1.9.0 • Published 12 months ago

@cloudgraph/policy-pack-aws-nist-800-53-rev4 v1.9.0

Weekly downloads
-
License
MPL-2.0
Repository
github
Last release
12 months ago

NIST 800-53 Rev. 4 for Amazon Web Services

Policy Pack based on the 800-53 Rev. 4 benchmark provided by the The National Institute of Standards and Technology (NIST)

First Steps

  1. Install Cloud Graph CLI.
  2. Set up the AWS Provider for CG with the cg init aws command.
  3. Add Policy Pack NIST 800-53 Rev. 4 for Amazon Web Services benchmark using cg policy add aws-nist-800-53-rev4 command.
  4. Execute the ruleset using the scan command cg scan aws.
  5. Query the findings using the different options:

    5a. Querying findings by provider:

    query {
      queryawsFindings {
        NISTFindings {
          id
          resourceId
          result
        }
      }
    }

    5b. Querying findings by specific benchmark:

    query {
      queryawsNISTFindings {
        id
        resourceId
        result
      }
    }

    5c. Querying findings by resource:

    query {
      queryawsIamUser {
        id
        arn
        accountId
        NISTFindings {
          id
          resourceId
          result
        }
      }
    }

Available Ruleset

RuleDescription
AWS NIST 1.1IAM role trust policies should not allow all principals to assume the role
AWS NIST 1.2IAM roles attached to instance profiles should not allow broad list actions on S3 buckets
AWS NIST 1.3S3 bucket ACLs should not have public access on S3 buckets that store CloudTrail log files
AWS NIST 2.1Auto Scaling groups should span two or more availability zones
AWS NIST 2.2ELBv1 load balancer cross zone load balancing should be enabled
AWS NIST 2.3RDS Aurora cluster multi-AZ should be enabled
AWS NIST 2.4Require Multi Availability Zones turned on for RDS Instances
AWS NIST 2.5S3 bucket replication (cross-region or same-region) should be enabled
AWS NIST 3.1CloudTrail log files should be encrypted with customer managed KMS keys
AWS NIST 3.2CloudWatch log groups should be encrypted with customer managed KMS keys
AWS NIST 3.3DynamoDB tables should be encrypted with AWS or customer managed KMS keys
AWS NIST 3.4EBS volume encryption should be enabled
AWS NIST 3.5RDS instances should be encrypted
AWS NIST 3.6S3 bucket server-side encryption should be enabled
AWS NIST 3.7SQS queue server-side encryption should be enabled with KMS keys
AWS NIST 4.1CloudFront distribution origin should be set to S3 or origin protocol policy should be set to https-only
AWS NIST 4.2CloudFront viewer protocol policy should be set to https-only or redirect-to-https
AWS NIST 4.3ElastiCache transport encryption should be enabled
AWS NIST 4.4ELBv1 listener protocol should not be set to http
AWS NIST 4.5S3 bucket policies should only allow requests that use HTTPS
AWS NIST 4.6SNS subscriptions should deny access via HTTP
AWS NIST 6.1CloudFront access logging should be enabled
AWS NIST 6.2CloudTrail log file validation should be enabled
AWS NIST 6.3CloudTrail should be enabled in all regions
AWS NIST 6.4CloudTrail should have at least one CloudTrail trail set to a multi-region trail
AWS NIST 6.5CloudTrail trails should be configured to log data events for S3 buckets
AWS NIST 6.6CloudTrail trails should be configured to log management events
AWS NIST 6.7CloudTrail trails should have CloudWatch log integration enabled
AWS NIST 6.8Exactly one CloudTrail trail should monitor global services
AWS NIST 6.9Load balancer access logging should be enabled
AWS NIST 6.10S3 bucket access logging should be enabled
AWS NIST 6.11S3 bucket access logging should be enabled on S3 buckets that store CloudTrail log files
AWS NIST 6.12S3 bucket object-level logging for read events should be enabled
AWS NIST 6.13S3 bucket object-level logging for write events should be enabled
AWS NIST 6.14VPC flow logging should be enabled
AWS NIST 7.1Alarm for denied connections in CloudFront logs should be configured
AWS NIST 7.3CloudWatch log metric filter and alarm for AWS Organizations changes should be configured for the master account
AWS NIST 7.3CloudWatch log metric filter and alarm for changes to VPC NACLs should be configured
AWS NIST 7.4CloudWatch log metric filter and alarm for changes to VPC network gateways should be configured
AWS NIST 7.5CloudWatch log metric filter and alarm for CloudTrail configuration changes should be configured
AWS NIST 7.7CloudWatch log metric filter and alarm for IAM policy changes should be configured
AWS NIST 7.8CloudWatch log metric filter and alarm for Management Console authentication failures should be configured
AWS NIST 7.9CloudWatch log metric filter and alarm for Management Console sign-in without MFA should be configured
AWS NIST 7.10CloudWatch log metric filter and alarm for unauthorized API calls should be configured
AWS NIST 7.11CloudWatch log metric filter and alarm for usage of root account should be configured
