AWS securityhub: Add CRI Profile v2.2 to Security Hub controls standards mapping
Summary
Adds 'CRI Profile v2.2' to the 'Applicable standards' column for a large set of Security Hub security controls (Account, ACM, APIGateway, CloudTrail, CloudWatch, EC2, IAM, S3, RDS, and many more), updating the compliance framework mapping table. No control titles, severities, or remediation guidance changed.
Security assessment
The diff only appends 'CRI Profile v2.2' to the standards column of existing control rows; it is a compliance-framework mapping update rather than a fix for a specific vulnerability or incident. It is security-relevant documentation (mapping controls to a security framework) but introduces no new control, severity change, or remediation.
Evidence
+[Account.1](./account-controls.html#account-1) | Security contact information should be provided for an AWS account | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Periodic
Diff
diff --git a/securityhub/latest/userguide/securityhub-controls-reference.md b/securityhub/latest/userguide/securityhub-controls-reference.md index ba5b2a7..190b81d 100644 --- a//securityhub/latest/userguide/securityhub-controls-reference.md +++ b//securityhub/latest/userguide/securityhub-controls-reference.md @@ -36,4 +36,4 @@ Security control ID | Security control title | Applicable standards | Severity | -[Account.1](./account-controls.html#account-1) | Security contact information should be provided for an AWS account | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Periodic -[Account.2](./account-controls.html#account-2) | AWS account should be part of an AWS Organizations organization | NIST SP 800-53 Rev. 5 | HIGH | No | Periodic -[ACM.1](./acm-controls.html#acm-1) | Imported and ACM-issued certificates should be renewed after a specified time period | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v4.0.1 | MEDIUM | Yes | Change triggered and periodic -[ACM.2](./acm-controls.html#acm-2) | RSA certificates managed by ACM should use a key length of at least 2,048 bits | AWS Foundational Security Best Practices v1.0.0, PCI DSS v4.0.1 | HIGH | No | Change triggered +[Account.1](./account-controls.html#account-1) | Security contact information should be provided for an AWS account | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Periodic +[Account.2](./account-controls.html#account-2) | AWS account should be part of an AWS Organizations organization | NIST SP 800-53 Rev. 5, CRI Profile v2.2 | HIGH | No | Periodic +[ACM.1](./acm-controls.html#acm-1) | Imported and ACM-issued certificates should be renewed after a specified time period | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | Yes | Change triggered and periodic +[ACM.2](./acm-controls.html#acm-2) | RSA certificates managed by ACM should use a key length of at least 2,048 bits | AWS Foundational Security Best Practices v1.0.0, PCI DSS v4.0.1, CRI Profile v2.2 | HIGH | No | Change triggered @@ -42,8 +42,8 @@ Security control ID | Security control title | Applicable standards | Severity | -[Amplify.2](./amplify-controls.html#amplify-2) | Amplify branches should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered -[APIGateway.1](./apigateway-controls.html#apigateway-1) | API Gateway REST and WebSocket API execution logging should be enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | Yes | Change triggered -[APIGateway.2](./apigateway-controls.html#apigateway-2) | API Gateway REST API stages should be configured to use SSL certificates for backend authentication | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2 | MEDIUM | No | Change triggered -[APIGateway.3](./apigateway-controls.html#apigateway-3) | API Gateway REST API stages should have AWS X-Ray tracing enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | LOW | No | Change triggered -[APIGateway.4](./apigateway-controls.html#apigateway-4) | API Gateway should be associated with a WAF Web ACL | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered -[APIGateway.5](./apigateway-controls.html#apigateway-5) | API Gateway REST API cache data should be encrypted at rest | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered -[APIGateway.8](./apigateway-controls.html#apigateway-8) | API Gateway routes should specify an authorization type | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | Yes | Periodic -[APIGateway.9](./apigateway-controls.html#apigateway-9) | Access logging should be configured for API Gateway V2 Stages | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered +[Amplify.2](./amplify-controls.html#amplify-2) | Amplify branches should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered +[APIGateway.1](./apigateway-controls.html#apigateway-1) | API Gateway REST and WebSocket API execution logging should be enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | Yes | Change triggered +[APIGateway.2](./apigateway-controls.html#apigateway-2) | API Gateway REST API stages should be configured to use SSL certificates for backend authentication | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | MEDIUM | No | Change triggered +[APIGateway.3](./apigateway-controls.html#apigateway-3) | API