1.19.0 • Published 12 months ago

@cloudgraph/policy-pack-aws-pci-dss-3.2.1 v1.19.0

Weekly downloads
-
License
MPL-2.0
Repository
github
Last release
12 months ago

PCI Data Security Standard version 3.2.1

Policy Pack based on the PCI DSS version 3.2.1 benchmark provided by the Payment Card Industry Data Security Standard (PCI DSS)

First Steps

  1. Install Cloud Graph CLI.
  2. Set up the AWS Provider for CG with the cg init aws command.
  3. Add Policy Pack for AWS PCI DSS benchmark using cg policy add aws-pci-dss-3.2.1 command.
  4. Execute the ruleset using the scan command cg scan aws.
  5. Query the findings using the different options:

    5a. Querying findings by provider:

    query {
      queryawsFindings {
        PCIFindings {
          id
          resourceId
          result
        }
      }
    }

    5b. Querying findings by specific benchmark:

    query {
      queryawsPCIFindings {
        id
        resourceId
        result
      }
    }

    5c. Querying findings by resource:

    query {
      queryawsCodebuild {
        id
        arn
        accountId
        PCIFindings {
          id
          resourceId
          result
        }
      }
    }

Available Ruleset

RuleDescription
autoscaling-check-1Auto Scaling groups associated with a load balancer should use health checks
cloudfront-check-1Cloudfront distributions should be protected by WAFs
cloudtrail-check-1CloudTrail logs should be encrypted at rest using AWS KMS keys
cloudtrail-check-2CloudTrail should be enabled
cloudtrail-check-3CloudTrail log file validation should be enabled
cloudtrail-check-4CloudTrail trails should be integrated with CloudWatch Logs
cloudwatch-check-1A log metric filter and alarm should exist for usage of the "root" user
codebuild-check-1CodeBuild GitHub or Bitbucket source repository URLs should use OAuth
codebuild-check-2CodeBuild project environment variables should not contain clear text credentials
config-check-1AWS Config should be enabled
dms-check-1AWS Database Migration Service replication instances should not be public
ec2-check-1Amazon EBS snapshots should not be publicly restorable
ec2-check-2VPC default security group should prohibit inbound and outbound traffic
ec2-check-4Unused EC2 EIPs should be removed
ec2-check-5Security groups should not allow ingress from 0.0.0.0/0 to port 22
ec2-check-6VPC flow logging should be enabled in all VPCs
elasticsearch-check-1ElasticSearch domains should be in a VPC
elasticsearch-check-2Elasticsearch domains should have encryption at rest enabled
elbv2-check-1Application Load Balancer should be configured to redirect all HTTP requests to HTTPS
guardDuty-check-1GuardDuty should be enabled
iam-check-1IAM root user access key should not exist
iam-check-2IAM users should not have IAM policies attached
iam-check-3IAM policies should not allow full "*" administrative privileges
iam-check-4Hardware MFA should be enabled for the root user
iam-check-5Virtual MFA should be enabled for the root user
iam-check-6MFA should be enabled for all IAM users
iam-check-7IAM user credentials should be disabled if not used within a predefined number of days
iam-check-8Password policies for IAM users should have strong configurations
kms-check-1KMS key rotation should be enabled
lambda-check-1Lambda functions should prohibit public access
lambda-check-2Lambda functions should be in a VPC
rds-check-1RDS snapshots should prohibit public access
rds-check-2RDS DB Instances should prohibit public access
redshift-check-1Amazon Redshift clusters should prohibit public access
s3-check-1S3 buckets should prohibit public write access
s3-check-2S3 buckets should prohibit public read access
s3-check-3S3 buckets should have cross-region replication enabled enabled
s3-check-4S3 buckets should have server-side encryption enabled
s3-check-5S3 buckets should require requests to use Secure Socket Layer
s3-check-6S3 Block Public Access setting should be enabled
sageMaker-check-1Amazon SageMaker notebook instances should not have direct internet access
ssm-check-1Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation
ssm-check-2Instances managed by Systems Manager should have an association compliance status of COMPLIANT
ssm-check-3EC2 instances should be managed by AWS Systems Manager
1.19.1-alpha.2

12 months ago

1.19.1-alpha.1

12 months ago

1.19.0

1 year ago

1.18.1-alpha.1

1 year ago

1.16.3

2 years ago

1.18.0

2 years ago

1.17.1

2 years ago

1.16.2

2 years ago

1.17.0

2 years ago

1.16.1

2 years ago

1.16.1-beta.1

2 years ago

1.16.1-alpha.1

2 years ago

1.15.0

2 years ago

1.14.0

2 years ago

1.13.0

2 years ago

1.12.0

2 years ago

1.16.0

2 years ago

1.9.0

2 years ago

1.8.0

2 years ago

1.7.0

2 years ago

1.6.0

2 years ago

1.5.0

2 years ago

1.11.0

2 years ago

1.10.0

2 years ago

1.2.0

2 years ago

1.4.0

2 years ago

1.3.0

2 years ago

1.1.0

2 years ago

1.0.0

2 years ago