-
Notifications
You must be signed in to change notification settings - Fork 52
/
section_3.sp
151 lines (131 loc) · 7.58 KB
/
section_3.sp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
locals {
cis_v300_3_common_tags = merge(local.cis_v300_common_tags, {
cis_section_id = "3"
})
}
benchmark "cis_v300_3" {
title = "3 Logging"
documentation = file("./cis_v300/docs/cis_v300_3.md")
children = [
control.cis_v300_3_1,
control.cis_v300_3_2,
control.cis_v300_3_3,
control.cis_v300_3_4,
control.cis_v300_3_5,
control.cis_v300_3_6,
control.cis_v300_3_7,
control.cis_v300_3_8,
control.cis_v300_3_9
]
tags = merge(local.cis_v300_3_common_tags, {
type = "Benchmark"
})
}
control "cis_v300_3_1" {
title = "3.1 Ensure CloudTrail is enabled in all regions"
description = "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation)."
query = query.cloudtrail_multi_region_read_write_enabled
documentation = file("./cis_v300/docs/cis_v300_3_1.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.1"
cis_level = "1"
cis_type = "automated"
service = "AWS/CloudTrail"
})
}
control "cis_v300_3_2" {
title = "3.2 Ensure CloudTrail log file validation is enabled"
description = "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails."
query = query.cloudtrail_trail_validation_enabled
documentation = file("./cis_v300/docs/cis_v300_3_2.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.2"
cis_level = "2"
cis_type = "automated"
service = "AWS/CloudTrail"
})
}
control "cis_v300_3_3" {
title = "3.3 Ensure AWS Config is enabled in all regions"
description = "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions."
query = query.config_enabled_all_regions
documentation = file("./cis_v300/docs/cis_v300_3_3.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.3"
cis_level = "2"
cis_type = "automated"
service = "AWS/Config"
})
}
control "cis_v300_3_4" {
title = "3.4 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket"
description = "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket."
query = query.cloudtrail_s3_logging_enabled
documentation = file("./cis_v300/docs/cis_v300_3_4.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.4"
cis_level = "1"
cis_type = "automated"
service = "AWS/CloudTrail"
})
}
control "cis_v300_3_5" {
title = "3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs"
description = "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS."
query = query.cloudtrail_trail_logs_encrypted_with_kms_cmk
documentation = file("./cis_v300/docs/cis_v300_3_5.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.5"
cis_level = "2"
cis_type = "automated"
service = "AWS/CloudTrail"
})
}
control "cis_v300_3_6" {
title = "3.6 Ensure rotation for customer-created symmetric CMKs is enabled"
description = "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the customercreated customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK"
query = query.kms_cmk_rotation_enabled
documentation = file("./cis_v300/docs/cis_v300_3_6.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.6"
cis_level = "2"
cis_type = "automated"
service = "AWS/CloudTrail"
})
}
control "cis_v300_3_7" {
title = "3.7 Ensure VPC flow logging is enabled in all VPCs"
description = "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet `Rejects` for VPCs."
query = query.vpc_flow_logs_enabled
documentation = file("./cis_v300/docs/cis_v300_3_7.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.7"
cis_level = "2"
cis_type = "automated"
service = "AWS/VPC"
})
}
control "cis_v300_3_8" {
title = "3.8 Ensure that Object-level logging for write events is enabled for S3 bucket"
description = "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets."
query = query.cloudtrail_s3_object_write_events_audit_enabled
documentation = file("./cis_v300/docs/cis_v300_3_8.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.8"
cis_level = "2"
cis_type = "automated"
service = "AWS/S3"
})
}
control "cis_v300_3_9" {
title = "3.9 Ensure that Object-level logging for read events is enabled for S3 bucket"
description = "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets."
query = query.cloudtrail_s3_object_read_events_audit_enabled
documentation = file("./cis_v300/docs/cis_v300_3_9.md")
tags = merge(local.cis_v300_3_common_tags, {
cis_item_id = "3.9"
cis_level = "2"
cis_type = "automated"
service = "AWS/S3"
})
}