Gateway REST API stages should have AWS X-Ray tracing enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | LOW | No | Change triggered +[APIGateway.4](./apigateway-controls.html#apigateway-4) | API Gateway should be associated with a WAF Web ACL | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Change triggered +[APIGateway.5](./apigateway-controls.html#apigateway-5) | API Gateway REST API cache data should be encrypted at rest | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Change triggered +[APIGateway.8](./apigateway-controls.html#apigateway-8) | API Gateway routes should specify an authorization type | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | Yes | Periodic +[APIGateway.9](./apigateway-controls.html#apigateway-9) | Access logging should be configured for API Gateway V2 Stages | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered @@ -56,2 +56,2 @@ Security control ID | Security control title | Applicable standards | Severity | -[AppFlow.1](./appflow-controls.html#appflow-1) | Amazon AppFlow flows should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered -[AppRunner.1](./apprunner-controls.html#apprunner-1) | App Runner services should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered +[AppFlow.1](./appflow-controls.html#appflow-1) | Amazon AppFlow flows should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered +[AppRunner.1](./apprunner-controls.html#apprunner-1) | App Runner services should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered @@ -59 +59 @@ Security control ID | Security control title | Applicable standards | Severity | -[AppSync.2](./appsync-controls.html#appsync-2) | AWS AppSync should have field-level logging enabled | AWS Foundational Security Best Practices v1.0.0, PCI DSS v4.0.1 | MEDIUM | Yes | Change triggered +[AppSync.2](./appsync-controls.html#appsync-2) | AWS AppSync should have field-level logging enabled | AWS Foundational Security Best Practices v1.0.0, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | Yes | Change triggered @@ -61 +61 @@ Security control ID | Security control title | Applicable standards | Severity | -[AppSync.5](./appsync-controls.html#appsync-5) | AWS AppSync GraphQL APIs should not be authenticated with API keys | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | HIGH | No | Change triggered +[AppSync.5](./appsync-controls.html#appsync-5) | AWS AppSync GraphQL APIs should not be authenticated with API keys | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | HIGH | No | Change triggered @@ -64,7 +64,7 @@ Security control ID | Security control title | Applicable standards | Severity | -[Athena.4](./athena-controls.html#athena-4) | Athena workgroups should have logging enabled | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered -[AutoScaling.1](./autoscaling-controls.html#autoscaling-1) | Auto Scaling groups associated with a load balancer should use ELB health checks | AWS Foundational Security Best Practices, PCI DSS v3.2.1, NIST SP 800-53 Rev. 5 | LOW | No | Change triggered -[AutoScaling.2](./autoscaling-controls.html#autoscaling-2) | Amazon EC2 Auto Scaling group should cover multiple Availability Zones | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | Yes | Change triggered -[AutoScaling.3](./autoscaling-controls.html#autoscaling-3) | Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2) | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | HIGH | No | Change triggered -[Autoscaling.5](./autoscaling-controls.html#autoscaling-5) | Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | HIGH | No | Change triggered -[AutoScaling.6](./autoscaling-controls.html#autoscaling-6) | Auto Scaling groups should use multiple instance types in multiple Availability Zones | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered -[AutoScaling.9](./autoscaling-controls.html#autoscaling-9) | EC2 Auto Scaling groups should use EC2 launch templates | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered +[Athena.4](./athena-controls.html#athena-4) | Athena workgroups should have logging enabled | AWS Foundational Security Best Practices, CRI Profile v2.2 | MEDIUM | No | Change triggered +[AutoScaling.1](./autoscaling-controls.html#autoscaling-1) | Auto Scaling groups associated with a load balancer should use ELB health checks | AWS Foundational Security Best Practices, PCI DSS v3.2.1, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | LOW | No | Change triggered +[AutoScaling.2](./autoscaling-controls.html#autoscaling-2) | Amazon EC2 Auto Scaling group should cover multiple Availability Zones | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | Yes | Change triggered +[AutoScaling.3](./autoscaling-controls.html#autoscaling-3) | Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2) | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | HIGH | No | Change triggered +[Autoscaling.5](./autoscaling-controls.html#autoscaling-5) | Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | HIGH | No | Change triggered +[AutoScaling.6](./autoscaling-controls.html#autoscaling-6) | Auto Scaling groups should use multiple instance types in multiple Availability