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "elbv2_deletion_protection",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "sc_23",
      "Name": "Session Authenticity (SC-23)",
      "Description": "Protect the authenticity of communications sessions.",
      "Attributes": [
        {
          "ItemId": "sc_23",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy"
      ]
    },
    {
      "Id": "sc_23_3",
      "Name": "SC-23(3) Unique System-Generated Session Identifiers",
      "Description": "Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.",
      "Attributes": [
        {
          "ItemId": "sc_23_3",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Session Authenticity (SC-23)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_imdsv2_enabled",
        "iam_password_policy_minimum_length_14",
        "iam_policy_attached_only_to_group_or_roles",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "secretsmanager_automatic_rotation_enabled"
      ]
    },
    {
      "Id": "sc_23_5",
      "Name": "SC-23(5) Allowed Certificate Authorities",
      "Description": "Only allow the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.",
      "Attributes": [
        {
          "ItemId": "sc_23_5",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Session Authenticity (SC-23)",
          "Service": "elb"
        }
      ],
      "Checks": [
        "elbv2_insecure_ssl_ciphers",
        "elb_ssl_listeners"
      ]
    },
    {
      "Id": "sc_25",
      "Name": "Thin Nodes (SC-25)",
      "Description": "Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].",
      "Attributes": [
        {
          "ItemId": "sc_25",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_ebs_public_snapshot",
        "ec2_instance_public_ip",
        "emr_cluster_master_nodes_no_public_ip",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_attached_policy_no_administrative_privileges",
        "iam_inline_policy_no_administrative_privileges",
        "iam_no_root_access_key",
        "awslambda_function_not_publicly_accessible",
        "awslambda_function_url_public",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "redshift_cluster_public_access",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured"
      ]
    },
    {
      "Id": "sc_28_1",
      "Name": "SC-28(1) Cryptographic Protection",
      "Description": "Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignment: organization-defined information].",
      "Attributes": [
        {
          "ItemId": "sc_28_1",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Protection Of Information At Rest (SC-28)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption",
        "sagemaker_notebook_instance_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
      ]
    },
    {
      "Id": "sc_28_2",
      "Name": "SC-28(2) Offline Storage",
      "Description": "Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].",
      "Attributes": [
        {
          "ItemId": "sc_28_2",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Protection Of Information At Rest (SC-28)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "sc_36",
      "Name": "Distributed Processing And Storage (SC-36)",
      "Description": "Distribute the following processing and storage components across multiple [Selection: physical locations; logical domains]: [Assignment: organization-defined processing and storage components].",
      "Attributes": [
        {
          "ItemId": "sc_36",
          "Section": "System and Communications Protection (SC)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "rds_instance_multi_az"
      ]
    },
    {
      "Id": "sc_36_1_a",
      "Name": "SC-36(1)(a)",
      "Description": "Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: [Assignment: organization-defined distributed processing and storage components].",
      "Attributes": [
        {
          "ItemId": "sc_36_1_a",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Distributed Processing And Storage (SC-36)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "rds_instance_enhanced_monitoring_enabled"
      ]
    },
    {
      "Id": "sc_43_b",
      "Name": "SC-43(b)",
      "Description": "Authorize, monitor, and control the use of such components within the system.",
      "Attributes": [
        {
          "ItemId": "sc_43_b",
          "Section": "System and Communications Protection (SC)",
          "SubSection": "Usage Restrictions (SC-43)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_1_a_2",
      "Name": "SI-1(a)(2)",
      "Description": "a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;.",
      "Attributes": [
        {
          "ItemId": "si_1_a_2",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Policy And Procedures (SI-1)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_client_certificate_enabled",
        "cloudtrail_log_file_validation_enabled",
        "elb_ssl_listeners",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "s3_bucket_secure_transport_policy",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "si_1_1_c",
      "Name": "SI-1(1)(c)",
      "Description": "Audit the use of the manual override capability.",
      "Attributes": [
        {
          "ItemId": "si_1_1_c",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Policy And Procedures (SI-1)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "si_2_5",
      "Name": "SI-2(5) Automatic Software And Firmware Updated",
      "Description": "Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].",
      "Attributes": [
        {
          "ItemId": "si_2_5",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Flaw Remediation (SI-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_2_2",
      "Name": "SI-2(2) Automated Flaw Remediation Status",
      "Description": "Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].",
      "Attributes": [
        {
          "ItemId": "si_2_2",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Flaw Remediation (SI-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_2_a",
      "Name": "SI-2(a)",
      "Description": "Identify, report, and correct system flaws.",
      "Attributes": [
        {
          "ItemId": "si_2_a",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Flaw Remediation (SI-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "rds_instance_enhanced_monitoring_enabled"
      ]
    },
    {
      "Id": "si_2_c",
      "Name": "SI-2(c)",
      "Description": "Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates.",