AWS NIST 7.12CloudWatch log metric filter and alarm for VPC changes should be configured
AWS NIST 7.13CloudWatch log metric filter and alarm for VPC route table changes should be configured
AWS NIST 7.14CloudWatch log metric filter and alarm for VPC security group changes should be configured
AWS NIST 8.1ELB listener security groups should not be set to TCP all
AWS NIST 8.2VPC default security group should restrict all traffic
AWS NIST 8.3VPC network ACLs should not allow ingress from 0.0.0.0/0 to TCP/UDP port 22
AWS NIST 8.4AWS NIST 8.4 VPC network ACLs should not allow ingress from 0.0.0.0/0 to TCP/UDP port 3389
AWS NIST 8.5VPC security group inbound rules should not permit ingress from ‘0.0.0.0/0’ to all ports and protocols
AWS NIST 8.6VPC security group inbound rules should not permit ingress from a public address to all ports and protocols
AWS NIST 8.7VPC security group inbound rules should not permit ingress from any address to all ports and protocols
AWS NIST 8.8VPC security group rules should not permit ingress from ‘0.0.0.0/0’ except to ports 80 and 443
AWS NIST 8.9VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to port 3389 (Remote Desktop Protocol)
AWS NIST 8.10VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 61621 (Cassandra OpsCenter Agent)
AWS NIST 8.11VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 636 (LDAP SSL)
AWS NIST 8.12VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 7001 (Cassandra)
AWS NIST 8.13VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 11214 (Memcached SSL)
AWS NIST 8.14VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 11215 (Memcached SSL)
AWS NIST 8.15VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 135 (MSSQL Debugger)
AWS NIST 8.16VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 137 (NetBIOS Name Service)
AWS NIST 8.17VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 138 (NetBios Datagram Service)
AWS NIST 8.18VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 139 (NetBios Session Service)
AWS NIST 8.19VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 1433 (MSSQL Server)
AWS NIST 8.20VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 1434 (MSSQL Admin)
AWS NIST 8.21VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to port 22 (SSH)
AWS NIST 8.22VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 23 (Telnet)
AWS NIST 8.23VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 2379 (etcd)
AWS NIST 8.24VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 2382 (SQL Server Analysis Services browser)
AWS NIST 8.25VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 2383 (SQL Server Analysis Services)
AWS NIST 8.26VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 2484 (Oracle DB SSL)
AWS NIST 8.27VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27017 (MongoDB)
AWS NIST 8.28VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27018 (MongoDB)
AWS NIST 8.29VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27019 (MongoDB)
AWS NIST 8.30VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 3000 (Ruby on Rails web server)
AWS NIST 8.31VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 3020 (CIFS / SMB)
AWS NIST 8.32VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 3306 (MySQL)
AWS NIST 8.33VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 4505 (SaltStack Master)
AWS NIST 8.34VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 4506 (SaltStack Master)
AWS NIST 8.35VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 5432 (PostgreSQL)
AWS NIST 8.36VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 5500 (Virtual Network Computing)
AWS NIST 8.37VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 5800 (Virtual Network Computing), unless from ELBs
AWS NIST 8.38VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 5900 (Virtual Network Computing)
AWS NIST 8.39VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 80 (HTTP), unless from ELBs
AWS NIST 8.40VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP/UDP port 8000 (HTTP Alternate)
AWS NIST 8.41VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 9200 (Elasticsearch)
AWS NIST 8.42VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 9300 (Elasticsearch)
AWS NIST 8.43VPC security groups attached to EC2 instances should not permit ingress from ‘0.0.0.0/0’ to all ports
AWS NIST 8.44VPC security groups attached to EC2 instances should not permit ingress from ‘0.0.0.0/0’ to TCP port 389 (LDAP)
AWS NIST 8.45VPC security groups attached to RDS instances should not permit ingress from ‘0.0.0.0/0’ to all ports
1.9.1-alpha.1

12 months ago

1.9.1-alpha.2

12 months ago

1.9.0

1 year ago

1.8.1-alpha.1

1 year ago

1.8.0

2 years ago

1.7.1

2 years ago

1.7.0

2 years ago

1.6.1

2 years ago

1.6.0

2 years ago

1.4.0-alpha.1

2 years ago

1.4.0-beta.1

2 years ago

1.5.0

2 years ago

1.4.0

2 years ago

1.2.0

2 years ago

1.1.0

2 years ago

1.3.0

2 years ago

1.0.0

2 years ago