Zones | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Change triggered +[AutoScaling.9](./autoscaling-controls.html#autoscaling-9) | EC2 Auto Scaling groups should use EC2 launch templates | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Change triggered @@ -72 +72 @@ Security control ID | Security control title | Applicable standards | Severity | -[Backup.1](./backup-controls.html#backup-1) | AWS Backup recovery points should be encrypted at rest | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered +[Backup.1](./backup-controls.html#backup-1) | AWS Backup recovery points should be encrypted at rest | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Change triggered @@ -78 +78 @@ Security control ID | Security control title | Applicable standards | Severity | -[Batch.2](./batch-controls.html#batch-2) | Batch scheduling policies should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered +[Batch.2](./batch-controls.html#batch-2) | Batch scheduling policies should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered @@ -80 +80 @@ Security control ID | Security control title | Applicable standards | Severity | -[Batch.4](./batch-controls.html#batch-4) | Compute resources properties in managed Batch compute environments should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered +[Batch.4](./batch-controls.html#batch-4) | Compute resources properties in managed Batch compute environments should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered @@ -92,11 +92,11 @@ Security control ID | Security control title | Applicable standards | Severity | -[CloudFront.1](./cloudfront-controls.html#cloudfront-1) | CloudFront distributions should have a default root object configured | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | HIGH | No | Change triggered -[CloudFront.3](./cloudfront-controls.html#cloudfront-3) | CloudFront distributions should require encryption in transit | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[CloudFront.4](./cloudfront-controls.html#cloudfront-4) | CloudFront distributions should have origin failover configured | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | LOW | No | Change triggered -[CloudFront.5](./cloudfront-controls.html#cloudfront-5) | CloudFront distributions should have logging enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[CloudFront.6](./cloudfront-controls.html#cloudfront-6) | CloudFront distributions should have WAF enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[CloudFront.7](./cloudfront-controls.html#cloudfront-7) | CloudFront distributions should use custom SSL/TLS certificates | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2 | LOW | No | Change triggered -[CloudFront.8](./cloudfront-controls.html#cloudfront-8) | CloudFront distributions should use SNI to serve HTTPS requests | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | LOW | No | Change triggered -[CloudFront.9](./cloudfront-controls.html#cloudfront-9) | CloudFront distributions should encrypt traffic to custom origins | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[CloudFront.10](./cloudfront-controls.html#cloudfront-10) | CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[CloudFront.12](./cloudfront-controls.html#cloudfront-12) | CloudFront distributions should not point to non-existent S3 origins | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | HIGH | No | Periodic -[CloudFront.13](./cloudfront-controls.html#cloudfront-13) | CloudFront distributions should use origin access control | AWS Foundational Security Best Practices v1.0.0 | MEDIUM | No | Change triggered +[CloudFront.1](./cloudfront-controls.html#cloudfront-1) | CloudFront distributions should have a default root object configured | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | HIGH | No | Change triggered +[CloudFront.3](./cloudfront-controls.html#cloudfront-3) | CloudFront distributions should require encryption in transit | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CloudFront.4](./cloudfront-controls.html#cloudfront-4) | CloudFront distributions should have origin failover configured | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | LOW | No | Change triggered +[CloudFront.5](./cloudfront-controls.html#cloudfront-5) | CloudFront distributions should have logging enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CloudFront.6](./cloudfront-controls.html#cloudfront-6) | CloudFront distributions should have WAF enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CloudFront.7](./cloudfront-controls.html#cloudfront-7) | CloudFront distributions should use custom SSL/TLS certificates | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Change triggered +[CloudFront.8](./cloudfront-controls.html#cloudfront-8) | CloudFront distributions should use SNI to serve HTTPS requests | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | LOW | No | Change triggered +[CloudFront.9](./cloudfront-controls.html#cloudfront-9) | CloudFront distributions should encrypt traffic to custom origins | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CloudFront.10](./cloudfront-controls.html#cloudfront-10) | CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CloudFront.12](./cloudfront-controls.html#cloudfront-12) | CloudFront