      "Attributes": [
        {
          "ItemId": "si_2_c",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Flaw Remediation (SI-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_2_d",
      "Name": "SI-2(d)",
      "Description": "Incorporate flaw remediation into the organizational configuration management process.",
      "Attributes": [
        {
          "ItemId": "si_2_d",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Flaw Remediation (SI-2)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "redshift_cluster_automatic_upgrades",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_3_c_2",
      "Name": "SI-3(c)(2)",
      "Description": "c. Configure malicious code protection mechanisms to: 2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action]]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection.",
      "Attributes": [
        {
          "ItemId": "si_3_c_2",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Malicious Code Protection (SI-3)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
      ]
    },
    {
      "Id": "si_3_8_a",
      "Name": "SI-3(8)(a)",
      "Description": "Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: organization-defined system hardware components]: [Assignment: organization-defined unauthorized operating system commands].",
      "Attributes": [
        {
          "ItemId": "si_3_8_a",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Malicious Code Protection (SI-3)",
          "SubGroup": "SI-3(8) Detect Unauthorized Commands",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_3_8_b",
      "Name": "SI-3(8)(b)",
      "Description": "[Selection (one or more): issue a warning; audit the command execution; prevent the execution of the command].",
      "Attributes": [
        {
          "ItemId": "si_3_8_b",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Malicious Code Protection (SI-3)",
          "SubGroup": "SI-3(8) Detect Unauthorized Commands",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "si_4_a",
      "Name": "SI-4(a)",
      "Description": "Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and 2. Unauthorized local, network, and remote connections.",
      "Attributes": [
        {
          "ItemId": "si_4_a",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_a_1",
      "Name": "SI-4(a)(1)",
      "Description": "a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and 2. Unauthorized local, network, and remote connections.",
      "Attributes": [
        {
          "ItemId": "si_4_a_1",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "SubGroup": "SI-4(a)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_a_2",
      "Name": "SI-4(a)(2)",
      "Description": "a. Monitor the system to detect: 2. Unauthorized local, network, and remote connections.",
      "Attributes": [
        {
          "ItemId": "si_4_a_2",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "SubGroup": "SI-4(a)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_b",
      "Name": "SI-4(b)",
      "Description": "Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods].",
      "Attributes": [
        {
          "ItemId": "si_4_b",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_c",
      "Name": "SI-4(c)",
      "Description": "c. Invoke internal monitoring capabilities or deploy monitoring devices: 1. Strategically within the system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization.",
      "Attributes": [
        {
          "ItemId": "si_4_c",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_d",
      "Name": "SI-4(d)",
      "Description": "Analyze detected events and anomalies.",
      "Attributes": [
        {
          "ItemId": "si_4_d",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "cloudtrail"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "si_4_1",
      "Name": "SI-4(1) System-Wide Intrusion Detection System",
      "Description": "Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.",
      "Attributes": [
        {
          "ItemId": "si_4_1",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_2",
      "Name": "SI-4(2) Automated Tools For Real-Time Analysis",
      "Description": "Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring]. Employ automated tools and mechanisms to support near real-time analysis of events.",
      "Attributes": [
        {
          "ItemId": "si_4_2",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "guardduty_is_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "si_4_3",
      "Name": "SI-4(3) Automated Tools And Mechanism Integration",
      "Description": "Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.",
      "Attributes": [
        {
          "ItemId": "si_4_3",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_4_a",
      "Name": "SI-4(4)(a)",
      "Description": "Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic.",
      "Attributes": [
        {
          "ItemId": "si_4_4_a",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "SubGroup": "SI-4(4) Inbound and Outbound Communications Traffic",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_4_b",
      "Name": "SI-4(4)(b)",
      "Description": "Monitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions].",
      "Attributes": [
        {
          "ItemId": "si_4_4_b",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "SubGroup": "SI-4(4) Inbound and Outbound Communications Traffic",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_10",
      "Name": "SI-4(10) Visibility Of Encrypted Communications",
      "Description": "Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].",
      "Attributes": [
        {
          "ItemId": "si_4_10",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_12",
      "Name": "SI-4(12) Automated Organization-Generated Alerts",
      "Description": "Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].",
      "Attributes": [
        {
          "ItemId": "si_4_12",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured"
      ]
    },
    {
      "Id": "si_4_13_a",
      "Name": "SI-4(13)(a)",
      "Description": "Analyze communications traffic and event patterns for the system.",
      "Attributes": [
        {
          "ItemId": "si_4_13_a",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "SubGroup": "SI-4(13) Analyze Traffic And Event Patterns",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_14",
      "Name": "SI-4(14) Wireless Intrusion Detection",
      "Description": "Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.",