distributions should not point to non-existent S3 origins | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | HIGH | No | Periodic +[CloudFront.13](./cloudfront-controls.html#cloudfront-13) | CloudFront distributions should use origin access control | AWS Foundational Security Best Practices v1.0.0, CRI Profile v2.2 | MEDIUM | No | Change triggered @@ -104 +104 @@ Security control ID | Security control title | Applicable standards | Severity | -[CloudFront.15](./cloudfront-controls.html#cloudfront-15) | CloudFront distributions should use the recommended TLS security policy | AWS Foundational Security Best Practices v1.0.0 | MEDIUM | No | Change triggered +[CloudFront.15](./cloudfront-controls.html#cloudfront-15) | CloudFront distributions should use the recommended TLS security policy | AWS Foundational Security Best Practices v1.0.0, CRI Profile v2.2 | MEDIUM | No | Change triggered @@ -107,7 +107,7 @@ Security control ID | Security control title | Applicable standards | Severity | -[CloudTrail.1](./cloudtrail-controls.html#cloudtrail-1) | CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5 | HIGH | No | Periodic -[CloudTrail.2](./cloudtrail-controls.html#cloudtrail-2) | CloudTrail should have encryption at-rest enabled | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0 AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v3.2.1, PCI DSS v4.0.1 | MEDIUM | No | Periodic -[CloudTrail.3](./cloudtrail-controls.html#cloudtrail-3) | At least one CloudTrail trail should be enabled | NIST SP 800-171 Rev. 2, PCI DSS v4.0.1, PCI DSS v3.2.1 | HIGH | No | Periodic -[CloudTrail.4](./cloudtrail-controls.html#cloudtrail-4) | CloudTrail log file validation should be enabled | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v4.0.1, PCI DSS v3.2.1 | LOW | No | Periodic -[CloudTrail.5](./cloudtrail-controls.html#cloudtrail-5) | CloudTrail trails should be integrated with Amazon CloudWatch Logs | CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1 | MEDIUM | No | Periodic -[CloudTrail.6](./cloudtrail-controls.html#cloudtrail-6) | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible | CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0, PCI DSS v4.0.1 | CRITICAL | No | Change triggered and periodic -[CloudTrail.7](./cloudtrail-controls.html#cloudtrail-7) | Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v3.0.0, PCI DSS v4.0.1 | LOW | No | Periodic +[CloudTrail.1](./cloudtrail-controls.html#cloudtrail-1) | CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | HIGH | No | Periodic +[CloudTrail.2](./cloudtrail-controls.html#cloudtrail-2) | CloudTrail should have encryption at-rest enabled | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0 AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v3.2.1, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Periodic +[CloudTrail.3](./cloudtrail-controls.html#cloudtrail-3) | At least one CloudTrail trail should be enabled | NIST SP 800-171 Rev. 2, PCI DSS v4.0.1, PCI DSS v3.2.1, CRI Profile v2.2 | HIGH | No | Periodic +[CloudTrail.4](./cloudtrail-controls.html#cloudtrail-4) | CloudTrail log file validation should be enabled | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS v4.0.1, PCI DSS v3.2.1, CRI Profile v2.2 | LOW | No | Periodic +[CloudTrail.5](./cloudtrail-controls.html#cloudtrail-5) | CloudTrail trails should be integrated with Amazon CloudWatch Logs | CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0, AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Periodic +[CloudTrail.6](./cloudtrail-controls.html#cloudtrail-6) | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible | CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0, PCI DSS v4.0.1, CRI Profile v2.2 | CRITICAL | No | Change triggered and periodic +[CloudTrail.7](./cloudtrail-controls.html#cloudtrail-7) | Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.2.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v3.0.0, PCI DSS v4.0.1, CRI Profile v2.2 | LOW | No | Periodic @@ -116,17 +116,17 @@ Security control ID | Security control title | Applicable standards | Severity | -[CloudWatch.1](./cloudwatch-controls.html#cloudwatch-1) | A log metric filter and alarm should exist for usage of the "root" user | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, PCI DSS v3.2.1 | LOW | No | Periodic -[CloudWatch.2](./cloudwatch-controls.html#cloudwatch-2) | Ensure a log metric filter and alarm exist for unauthorized API calls | CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.3](./cloudwatch-controls.html#cloudwatch-3) | Ensure a log metric filter and alarm exist for Management Console sign-in without MFA | CIS AWS Foundations Benchmark v1.2.0 | LOW | No | Periodic -[CloudWatch.4](./cloudwatch-controls.html#cloudwatch-4) | Ensure a log metric filter and alarm exist for IAM policy changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.5](./cloudwatch-controls.html#cloudwatch-5) | Ensure a log metric filter and alarm exist for CloudTrail configuration changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.6](./cloudwatch-controls.html#cloudwatch-6) | Ensure a log metric filter and alarm exist for AWS Management Console authentication failures | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.7](./cloudwatch-controls.html#cloudwatch-7) | Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.8](./cloudwatch-controls.html#cloudwatch-8) | Ensure a log metric filter and alarm exist for S3 bucket policy changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.9](./cloudwatch-controls.html#cloudwatch-9) | Ensure a log metric filter and alarm exist for AWS Config configuration changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.10](./cloudwatch-controls.html#cloudwatch-10) | Ensure a log metric filter and alarm exist for security group changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.11](./cloudwatch-controls.html#cloudwatch-11) | Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.12](./cloudwatch-controls.html#cloudwatch-12) | Ensure a log metric filter and alarm exist for changes to network gateways | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.13](./cloudwatch-controls.html#cloudwatch-13) | Ensure a log metric filter and alarm exist for route table changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.14](./cloudwatch-controls.html#cloudwatch-14) | Ensure a log metric filter and alarm exist for VPC changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2 | LOW | No | Periodic -[CloudWatch.15](./cloudwatch-controls.html#cloudwatch-15) | CloudWatch alarms should have specified actions configured | NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2 | HIGH | Yes | Change triggered -[CloudWatch.16](./cloudwatch-controls.html#cloudwatch-16) | CloudWatch log groups should be retained for a specified time period | NIST SP 800-53 Rev. 5 | MEDIUM | Yes | Periodic -[CloudWatch.17](./cloudwatch-controls.html#cloudwatch-17) | CloudWatch alarm actions should be enabled | NIST SP 800-53 Rev. 5 | HIGH | No | Change triggered +[CloudWatch.1](./cloudwatch-controls.html#cloudwatch-1) | A log metric filter and alarm should exist for usage of the "root" user | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, PCI DSS v3.2.1, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.2](./cloudwatch-controls.html#cloudwatch-2) | Ensure a log metric filter and alarm exist for unauthorized API calls | CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.3](./cloudwatch-controls.html#cloudwatch-3) | Ensure a log metric filter and alarm exist for Management Console sign-in without MFA | CIS AWS Foundations Benchmark v1.2.0, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.4](./cloudwatch-controls.html#cloudwatch-4) | Ensure a log metric filter and alarm exist for IAM policy changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.5](./cloudwatch-controls.html#cloudwatch-5) | Ensure a log metric filter and alarm exist for CloudTrail configuration changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.6](./cloudwatch-controls.html#cloudwatch-6) | Ensure a log metric filter and alarm exist for AWS Management Console authentication failures | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.7](./cloudwatch-controls.html#cloudwatch-7) | Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.8](./cloudwatch-controls.html#cloudwatch-8) | Ensure a log metric filter and alarm exist for S3 bucket policy changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.9](./cloudwatch-controls.html#cloudwatch-9) | Ensure a log metric filter and alarm exist for AWS Config configuration changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.10](./cloudwatch-controls.html#cloudwatch-10) | Ensure a log metric filter and alarm exist for security group changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.11](./cloudwatch-controls.html#cloudwatch-11) | Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.12](./cloudwatch-controls.html#cloudwatch-12) | Ensure a log metric filter and alarm exist for changes to network gateways | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.13](./cloudwatch-controls.html#cloudwatch-13) | Ensure a log metric filter and alarm exist for route table changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.14](./cloudwatch-controls.html#cloudwatch-14) | Ensure a log metric filter and alarm exist for VPC changes | CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | LOW | No | Periodic +[CloudWatch.15](./cloudwatch-controls.html#cloudwatch-15) | CloudWatch alarms should have specified actions configured | NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, CRI Profile v2.2 | HIGH | Yes | Change triggered +[CloudWatch.16](./cloudwatch-controls.html#cloudwatch-16) | CloudWatch log groups should be retained for a specified time period | NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | Yes | Periodic +[CloudWatch.17](./cloudwatch-controls.html#cloudwatch-17) | CloudWatch alarm actions should be enabled | NIST SP 800-53 Rev. 5, CRI Profile v2.2 | HIGH | No | Change triggered @@ -134,7 +134,7 @@ Security control ID | Security control title | Applicable standards | Severity | -[CodeBuild.1](./codebuild-controls.html#codebuild-1) | CodeBuild Bitbucket source