      "Attributes": [
        {
          "ItemId": "si_4_14",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_17",
      "Name": "SI-4(17) Integrated Situational Awareness",
      "Description": "Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.",
      "Attributes": [
        {
          "ItemId": "si_4_17",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "apigateway_restapi_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "si_4_20",
      "Name": "SI-4(20) Privileged Users",
      "Description": "Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].",
      "Attributes": [
        {
          "ItemId": "si_4_20",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "si_4_23",
      "Name": "SI-4(23) Host-Based Devices",
      "Description": "Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].",
      "Attributes": [
        {
          "ItemId": "si_4_23",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "guarduty"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_4_25",
      "Name": "SI-4(25) Optimize Network Traffic Analysis",
      "Description": "Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.",
      "Attributes": [
        {
          "ItemId": "si_4_25",
          "Section": "System and Information integrity (SI)",
          "SubSection": "System Monitoring (SI-4)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_5_1",
      "Name": "SI-5(1) Automated Alerts And Advisories",
      "Description": "Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].",
      "Attributes": [
        {
          "ItemId": "si_5_1",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Secuity Alerts, Advisories, And Directives (SI-5)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_5_b",
      "Name": "SI-5(b)",
      "Description": "Generate internal security alerts, advisories, and directives as deemed necessary.",
      "Attributes": [
        {
          "ItemId": "si_5_b",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Secuity Alerts, Advisories, And Directives (SI-5)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled"
      ]
    },
    {
      "Id": "si_7_1",
      "Name": "SI-7(1) Integrity Checks",
      "Description": "Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].",
      "Attributes": [
        {
          "ItemId": "si_7_1",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Software, Firmware, and Information Integrity (SI-7)",
          "Service": "cloudtrail"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "si_7_3",
      "Name": "SI-7(3) Centrally Managed Integrity Tools",
      "Description": "Employ centrally managed integrity verification tools.",
      "Attributes": [
        {
          "ItemId": "si_7_3",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Software, Firmware, and Information Integrity (SI-7)",
          "Service": "cloudtrail"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "si_7_7",
      "Name": "SI-7(7) Integration Of Detection And Response",
      "Description": "Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].",
      "Attributes": [
        {
          "ItemId": "si_7_7",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Software, Firmware, and Information Integrity (SI-7)",
          "Service": "cloudtrail"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "si_7_8",
      "Name": "SI-7(8) Auditing Capability For Significant Events",
      "Description": "Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].",
      "Attributes": [
        {
          "ItemId": "si_7_8",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Software, Firmware, and Information Integrity (SI-7)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "apigateway_restapi_logging_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "elbv2_logging_enabled",
        "elb_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "vpc_flow_logs_enabled"
      ]
    },
    {
      "Id": "si_7_a",
      "Name": "SI-7(a)",
      "Description": "Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information].",
      "Attributes": [
        {
          "ItemId": "si_7_a",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Software, Firmware, and Information Integrity (SI-7)",
          "Service": "cloudtrail"
        }
      ],
      "Checks": [
        "cloudtrail_log_file_validation_enabled"
      ]
    },
    {
      "Id": "si_10_1_c",
      "Name": "SI-10(1)(c)",
      "Description": "Audit the use of the manual override capability.",
      "Attributes": [
        {
          "ItemId": "si_10_1_c",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Information Input Validation (SI-10)",
          "SubGroup": "SI-10(1) Manual Override Capability",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_cloudwatch_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
      ]
    },
    {
      "Id": "si_12",
      "Name": "Information Management and Retention (SI-12)",
      "Description": "Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.",
      "Attributes": [
        {
          "ItemId": "si_12",
          "Section": "System and Information integrity (SI)",
          "Service": "cloudwatch"
        }
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ]
    },
    {
      "Id": "si_13_5",
      "Name": "SI-13(5) Failover Capability",
      "Description": "Provide [Selection: real-time; near real-time] [Assignment: organization-defined failover capability] for the system.",
      "Attributes": [
        {
          "ItemId": "si_13_5",
          "Section": "System and Information integrity (SI)",
          "SubSection": "Predictable Failure Prevention (SI-13)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_deletion_protection",
        "rds_instance_multi_az",
        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
    },
    {
      "Id": "si_19_4",
      "Name": "SI-19(4) Removal, Masking, Encryption, Hashing, Or Replacement Of Direct Identifiers",
      "Description": "Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.",
      "Attributes": [
        {
          "ItemId": "si_19_4",
          "Section": "System and Information integrity (SI)",
          "SubSection": "De-Identification (SI-19)",
          "Service": "aws"
        }
      ],
      "Checks": [
        "cloudtrail_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_default_encryption",
        "efs_encryption_at_rest_enabled",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "s3_bucket_default_encryption",
        "sagemaker_notebook_instance_encryption_enabled"
      ]
    }
  ]
}