repository URLs should not contain sensitive credentials | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1 | CRITICAL | No | Change triggered -[CodeBuild.2](./codebuild-controls.html#codebuild-2) | CodeBuild project environment variables should not contain clear text credentials | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1 | CRITICAL | No | Change triggered -[CodeBuild.3](./codebuild-controls.html#codebuild-3) | CodeBuild S3 logs should be encrypted | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, | LOW | No | Change triggered -[CodeBuild.4](./codebuild-controls.html#codebuild-4) | CodeBuild project environments should have a logging configuration | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered -[CodeBuild.7](./codebuild-controls.html#codebuild-7) | CodeBuild report group exports should be encrypted at rest | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered -[CodeGuruProfiler.1](./codeguruprofiler-controls.html#codeguruprofiler-1) | CodeGuru Profiler profiling groups should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered -[CodeGuruReviewer.1](./codegurureviewer-controls.html#codegurureviewer-1) | CodeGuru Reviewer repository associations should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered +[CodeBuild.1](./codebuild-controls.html#codebuild-1) | CodeBuild Bitbucket source repository URLs should not contain sensitive credentials | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1, CRI Profile v2.2 | CRITICAL | No | Change triggered +[CodeBuild.2](./codebuild-controls.html#codebuild-2) | CodeBuild project environment variables should not contain clear text credentials | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1, CRI Profile v2.2 | CRITICAL | No | Change triggered +[CodeBuild.3](./codebuild-controls.html#codebuild-3) | CodeBuild S3 logs should be encrypted | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | LOW | No | Change triggered +[CodeBuild.4](./codebuild-controls.html#codebuild-4) | CodeBuild project environments should have a logging configuration | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CodeBuild.7](./codebuild-controls.html#codebuild-7) | CodeBuild report group exports should be encrypted at rest | AWS Foundational Security Best Practices, CRI Profile v2.2 | MEDIUM | No | Change triggered +[CodeGuruProfiler.1](./codeguruprofiler-controls.html#codeguruprofiler-1) | CodeGuru Profiler profiling groups should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered +[CodeGuruReviewer.1](./codegurureviewer-controls.html#codegurureviewer-1) | CodeGuru Reviewer repository associations should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered @@ -142,2 +142,2 @@ Security control ID | Security control title | Applicable standards | Severity | -[Cognito.2](./cognito-controls.html#cognito-2) | Cognito identity pools should not allow unauthenticated identities | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered -[Cognito.3](./cognito-controls.html#cognito-3) | Password policies for Cognito user pools should have strong configurations | AWS Foundational Security Best Practices | MEDIUM | Yes | Change triggered +[Cognito.2](./cognito-controls.html#cognito-2) | Cognito identity pools should not allow unauthenticated identities | AWS Foundational Security Best Practices, CRI Profile v2.2 | MEDIUM | No | Change triggered +[Cognito.3](./cognito-controls.html#cognito-3) | Password policies for Cognito user pools should have strong configurations | AWS Foundational Security Best Practices, CRI Profile v2.2 | MEDIUM | Yes | Change triggered @@ -147 +147 @@ Security control ID | Security control title | Applicable standards | Severity | -[Config.1](./config-controls.html#config-1) | AWS Config should be enabled and use the service-linked role for resource recording | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1 | CRITICAL | Yes | Periodic +[Config.1](./config-controls.html#config-1) | AWS Config should be enabled and use the service-linked role for resource recording | CIS AWS Foundations Benchmark v5.0.0, CIS AWS Foundations Benchmark v3.0.0, CIS AWS Foundations Benchmark v1.4.0, CIS AWS Foundations Benchmark v1.2.0, AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, CRI Profile v2.2 | CRITICAL | Yes | Periodic @@ -149,4 +149,4 @@ Security control ID | Security control title | Applicable standards | Severity | -[Connect.2](./connect-controls.html#connect-2) | Connect Customer instances should have CloudWatch logging enabled | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered -[DataFirehose.1](./datafirehose-controls.html#datafirehose-1) | Firehose delivery streams should be encrypted at rest | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5 | MEDIUM | No | Periodic -[DataSync.1](./datasync-controls.html#datasync-1) | DataSync tasks should have logging enabled | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered -[DataSync.2](./datasync-controls.html#datasync-2) | DataSync tasks should be tagged | AWS Resource Tagging Standard | LOW | Yes | Change triggered +[Connect.2](./connect-controls.html#connect-2) | Connect Customer instances should have CloudWatch logging enabled | AWS Foundational Security Best Practices, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DataFirehose.1](./datafirehose-controls.html#datafirehose-1) | Firehose delivery streams should be encrypted at rest | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, CRI Profile v2.2 | MEDIUM | No | Periodic +[DataSync.1](./datasync-controls.html#datasync-1) | DataSync tasks should have logging enabled | AWS Foundational Security Best Practices, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DataSync.2](./datasync-controls.html#datasync-2) | DataSync tasks should be tagged | AWS Resource Tagging Standard, CRI Profile v2.2 | LOW | Yes | Change triggered @@ -154 +154 @@ Security control ID | Security control title | Applicable standards | Severity | -[DMS.1](./dms-controls.html#dms-1) | Database Migration Service replication instances should not be public | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1 | CRITICAL | No | Periodic +[DMS.1](./dms-controls.html#dms-1) | Database Migration Service replication instances should not be public | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v3.2.1, PCI DSS v4.0.1, CRI Profile v2.2 | CRITICAL | No | Periodic @@ -159,7 +159,7 @@ Security control ID | Security control title | Applicable standards | Severity | -[DMS.6](./dms-controls.html#dms-6) | DMS replication instances should have automatic minor version upgrade enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DMS.7](./dms-controls.html#dms-7) | DMS replication tasks for the target database should have logging enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DMS.8](./dms-controls.html#dms-8) | DMS replication tasks for the source database should have logging enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DMS.9](./dms-controls.html#dms-9) | DMS endpoints should use SSL | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DMS.10](./dms-controls.html#dms-10) | DMS endpoints for Neptune databases should have IAM authorization enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DMS.11](./dms-controls.html#dms-11) | DMS endpoints for MongoDB should have an authentication mechanism enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DMS.12](./dms-controls.html#dms-12) | DMS endpoints for Redis OSS should have TLS enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered +[DMS.6](./dms-controls.html#dms-6) | DMS replication instances should have automatic minor version upgrade enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DMS.7](./dms-controls.html#dms-7) | DMS replication tasks for the target database should have logging enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DMS.8](./dms-controls.html#dms-8) | DMS replication tasks for the source database should have logging enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DMS.9](./dms-controls.html#dms-9) | DMS endpoints should use SSL | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DMS.10](./dms-controls.html#dms-10) | DMS endpoints for Neptune databases should have IAM authorization enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DMS.11](./dms-controls.html#dms-11) | DMS endpoints for MongoDB should have an authentication mechanism enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered +[DMS.12](./dms-controls.html#dms-12) | DMS endpoints for Redis OSS should have TLS enabled | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, CRI Profile v2.2 | MEDIUM | No | Change triggered @@ -167,10 +167,10 @@ Security control ID | Security control title | Applicable standards | Severity | -[DocumentDB.1](./documentdb-controls.html#documentdb-1) | Amazon DocumentDB clusters should be encrypted at rest | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered -[DocumentDB.2](./documentdb-controls.html#documentdb-2) | Amazon DocumentDB clusters should have an adequate backup retention period | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | Yes | Change triggered -[DocumentDB.3](./documentdb-controls.html#documentdb-3) | Amazon DocumentDB manual cluster snapshots should not be public | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | CRITICAL | No | Change triggered -[DocumentDB.4](./documentdb-controls.html#documentdb-4) | Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs | AWS Foundational Security Best Practices, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1 | MEDIUM | No | Change triggered -[DocumentDB.5](./documentdb-controls.html#documentdb-5) | Amazon DocumentDB clusters should have deletion protection enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered -[DocumentDB.6](./documentdb-controls.html#documentdb-6) | Amazon DocumentDB clusters should be encrypted in transit | AWS Foundational Security Best Practices | MEDIUM | No | Periodic -[DynamoDB.1](./dynamodb-controls.html#dynamodb-1) | DynamoDB tables should automatically scale capacity with demand | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | Yes | Periodic -[DynamoDB.2](./dynamodb-controls.html#dynamodb-2) | DynamoDB tables should have point-in-time recovery enabled | AWS Foundational Security Best Practices v1.0.0, NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered