{"platform":{"name":"aws","release":"aws-sdk-v2.11.162"},"profiles":[{"name":"cis-aws-foundations-baseline","version":"1.0.0","sha256":"a7796269856facb553113c902dc561afc67e3cdaa985b2381223e05556b9b798","title":"cis-aws-foundations-baseline","maintainer":"MITRE InSpec Team","summary":"InSpec Profile to validate the CIS AWS Foundations Benchmark v1.1.0","license":"Apache-2.0","copyright":"MITRE, 2018","copyright_email":"inspec@mitre.org","supports":[{"platform":"aws"}],"attributes":[{"name":"default_aws_region","options":{"description":"default aws region","default":"us-east-1"}},{"name":"aws_regions","options":{"description":"all aws regions to be inspected","default":["us-east-1","us-east-2","us-west-1","us-west-2"]}},{"name":"aws_key_age","options":{"description":"The maximum allowed key age","type":"numeric","default":90}},{"name":"pwd_length","options":{"description":"Required password length","type":"numeric","default":14}},{"name":"aws_cred_age","options":{"description":"The maximum allowed IAM account age","type":"numeric","default":90}},{"name":"iam_manager_role_name","options":{"description":"iam manager role name","type":"string","default":"iam-manager-role-name"}},{"name":"iam_master_role_name","options":{"description":"iam master role name","type":"string","default":"iam-master-role-name"}},{"name":"iam_manager_user_name","options":{"description":"iam manager user name","type":"string","default":"iam-manager-user-name"}},{"name":"iam_master_user_name","options":{"description":"iam master user name","type":"string","default":"iam-master-user-name"}},{"name":"iam_manager_policy_name","options":{"description":"iam manager policy","type":"string","default":"iam-manager-policy"}},{"name":"iam_master_policy_name","options":{"description":"iam master policy","type":"string","default":"iam-master-policy"}},{"name":"exception_bucket_list","options":{"description":"list of buckets exempted from inspection","type":"array","default":["exception_bucket_name"]}},{"name":"config_delivery_channels","options":{"description":"Config service settings","type":"hash","default":{"us-east-1":{"s3_bucket_name":"s3_bucket_name_value","sns_topic_arn":"sns_topic_arn_value"},"us-east-2":{"s3_bucket_name":"s3_bucket_name_value","sns_topic_arn":"sns_topic_arn_value"},"us-west-1":{"s3_bucket_name":"s3_bucket_name_value","sns_topic_arn":"sns_topic_arn_value"},"us-west-2":{"s3_bucket_name":"s3_bucket_name_value","sns_topic_arn":"sns_topic_arn_value"}}}},{"name":"sns_topics","options":{"description":"SNS topics list and details","type":"hash","default":{"topic_arn1":{"owner":"owner_value","region":"region_value"},"topic_arn2":{"owner":"owner_value","region":"region_value"}}}},{"name":"sns_subscriptions","options":{"description":"SNS subscription list and details","type":"hash","default":{"subscription_arn1":{"endpoint":"endpoint_value","owner":"owner_value","protocol":"protocol_value"},"subscription_arn2":{"endpoint":"endpoint_value","owner":"owner_value","protocol":"protocol_value"}}}},{"name":"exception_security_group_list","options":{"description":"list of security groups exempted from inspection","type":"array","default":["exception_security_group_name"]}}],"groups":[{"id":"controls/cis-aws-foundations-1.6.rb","controls":["cis-aws-foundations-1.6"]},{"id":"controls/cis-aws-foundations-2.1.rb","controls":["cis-aws-foundations-2.1"]},{"id":"controls/cis-aws-foundations-2.5.rb","controls":["cis-aws-foundations-2.5"]},{"id":"controls/cis-aws-foundations-1.2.rb","controls":["cis-aws-foundations-1.2"]},{"id":"controls/cis-aws-foundations-3.4.rb","controls":["cis-aws-foundations-3.4"]},{"id":"controls/cis-aws-foundations-2.4.rb","controls":["cis-aws-foundations-2.4"]},{"id":"controls/cis-aws-foundations-1.3.rb","controls":["cis-aws-foundations-1.3"]},{"id":"controls/cis-aws-foundations-3.5.rb","controls":["cis-aws-foundations-3.5"]},{"id":"controls/cis-aws-foundations-1.7.rb","controls":["cis-aws-foundations-1.7"]},{"id":"controls/cis-aws-foundations-3.1.rb","controls":["cis-aws-foundations-3.1"]},{"id":"controls/cis-aws-foundations-1.14.rb","controls":["cis-aws-foundations-1.14"]},{"id":"controls/cis-aws-foundations-4.5.rb","controls":["cis-aws-foundations-4.5"]},{"id":"controls/cis-aws-foundations-1.20.rb","controls":["cis-aws-foundations-1.20"]},{"id":"controls/cis-aws-foundations-3.10.rb","controls":["cis-aws-foundations-3.10"]},{"id":"controls/cis-aws-foundations-1.24.rb","controls":["cis-aws-foundations-1.24"]},{"id":"controls/cis-aws-foundations-1.10.rb","controls":["cis-aws-foundations-1.10"]},{"id":"controls/cis-aws-foundations-4.1.rb","controls":["cis-aws-foundations-4.1"]},{"id":"controls/cis-aws-foundations-1.8.rb","controls":["cis-aws-foundations-1.8"]},{"id":"controls/cis-aws-foundations-3.14.rb","controls":["cis-aws-foundations-3.14"]},{"id":"controls/cis-aws-foundations-1.11.rb","controls":["cis-aws-foundations-1.11"]},{"id":"controls/cis-aws-foundations-1.9.rb","controls":["cis-aws-foundations-1.9"]},{"id":"controls/cis-aws-foundations-3.15.rb","controls":["cis-aws-foundations-3.15"]},{"id":"controls/cis-aws-foundations-1.15.rb","controls":["cis-aws-foundations-1.15"]},{"id":"controls/cis-aws-foundations-4.4.rb","controls":["cis-aws-foundations-4.4"]},{"id":"controls/cis-aws-foundations-1.21.rb","controls":["cis-aws-foundations-1.21"]},{"id":"controls/cis-aws-foundations-3.11.rb","controls":["cis-aws-foundations-3.11"]},{"id":"controls/cis-aws-foundations-4.3.rb","controls":["cis-aws-foundations-4.3"]},{"id":"controls/cis-aws-foundations-1.12.rb","controls":["cis-aws-foundations-1.12"]},{"id":"controls/cis-aws-foundations-1.16.rb","controls":["cis-aws-foundations-1.16"]},{"id":"controls/cis-aws-foundations-1.22.rb","controls":["cis-aws-foundations-1.22"]},{"id":"controls/cis-aws-foundations-3.8.rb","controls":["cis-aws-foundations-3.8"]},{"id":"controls/cis-aws-foundations-3.12.rb","controls":["cis-aws-foundations-3.12"]},{"id":"controls/cis-aws-foundations-1.17.rb","controls":["cis-aws-foundations-1.17"]},{"id":"controls/cis-aws-foundations-1.23.rb","controls":["cis-aws-foundations-1.23"]},{"id":"controls/cis-aws-foundations-2.8.rb","controls":["cis-aws-foundations-2.8"]},{"id":"controls/cis-aws-foundations-3.9.rb","controls":["cis-aws-foundations-3.9"]},{"id":"controls/cis-aws-foundations-3.13.rb","controls":["cis-aws-foundations-3.13"]},{"id":"controls/cis-aws-foundations-4.2.rb","controls":["cis-aws-foundations-4.2"]},{"id":"controls/cis-aws-foundations-1.13.rb","controls":["cis-aws-foundations-1.13"]},{"id":"controls/cis-aws-foundations-2.7.rb","controls":["cis-aws-foundations-2.7"]},{"id":"controls/cis-aws-foundations-1.18.rb","controls":["cis-aws-foundations-1.18"]},{"id":"controls/cis-aws-foundations-3.6.rb","controls":["cis-aws-foundations-3.6"]},{"id":"controls/cis-aws-foundations-1.4.rb","controls":["cis-aws-foundations-1.4"]},{"id":"controls/cis-aws-foundations-2.3.rb","controls":["cis-aws-foundations-2.3"]},{"id":"controls/cis-aws-foundations-3.2.rb","controls":["cis-aws-foundations-3.2"]},{"id":"controls/cis-aws-foundations-1.5.rb","controls":["cis-aws-foundations-1.5"]},{"id":"controls/cis-aws-foundations-2.2.rb","controls":["cis-aws-foundations-2.2"]},{"id":"controls/cis-aws-foundations-3.3.rb","controls":["cis-aws-foundations-3.3"]},{"id":"controls/cis-aws-foundations-2.6.rb","controls":["cis-aws-foundations-2.6"]},{"id":"controls/cis-aws-foundations-1.1.rb","controls":["cis-aws-foundations-1.1"]},{"id":"controls/cis-aws-foundations-1.19.rb","controls":["cis-aws-foundations-1.19"]},{"id":"controls/cis-aws-foundations-3.7.rb","controls":["cis-aws-foundations-3.7"]}],"controls":[{"id":"cis-aws-foundations-1.6","title":"Ensure IAM password policy require at least one lowercase letter","desc":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one lowercase letter.","descriptions":[{"label":"default","data":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one lowercase letter."}],"impact":0.3,"refs":[],"tags":{"rationale":"Setting a password complexity policy increases account\nresiliency against brute force login attempts.","cis_impact":"","cis_rid":"1.6","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78904-0","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via the AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Requires at least one lowercase letter' is checked under 'Password\nPolicy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireLowercaseCharacters':\ntrue","fix":"Perform the following to set the password policy as prescribed:\n\n'Via the AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Requires at least one lowercase letter'\n* Click 'Apply password policy'\n\n'Via CLI\n\n' aws iam update-account-password-policy --require-lowercase-characters\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.6\" do\n  title \"Ensure IAM password policy require at least one lowercase letter\"\n  desc  \"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one lowercase letter.\"\n  impact 0.3\n  tag \"rationale\": \"Setting a password complexity policy increases account\nresiliency against brute force login attempts.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.6\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78904-0\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via the AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Requires at least one lowercase letter' is checked under 'Password\nPolicy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireLowercaseCharacters':\ntrue\"\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via the AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Requires at least one lowercase letter'\n* Click 'Apply password policy'\n\n'Via CLI\n\n' aws iam update-account-password-policy --require-lowercase-characters\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('require_lowercase_characters?') { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.6.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy require_lowercase_characters? should equal true","run_time":0.001611,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-2.1","title":"Ensure CloudTrail is enabled in all regions","desc":"AWS CloudTrail is a web service that records AWS API calls for your\naccount and delivers log files to you. The recorded information includes the\nidentity of the API caller, the time of the API call, the source IP address of\nthe API caller, the request parameters, and the response elements returned by\nthe AWS service. CloudTrail provides a history of AWS API calls for an account,\nincluding API calls made via the Management Console, SDKs, command line tools,\nand higher-level AWS services (such as CloudFormation).","descriptions":[{"label":"default","data":"AWS CloudTrail is a web service that records AWS API calls for your\naccount and delivers log files to you. The recorded information includes the\nidentity of the API caller, the time of the API call, the source IP address of\nthe API caller, the request parameters, and the response elements returned by\nthe AWS service. CloudTrail provides a history of AWS API calls for an account,\nincluding API calls made via the Management Console, SDKs, command line tools,\nand higher-level AWS services (such as CloudFormation)."}],"impact":0.3,"refs":[],"tags":{"rationale":"The AWS API call history produced by CloudTrail enables\nsecurity analysis, resource change tracking, and compliance auditing.\nAdditionally, ensuring that a multi-regions trail exists will ensure that\nunexpected activity occurring in otherwise unused regions is detected.","cis_impact":"S3 lifecycle features can be used to manage the\naccumulation and management of logs over time. See the following AWS resource\nfor more information on these features:\n\n* http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html","cis_rid":"2.1","cis_level":1,"csc_control":[["14.6"],"6.0"],"nist":["AU-2","Rev_4"],"cce_id":"CCE-78913-1","check":"Perform the following to determine if CloudTrail is enabled for\nall regions:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n\n* Click on Trails_ _on the left navigation pane\n\n* You will be presented with a list of trails across all regions\n\n\n* Ensure at least one Trail has All specified in the Region column\n* Click on a trail via the link in the _Name_ column\n* Ensure Logging is set to ON\n\n* Ensure Apply trail to all regions is set to Yes\n\n'Via CLI\n\n' aws cloudtrail describe-trails\n\n'Ensure IsMultiRegionTrail is set to true","fix":"Perform the following to enable global CloudTrail logging:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* Click on _Trails_ on the left navigation pane\n\n* Click Get Started Now, if presented\n\n* Click Add new trail\n* Enter a trail name in the Trail name box\n* Set the Apply trail to all regions option to Yes\n* Specify an S3 bucket name in the S3 bucket box\n* Click Create\n\n\n* If 1 or more trails already exist, select the target trail to enable for\nglobal logging\n\n* Click the edit icon (pencil) next to Apply trail to all regions\n* Click Yes\n* Click Save\n`\n'Via CLI\n\n'aws cloudtrail create-trail --name _<trail_name>_ --bucket-name\n_<s3_bucket_for_cloudtrail>_ --is-multi-region-trail\naws cloudtrail update-trail --name _<trail_name>_ --is-multi-region-trail"},"code":"control \"cis-aws-foundations-2.1\" do\n  title \"Ensure CloudTrail is enabled in all regions\"\n  desc  \"AWS CloudTrail is a web service that records AWS API calls for your\naccount and delivers log files to you. The recorded information includes the\nidentity of the API caller, the time of the API call, the source IP address of\nthe API caller, the request parameters, and the response elements returned by\nthe AWS service. CloudTrail provides a history of AWS API calls for an account,\nincluding API calls made via the Management Console, SDKs, command line tools,\nand higher-level AWS services (such as CloudFormation).\"\n  impact 0.3\n  tag \"rationale\": \"The AWS API call history produced by CloudTrail enables\nsecurity analysis, resource change tracking, and compliance auditing.\nAdditionally, ensuring that a multi-regions trail exists will ensure that\nunexpected activity occurring in otherwise unused regions is detected.\"\n  tag \"cis_impact\": \"S3 lifecycle features can be used to manage the\naccumulation and management of logs over time. See the following AWS resource\nfor more information on these features:\n\n* http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html\"\n  tag \"cis_rid\": \"2.1\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"14.6\"], \"6.0\"]\n  tag \"nist\": [\"AU-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78913-1\"\n  tag \"check\": \"Perform the following to determine if CloudTrail is enabled for\nall regions:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n\n* Click on Trails_ _on the left navigation pane\n\n* You will be presented with a list of trails across all regions\n\n\n* Ensure at least one Trail has All specified in the Region column\n* Click on a trail via the link in the _Name_ column\n* Ensure Logging is set to ON\n\n* Ensure Apply trail to all regions is set to Yes\n\n'Via CLI\n\n' aws cloudtrail describe-trails\n\n'Ensure IsMultiRegionTrail is set to true\"\n  tag \"fix\": \"Perform the following to enable global CloudTrail logging:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* Click on _Trails_ on the left navigation pane\n\n* Click Get Started Now, if presented\n\n* Click Add new trail\n* Enter a trail name in the Trail name box\n* Set the Apply trail to all regions option to Yes\n* Specify an S3 bucket name in the S3 bucket box\n* Click Create\n\n\n* If 1 or more trails already exist, select the target trail to enable for\nglobal logging\n\n* Click the edit icon (pencil) next to Apply trail to all regions\n* Click Yes\n* Click Save\n`\n'Via CLI\n\n'aws cloudtrail create-trail --name _<trail_name>_ --bucket-name\n_<s3_bucket_for_cloudtrail>_ --is-multi-region-trail\naws cloudtrail update-trail --name _<trail_name>_ --is-multi-region-trail\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  aws_cloudtrail_trails.trail_arns.each do |trail|\n    describe aws_cloudtrail_trail(trail) do\n      it { should be_multi_region_trail }\n      its('status.is_logging') { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-2.1.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000118,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"CloudTrail arn:aws:cloudtrail:us-east-1:484747447281:trail/cis-trail-01 should be multi region trail","run_time":0.000145,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"CloudTrail arn:aws:cloudtrail:us-east-1:484747447281:trail/cis-trail-01 status.is_logging should equal true","run_time":0.036876,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-2.5","title":"Ensure AWS Config is enabled in all regions","desc":"AWS Config is a web service that performs configuration management of\nsupported AWS resources within your account and delivers log files to you. The\nrecorded information includes the configuration item (AWS resource),\nrelationships between configuration items (AWS resources), any configuration\nchanges between resources. It is recommended to enable AWS Config be enabled in\nall regions.","descriptions":[{"label":"default","data":"AWS Config is a web service that performs configuration management of\nsupported AWS resources within your account and delivers log files to you. The\nrecorded information includes the configuration item (AWS resource),\nrelationships between configuration items (AWS resources), any configuration\nchanges between resources. It is recommended to enable AWS Config be enabled in\nall regions."}],"impact":0.3,"refs":[],"tags":{"rationale":"The AWS configuration item history captured by AWS Config\nenables security analysis, resource change tracking, and compliance auditing.","cis_impact":"","cis_rid":"2.5","cis_level":1,"csc_control":[["1.1","1.3","1.4","5.2","11.1","11.3","14.6"],"6.0"],"nist":["CM-8(3)","CM-8(2)","CM-8","AC-6(7)","CM-6(1)","CM-6(2)","AU-2","Rev_4"],"cce_id":"CCE-78917-2","check":"Process to evaluate AWS Config configuration per region\n\n'Via AWS Management Console\n\n 'Sign in to the AWS Management Console and open the AWS Config console at\nhttps://console.aws.amazon.com/config/ [https://console.aws.amazon.com/config/].\n* On the top right of the console select target Region.\n* If presented with Setup AWS Config - follow remediation procedure:\n\n 'On the Resource inventory page, Click on edit (the gear icon). The Set Up AWS\nConfig page appears.\n\n* Ensure 1 or both check-boxes under 'All Resources' is checked.\n\n* Include global resources related to IAM resources - which needs to be enabled\nin 1 region only\n\n\n* Ensure the correct S3 bucket has been defined.\n* Ensure the correct SNS topic has been defined.\n* Repeat steps 2 to 7 for each region.","fix":"Perform the following in the AWS Management Console:\n\n* Select the region you want to focus on in the top right of the console\n* Click Services\n* Click Config\n* Define which resources you want to record in the selected region\n* Choose to include global resources (IAM resources)\n* Specify an S3 bucket in the same account or in another managed AWS account\n* Create an SNS Topic from the same AWS account or another managed AWS account\n\n\n'API Call:\n\n'aws configservice start-configuration-recorder"},"code":"control \"cis-aws-foundations-2.5\" do\n  title \"Ensure AWS Config is enabled in all regions\"\n  desc  \"AWS Config is a web service that performs configuration management of\nsupported AWS resources within your account and delivers log files to you. The\nrecorded information includes the configuration item (AWS resource),\nrelationships between configuration items (AWS resources), any configuration\nchanges between resources. It is recommended to enable AWS Config be enabled in\nall regions.\"\n  impact 0.3\n  tag \"rationale\": \"The AWS configuration item history captured by AWS Config\nenables security analysis, resource change tracking, and compliance auditing.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"2.5\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"1.1\", \"1.3\", \"1.4\", \"5.2\", \"11.1\", \"11.3\", \"14.6\"], \"6.0\"]\n  tag \"nist\": [\"CM-8(3)\", \"CM-8(2)\", \"CM-8\", \"AC-6(7)\", \"CM-6(1)\", \"CM-6(2)\", \"AU-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78917-2\"\n  tag \"check\": \"Process to evaluate AWS Config configuration per region\n\n'Via AWS Management Console\n\n 'Sign in to the AWS Management Console and open the AWS Config console at\nhttps://console.aws.amazon.com/config/ [https://console.aws.amazon.com/config/].\n* On the top right of the console select target Region.\n* If presented with Setup AWS Config - follow remediation procedure:\n\n 'On the Resource inventory page, Click on edit (the gear icon). The Set Up AWS\nConfig page appears.\n\n* Ensure 1 or both check-boxes under 'All Resources' is checked.\n\n* Include global resources related to IAM resources - which needs to be enabled\nin 1 region only\n\n\n* Ensure the correct S3 bucket has been defined.\n* Ensure the correct SNS topic has been defined.\n* Repeat steps 2 to 7 for each region.\"\n  tag \"fix\": \"Perform the following in the AWS Management Console:\n\n* Select the region you want to focus on in the top right of the console\n* Click Services\n* Click Config\n* Define which resources you want to record in the selected region\n* Choose to include global resources (IAM resources)\n* Specify an S3 bucket in the same account or in another managed AWS account\n* Create an SNS Topic from the same AWS account or another managed AWS account\n\n\n'API Call:\n\n'aws configservice start-configuration-recorder\"\n\n\n  attribute('aws_regions').each do |region|\n    ENV['AWS_REGION'] = region\n\n    describe aws_config_recorder do\n      it { should exist }\n      it { should be_recording }\n      it { should be_all_supported }\n      it { should have_include_global_resource_types }\n    end\n\n    describe aws_config_delivery_channel do\n      it { should exist }\n      its('s3_bucket_name') { should cmp CONFIG_DELIVERY_CHANNELS[region]['s3_bucket_name'] } #verify with attributes\n      its('sns_topic_arn') { should cmp CONFIG_DELIVERY_CHANNELS[region]['sns_topic_arn'] } #verify with attributes\n    end\n  end\n\n  # reset to default region\n  ENV['AWS_REGION'] = attribute('default_aws_region')\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-2.5.rb"},"results":[{"status":"passed","code_desc":"Configuration_Recorder: default should exist","run_time":0.000136,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be recording","run_time":0.177381,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be all supported","run_time":0.000193,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should have include global resource types","run_time":0.004451,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default should exist","run_time":0.000151,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default s3_bucket_name should cmp == \"cis-config-delivery-bucket-20181119002059274600000002\"","run_time":0.000273,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default sns_topic_arn should cmp == \"arn:aws:sns:us-east-1:484747447281:cis-config-sns\"","run_time":0.000194,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should exist","run_time":9.5e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be recording","run_time":0.025263,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be all supported","run_time":0.00015,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should have include global resource types","run_time":0.00019,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default should exist","run_time":0.000125,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default s3_bucket_name should cmp == \"cis-config-delivery-bucket-20181119002059274600000002\"","run_time":0.000304,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default sns_topic_arn should cmp == \"arn:aws:sns:us-east-2:484747447281:cis-config-sns\"","run_time":0.000223,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should exist","run_time":8.6e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be recording","run_time":0.027546,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be all supported","run_time":0.000266,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should have include global resource types","run_time":0.000175,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default should exist","run_time":9.5e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default s3_bucket_name should cmp == \"cis-config-delivery-bucket-20181119002059274600000002\"","run_time":0.000234,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default sns_topic_arn should cmp == \"arn:aws:sns:us-west-1:484747447281:cis-config-sns\"","run_time":0.000201,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should exist","run_time":8.3e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be recording","run_time":0.025171,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should be all supported","run_time":0.000166,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Recorder: default should have include global resource types","run_time":0.0002,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default should exist","run_time":0.000132,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default s3_bucket_name should cmp == \"cis-config-delivery-bucket-20181119002059274600000002\"","run_time":0.000272,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Configuration_Delivery_Channel: default sns_topic_arn should cmp == \"arn:aws:sns:us-west-2:484747447281:cis-config-sns\"","run_time":0.000192,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-1.2","title":"Ensure multi-factor authentication (MFA) is enabled for all IAM users\nthat have a console password","desc":"Multi-Factor Authentication (MFA) adds an extra layer of protection on\ntop of a user name and password. With MFA enabled, when a user signs in to an\nAWS website, they will be prompted for their user name and password as well as\nfor an authentication code from their AWS MFA device. It is recommended that\nMFA be enabled for all accounts that have a console password.","descriptions":[{"label":"default","data":"Multi-Factor Authentication (MFA) adds an extra layer of protection on\ntop of a user name and password. With MFA enabled, when a user signs in to an\nAWS website, they will be prompted for their user name and password as well as\nfor an authentication code from their AWS MFA device. It is recommended that\nMFA be enabled for all accounts that have a console password."}],"impact":0.3,"refs":[],"tags":{"rationale":"Enabling MFA provides increased security for console access\nas it requires the authenticating principal to possess a device that emits a\ntime-sensitive key and have knowledge of a credential.","cis_impact":"","cis_rid":"1.2","cis_level":1,"csc_control":[["5.6","11.4","12.6","16.11"],"6.0"],"nist":["IA-2(1)","SC-23","Rev_4"],"cce_id":"CCE-78901-6","check":"Perform the following to determine if a MFA device is enabled\nfor all IAM users having a console password:\nVia Management Console\n\n\n 'Open the IAM console at https://console.aws.amazon.com/iam/\n[https://console.aws.amazon.com/iam/].\n\n 'In the left pane, select Users\n\n 'If the MFA Device or Password columns are not visible in the table, click the\ngear icon at the upper right corner of the table and ensure a checkmark is next\nto both, then click Close.\n\n 'Ensure each user having a checkmark in the Password column also has a value in\nthe MFA Device column.\n\n\nVia the CLI\n\n\n* Run the following command (OSX/Linux/UNIX) to generate a list of all IAM\nusers along with their password and MFA status:\n\n'aws iam generate-credential-report\n\n'aws iam get-credential-report --query 'Content' --output text | base64 -d |\ncut -d, -f1,4,8\n\n* The output of this command will produce a table similar to the following:\n\n'user,password_enabled,mfa_active\nelise,false,false\nbrandon,true,true\nrakesh,false,false\nhelene,false,false\nparas,true,true\nanitha,false,false\n* For any column having password_enabled set to true, ensure mfa_active is also\nset to true.\n\n\n","fix":"Perform the following to enable MFA:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, choose Users.\n\n 'In the User Name list, choose the name of the intended MFA user.\n\n 'Choose the Security Credentials tab, and then choose Manage MFA Device.\n\n 'In the Manage MFA Device wizard, choose A virtual MFA device, and then choose\nNext Step.\n\n'IAM generates and displays configuration information for the virtual MFA\ndevice, including a QR code graphic. The graphic is a representation of the\n'secret configuration key' that is available for manual entry on devices that\ndo not support QR codes.\n\n 'Open your virtual MFA application. (For a list of apps that you can use for\nhosting virtual MFA devices, see Virtual MFA Applications\n[http://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications].) If the\nvirtual MFA application supports multiple accounts (multiple virtual MFA\ndevices), choose the option to create a new account (a new virtual MFA device).\n\n 'Determine whether the MFA app supports QR codes, and then do one of the\nfollowing:<div class='itemizedlist'>\n\n 'Use the app to scan the QR code. For example, you might choose the camera icon\nor choose an option similar to Scan code, and then use the device's camera to\nscan the code.\n\n 'In the Manage MFA Device wizard, choose Show secret key for manual\nconfiguration, and then type the secret configuration key into your MFA\napplication.\n\n\n'When you are finished, the virtual MFA device starts generating one-time\npasswords.\n\n 'In the Manage MFA Device wizard, in the Authentication Code 1 box, type the\none-time password that currently appears in the virtual MFA device. Wait up to\n30 seconds for the device to generate a new one-time password. Then type the\nsecond one-time password into the Authentication Code 2 box. Choose Active\nVirtual MFA.\n\n\n'FORCED IAM USER SELF-SERVICE REMEDIATION\n\n'Amazon has published a pattern that forces users to self-service setup MFA\nbefore they have access to their complete permissions set. Until they complete\nthis step, they cannot access their full permissions. This pattern can be used\non new AWS accounts. It can also be used on existing accounts - it is\nrecommended users are given instructions and a grace period to accomplish MFA\nenrollment before active enforcement on existing AWS accounts.\n\n'How to Delegate Management of Multi-Factor Authentication to AWS IAM Users\n[http://blogs.aws.amazon.com/security/post/Tx2SJJYE082KBUK/How-to-Delegate-Management-of-Multi-Factor-Authentication-to-AWS-IAM-Users]"},"code":"control \"cis-aws-foundations-1.2\" do\n  title \"Ensure multi-factor authentication (MFA) is enabled for all IAM users\nthat have a console password\"\n  desc  \"Multi-Factor Authentication (MFA) adds an extra layer of protection on\ntop of a user name and password. With MFA enabled, when a user signs in to an\nAWS website, they will be prompted for their user name and password as well as\nfor an authentication code from their AWS MFA device. It is recommended that\nMFA be enabled for all accounts that have a console password.\"\n  impact 0.3\n  tag \"rationale\": \"Enabling MFA provides increased security for console access\nas it requires the authenticating principal to possess a device that emits a\ntime-sensitive key and have knowledge of a credential.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.2\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"5.6\", \"11.4\", \"12.6\", \"16.11\"], \"6.0\"]\n  tag \"nist\": [\"IA-2(1)\",\"SC-23\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78901-6\"\n  tag \"check\": \"Perform the following to determine if a MFA device is enabled\nfor all IAM users having a console password:\nVia Management Console\n\n\n 'Open the IAM console at https://console.aws.amazon.com/iam/\n[https://console.aws.amazon.com/iam/].\n\n 'In the left pane, select Users\n\n 'If the MFA Device or Password columns are not visible in the table, click the\ngear icon at the upper right corner of the table and ensure a checkmark is next\nto both, then click Close.\n\n 'Ensure each user having a checkmark in the Password column also has a value in\nthe MFA Device column.\n\n\nVia the CLI\n\n\n* Run the following command (OSX/Linux/UNIX) to generate a list of all IAM\nusers along with their password and MFA status:\n\n'aws iam generate-credential-report\n\n'aws iam get-credential-report --query 'Content' --output text | base64 -d |\ncut -d, -f1,4,8\n\n* The output of this command will produce a table similar to the following:\n\n'user,password_enabled,mfa_active\nelise,false,false\nbrandon,true,true\nrakesh,false,false\nhelene,false,false\nparas,true,true\nanitha,false,false\n* For any column having password_enabled set to true, ensure mfa_active is also\nset to true.\n\n\n\"\n  tag \"fix\": \"Perform the following to enable MFA:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, choose Users.\n\n 'In the User Name list, choose the name of the intended MFA user.\n\n 'Choose the Security Credentials tab, and then choose Manage MFA Device.\n\n 'In the Manage MFA Device wizard, choose A virtual MFA device, and then choose\nNext Step.\n\n'IAM generates and displays configuration information for the virtual MFA\ndevice, including a QR code graphic. The graphic is a representation of the\n'secret configuration key' that is available for manual entry on devices that\ndo not support QR codes.\n\n 'Open your virtual MFA application. (For a list of apps that you can use for\nhosting virtual MFA devices, see Virtual MFA Applications\n[http://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications].) If the\nvirtual MFA application supports multiple accounts (multiple virtual MFA\ndevices), choose the option to create a new account (a new virtual MFA device).\n\n 'Determine whether the MFA app supports QR codes, and then do one of the\nfollowing:<div class='itemizedlist'>\n\n 'Use the app to scan the QR code. For example, you might choose the camera icon\nor choose an option similar to Scan code, and then use the device's camera to\nscan the code.\n\n 'In the Manage MFA Device wizard, choose Show secret key for manual\nconfiguration, and then type the secret configuration key into your MFA\napplication.\n\n\n'When you are finished, the virtual MFA device starts generating one-time\npasswords.\n\n 'In the Manage MFA Device wizard, in the Authentication Code 1 box, type the\none-time password that currently appears in the virtual MFA device. Wait up to\n30 seconds for the device to generate a new one-time password. Then type the\nsecond one-time password into the Authentication Code 2 box. Choose Active\nVirtual MFA.\n\n\n'FORCED IAM USER SELF-SERVICE REMEDIATION\n\n'Amazon has published a pattern that forces users to self-service setup MFA\nbefore they have access to their complete permissions set. Until they complete\nthis step, they cannot access their full permissions. This pattern can be used\non new AWS accounts. It can also be used on existing accounts - it is\nrecommended users are given instructions and a grace period to accomplish MFA\nenrollment before active enforcement on existing AWS accounts.\n\n'How to Delegate Management of Multi-Factor Authentication to AWS IAM Users\n[http://blogs.aws.amazon.com/security/post/Tx2SJJYE082KBUK/How-to-Delegate-Management-of-Multi-Factor-Authentication-to-AWS-IAM-Users]\"\n\n  describe aws_iam_users.where(has_console_password?: true).where(has_mfa_enabled?: false) do\n    it { should_not exist }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.2.rb"},"results":[{"status":"passed","code_desc":"IAM Users with has_console_password? == true has_mfa_enabled? == false should not exist","run_time":0.00011,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-3.4","title":"Ensure a log metric filter and alarm exist for IAM policy changes","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished changes made to Identity and Access Management (IAM) policies.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished changes made to Identity and Access Management (IAM) policies."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring changes to IAM policies will help ensure\nauthentication and authorization controls remain intact.","cis_impact":"","cis_rid":"3.4","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79189-7","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern':\n'{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'\n5. Note the _<iam_changes_metric>_ value associated with the filterPattern\nfound in step 4.\n6. Get a list of CloudWatch alarms and filter on the _<iam_changes_metric>_\ncaptured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<iam_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for IAM Policy changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<iam_changes_metric>_ --metric-transformations\nmetricName=_<iam_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern\n'{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'\n\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<iam_changes_alarm>_\n--metric-name _<iam_changes_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.4\" do\n  title \"Ensure a log metric filter and alarm exist for IAM policy changes\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished changes made to Identity and Access Management (IAM) policies.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring changes to IAM policies will help ensure\nauthentication and authorization controls remain intact.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.4\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79189-7\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern':\n'{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'\n5. Note the _<iam_changes_metric>_ value associated with the filterPattern\nfound in step 4.\n6. Get a list of CloudWatch alarms and filter on the _<iam_changes_metric>_\ncaptured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<iam_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for IAM Policy changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<iam_changes_metric>_ --metric-transformations\nmetricName=_<iam_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern\n'{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'\n\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<iam_changes_alarm>_\n--metric-name _<iam_changes_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\"\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.4.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000151,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":9.4e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":8.0e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":0.0001,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":7.6e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":9.1e-05,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-2.4","title":"Ensure CloudTrail trails are integrated with CloudWatch Logs","desc":"AWS CloudTrail is a web service that records AWS API calls made in a\ngiven AWS account. The recorded information includes the identity of the API\ncaller, the time of the API call, the source IP address of the API caller, the\nrequest parameters, and the response elements returned by the AWS service.\nCloudTrail uses Amazon S3 for log file storage and delivery, so log files are\nstored durably. In addition to capturing CloudTrail logs within a specified S3\nbucket for long term analysis, realtime analysis can be performed by\nconfiguring CloudTrail to send logs to CloudWatch Logs. For a trail that is\nenabled in all regions in an account, CloudTrail sends log files from all those\nregions to a CloudWatch Logs log group. It is recommended that CloudTrail logs\nbe sent to CloudWatch Logs.\n\n'Note: The intent of this recommendation is to ensure AWS account activity is\nbeing captured, monitored, and appropriately alarmed on. CloudWatch Logs is a\nnative way to accomplish this using AWS services but does not preclude the use\nof an alternate solution.","descriptions":[{"label":"default","data":"AWS CloudTrail is a web service that records AWS API calls made in a\ngiven AWS account. The recorded information includes the identity of the API\ncaller, the time of the API call, the source IP address of the API caller, the\nrequest parameters, and the response elements returned by the AWS service.\nCloudTrail uses Amazon S3 for log file storage and delivery, so log files are\nstored durably. In addition to capturing CloudTrail logs within a specified S3\nbucket for long term analysis, realtime analysis can be performed by\nconfiguring CloudTrail to send logs to CloudWatch Logs. For a trail that is\nenabled in all regions in an account, CloudTrail sends log files from all those\nregions to a CloudWatch Logs log group. It is recommended that CloudTrail logs\nbe sent to CloudWatch Logs.\n\n'Note: The intent of this recommendation is to ensure AWS account activity is\nbeing captured, monitored, and appropriately alarmed on. CloudWatch Logs is a\nnative way to accomplish this using AWS services but does not preclude the use\nof an alternate solution."}],"impact":0.3,"refs":[],"tags":{"rationale":"Sending CloudTrail logs to CloudWatch Logs will facilitate\nreal-time and historic activity logging based on user, API, resource, and IP\naddress, and provides opportunity to establish alarms and notifications for\nanomalous or sensitivity account activity.","cis_impact":"Note: By default, CloudWatch Logs will store Logs\nindefinitely unless a specific retention period is defined for the log group.\nWhen choosing the number of days to retain, keep in mind the average days it\ntakes an organization to realize they have been breached is 210 days (at the\ntime of this writing). Since additional time is required to research a breach,\na minimum 365 day retention policy allows time for detection and research. You\nmay also wish to archive the logs to a cheaper storage service rather than\nsimply deleting them. See the following AWS resource to manage CloudWatch Logs\nretention periods:\n\n*\nhttp://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html","cis_rid":"2.4","cis_level":1,"csc_control":[["6.6","14.6"],"6.0"],"nist":["SI-4(2)","AU-2","Rev_4"],"cce_id":"CCE-78916-4","check":"Perform the following to ensure CloudTrail is configured as\nprescribed:\n\n'Via the AWS management Console\n\n* Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/\n[https://console.aws.amazon.com/cloudtrail/]\n* Under All Buckets, click on the target bucket you wish to evaluate\n* Click Properties on the top right of the console\n* Click Trails in the left menu\n* Ensure a CloudWatch Logs log group is configured and has a recent (~one day\nold) Last log file delivered timestamp.\n\n'Via CLI\n\n* Run the following command to get a listing of existing trails:\n\n'aws cloudtrail describe-trails\n* Ensure CloudWatchLogsLogGroupArn is not empty and note the value of the Name\nproperty.\n\n* Using the noted value of the Name property, run the following command:\n\n'aws cloudtrail get-trail-status --name _<trail_name>_\n* Ensure the LatestcloudwatchLogdDeliveryTime property is set to a recent (~one\nday old) timestamp.","fix":"Perform the following to establish the prescribed state:\n\n'Via the AWS management Console\n\n* Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/\n[https://console.aws.amazon.com/cloudtrail/]\n* Under All Buckets, click on the target bucket you wish to evaluate\n* Click Properties on the top right of the console\n* Click Trails in the left menu\n* Click on each trail where no CloudWatch Logs are defined\n* Go to the CloudWatch Logs section and click on Configure\n* Define a new or select an existing log group\n* Click on Continue\n\n* Configure IAM Role which will deliver CloudTrail events to CloudWatch Logs\n\n* Create/Select an IAM Role and Policy Name\n* Click Allow to continue\n\n'Via CLI\n\n'aws cloudtrail update-trail --name _<trail_name>_\n--cloudwatch-logs-log-group-arn _<cloudtrail_log_group_arn>_\n--cloudwatch-logs-role-arn _<__cloudtrail_cloudwatchLogs_role_arn>_"},"code":"control \"cis-aws-foundations-2.4\" do\n  title \"Ensure CloudTrail trails are integrated with CloudWatch Logs\"\n  desc  \"AWS CloudTrail is a web service that records AWS API calls made in a\ngiven AWS account. The recorded information includes the identity of the API\ncaller, the time of the API call, the source IP address of the API caller, the\nrequest parameters, and the response elements returned by the AWS service.\nCloudTrail uses Amazon S3 for log file storage and delivery, so log files are\nstored durably. In addition to capturing CloudTrail logs within a specified S3\nbucket for long term analysis, realtime analysis can be performed by\nconfiguring CloudTrail to send logs to CloudWatch Logs. For a trail that is\nenabled in all regions in an account, CloudTrail sends log files from all those\nregions to a CloudWatch Logs log group. It is recommended that CloudTrail logs\nbe sent to CloudWatch Logs.\n\n'Note: The intent of this recommendation is to ensure AWS account activity is\nbeing captured, monitored, and appropriately alarmed on. CloudWatch Logs is a\nnative way to accomplish this using AWS services but does not preclude the use\nof an alternate solution.\"\n  impact 0.3\n  tag \"rationale\": \"Sending CloudTrail logs to CloudWatch Logs will facilitate\nreal-time and historic activity logging based on user, API, resource, and IP\naddress, and provides opportunity to establish alarms and notifications for\nanomalous or sensitivity account activity.\"\n  tag \"cis_impact\": \"Note: By default, CloudWatch Logs will store Logs\nindefinitely unless a specific retention period is defined for the log group.\nWhen choosing the number of days to retain, keep in mind the average days it\ntakes an organization to realize they have been breached is 210 days (at the\ntime of this writing). Since additional time is required to research a breach,\na minimum 365 day retention policy allows time for detection and research. You\nmay also wish to archive the logs to a cheaper storage service rather than\nsimply deleting them. See the following AWS resource to manage CloudWatch Logs\nretention periods:\n\n*\nhttp://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html\"\n  tag \"cis_rid\": \"2.4\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"6.6\", \"14.6\"], \"6.0\"]\n  tag \"nist\": [\"SI-4(2)\", \"AU-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78916-4\"\n  tag \"check\": \"Perform the following to ensure CloudTrail is configured as\nprescribed:\n\n'Via the AWS management Console\n\n* Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/\n[https://console.aws.amazon.com/cloudtrail/]\n* Under All Buckets, click on the target bucket you wish to evaluate\n* Click Properties on the top right of the console\n* Click Trails in the left menu\n* Ensure a CloudWatch Logs log group is configured and has a recent (~one day\nold) Last log file delivered timestamp.\n\n'Via CLI\n\n* Run the following command to get a listing of existing trails:\n\n'aws cloudtrail describe-trails\n* Ensure CloudWatchLogsLogGroupArn is not empty and note the value of the Name\nproperty.\n\n* Using the noted value of the Name property, run the following command:\n\n'aws cloudtrail get-trail-status --name _<trail_name>_\n* Ensure the LatestcloudwatchLogdDeliveryTime property is set to a recent (~one\nday old) timestamp.\"\n  tag \"fix\": \"Perform the following to establish the prescribed state:\n\n'Via the AWS management Console\n\n* Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/\n[https://console.aws.amazon.com/cloudtrail/]\n* Under All Buckets, click on the target bucket you wish to evaluate\n* Click Properties on the top right of the console\n* Click Trails in the left menu\n* Click on each trail where no CloudWatch Logs are defined\n* Go to the CloudWatch Logs section and click on Configure\n* Define a new or select an existing log group\n* Click on Continue\n\n* Configure IAM Role which will deliver CloudTrail events to CloudWatch Logs\n\n* Create/Select an IAM Role and Policy Name\n* Click Allow to continue\n\n'Via CLI\n\n'aws cloudtrail update-trail --name _<trail_name>_\n--cloudwatch-logs-log-group-arn _<cloudtrail_log_group_arn>_\n--cloudwatch-logs-role-arn _<__cloudtrail_cloudwatchLogs_role_arn>_\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  aws_cloudtrail_trails.trail_arns.each do |trail|\n    describe aws_cloudtrail_trail(trail) do\n      its('cloud_watch_logs_log_group_arn') { should_not be_nil}\n      its('status.latest_cloud_watch_logs_delivery_time') { should cmp > Time.now - 86400 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-2.4.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":9.7e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"CloudTrail arn:aws:cloudtrail:us-east-1:484747447281:trail/cis-trail-01 cloud_watch_logs_log_group_arn should not be nil","run_time":0.00012,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"CloudTrail arn:aws:cloudtrail:us-east-1:484747447281:trail/cis-trail-01 status.latest_cloud_watch_logs_delivery_time should cmp > 2018-11-17 20:21:35 -0500","run_time":0.035986,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-1.3","title":"Ensure credentials unused for 90 days or greater are disabled","desc":"AWS IAM users can access AWS resources using different types of\ncredentials, such as passwords or access keys. It is recommended that all\ncredentials that have been unused in 90 or greater days be removed or\ndeactivated.","descriptions":[{"label":"default","data":"AWS IAM users can access AWS resources using different types of\ncredentials, such as passwords or access keys. It is recommended that all\ncredentials that have been unused in 90 or greater days be removed or\ndeactivated."}],"impact":0.3,"refs":[],"tags":{"rationale":"Disabling or removing unnecessary credentials will reduce\nthe window of opportunity for credentials associated with a compromised or\nabandoned account to be used.","cis_impact":"","cis_rid":"1.3","cis_level":1,"csc_control":[["16.6"],"6.0"],"nist":["IA-4","Rev_4"],"cce_id":"CCE-78900-8","check":"Perform the following to determine if unused credentials exist:\n\n\n* Login to the AWS Management Console\n* Click Services\n* Click IAM\n* Click on Credential Report\n* This will download an .xls file which contains credential usage for all users\nwithin an AWS Account - open this file\n* For each user having password_enabled set to TRUE, ensure password_last_used\nis less than 90 days ago.\n* For each user having access_key_1_active or access_key_2_active to TRUE,\nensure the corresponding access_key_n_last_used_date is less than 90 days ago.\n\n\n'Via CLI\n\n* Run the following commands:\n\n'aws iam generate-credential-report\naws iam get-credential-report --query 'Content' --output text | base64 -d | cut\n-d, -f1,9,10,11,14,15,16\n* For each user having password_enabled set to TRUE, ensure\npassword_last_used_date is less than 90 days ago.\n* For each user having an access_key_1_active or access_key_2_active to TRUE,\nensure the corresponding access_key_n_last_used_date is less than 90 days ago.","fix":"Perform the following to remove or deactivate credentials:\n\n* Login to the AWS Management Console:\n* Click Services\n* Click IAM\n* Click on Users\n* Click on Security Credentials\n\n* As an Administrator\n\n* Click on Make Inactive for credentials that have not been used in 90 Days\n\n* As an IAM User\n\n* Click on Make Inactive or Delete for credentials which have not been used in\n90 Days\n"},"code":"control \"cis-aws-foundations-1.3\" do\n  title \"Ensure credentials unused for 90 days or greater are disabled\"\n  desc  \"AWS IAM users can access AWS resources using different types of\ncredentials, such as passwords or access keys. It is recommended that all\ncredentials that have been unused in 90 or greater days be removed or\ndeactivated.\"\n  impact 0.3\n  tag \"rationale\": \"Disabling or removing unnecessary credentials will reduce\nthe window of opportunity for credentials associated with a compromised or\nabandoned account to be used.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.3\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"16.6\"], \"6.0\"]\n  tag \"nist\": [\"IA-4\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78900-8\"\n  tag \"check\": \"Perform the following to determine if unused credentials exist:\n\n\n* Login to the AWS Management Console\n* Click Services\n* Click IAM\n* Click on Credential Report\n* This will download an .xls file which contains credential usage for all users\nwithin an AWS Account - open this file\n* For each user having password_enabled set to TRUE, ensure password_last_used\nis less than 90 days ago.\n* For each user having access_key_1_active or access_key_2_active to TRUE,\nensure the corresponding access_key_n_last_used_date is less than 90 days ago.\n\n\n'Via CLI\n\n* Run the following commands:\n\n'aws iam generate-credential-report\naws iam get-credential-report --query 'Content' --output text | base64 -d | cut\n-d, -f1,9,10,11,14,15,16\n* For each user having password_enabled set to TRUE, ensure\npassword_last_used_date is less than 90 days ago.\n* For each user having an access_key_1_active or access_key_2_active to TRUE,\nensure the corresponding access_key_n_last_used_date is less than 90 days ago.\"\n  tag \"fix\": \"Perform the following to remove or deactivate credentials:\n\n* Login to the AWS Management Console:\n* Click Services\n* Click IAM\n* Click on Users\n* Click on Security Credentials\n\n* As an Administrator\n\n* Click on Make Inactive for credentials that have not been used in 90 Days\n\n* As an IAM User\n\n* Click on Make Inactive or Delete for credentials which have not been used in\n90 Days\n\"\n  describe aws_iam_users.where(has_console_password?: true).where(password_never_used?: true) do\n    it { should_not exist }\n  end\n\n  describe aws_iam_users.where(password_ever_used?: true).where{ password_last_used_days_ago >= 90 } do\n    it { should_not exist }\n  end\n\n  aws_iam_access_keys.where(active: true).entries.each do |key|\n    describe key.username do\n      context key do\n        its('last_used_days_ago') { should cmp < 90 }\n      end\n    end\n  end\n\n  describe \"Control skipped because no active iam access keys were found\" do\n    skip \"This control is skipped since the aws_iam_access_keys resource returned an empty active access key list\"\n  end if aws_iam_access_keys.where(active: true).entries.empty?\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.3.rb"},"results":[{"status":"passed","code_desc":"IAM Users with has_console_password? == true password_never_used? == true should not exist","run_time":0.000237,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"IAM Users with password_ever_used? == true password_last_used_days_ago >= 90 should not exist","run_time":8.0e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with active == true one entry last_used_days_ago should cmp < 90","run_time":0.000234,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with active == true one entry last_used_days_ago should cmp < 90","run_time":0.000251,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-3.5","title":"Ensure a log metric filter and alarm exist for CloudTrail\nconfiguration changes","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for detecting changes to CloudTrail's configurations.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for detecting changes to CloudTrail's configurations."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring changes to CloudTrail's configuration will help\nensure sustained visibility to activities performed in the AWS account.","cis_impact":"","cis_rid":"3.5","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79190-5","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)\n|| ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName\n= StopLogging) }'\n5. Note the _<cloudtrail_cfg_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<cloudtrail_cfg_changes_metric> _captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<cloudtrail_cfg_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for Cloudtrail configuration changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<cloudtrail_cfg_changes_metric>_ --metric-transformations\nmetricName=_<cloudtrail_cfg_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)\n|| ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName\n= StopLogging) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<cloudtrail_cfg_changes_alarm>_\n--metric-name _<cloudtrail_cfg_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.5\" do\n  title \"Ensure a log metric filter and alarm exist for CloudTrail\nconfiguration changes\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for detecting changes to CloudTrail's configurations.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring changes to CloudTrail's configuration will help\nensure sustained visibility to activities performed in the AWS account.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.5\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79190-5\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)\n|| ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName\n= StopLogging) }'\n5. Note the _<cloudtrail_cfg_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<cloudtrail_cfg_changes_metric> _captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<cloudtrail_cfg_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for Cloudtrail configuration changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<cloudtrail_cfg_changes_metric>_ --metric-transformations\nmetricName=_<cloudtrail_cfg_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)\n|| ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName\n= StopLogging) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<cloudtrail_cfg_changes_alarm>_\n--metric-name _<cloudtrail_cfg_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.5.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000115,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":6.8e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":6.7e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":9.1e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":6.0e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":0.000124,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-1.7","title":"Ensure IAM password policy require at least one symbol","desc":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one symbol.","descriptions":[{"label":"default","data":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one symbol."}],"impact":0.3,"refs":[],"tags":{"rationale":"Setting a password complexity policy increases account\nresiliency against brute force login attempts.","cis_impact":"","cis_rid":"1.7","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78905-7","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Require at least one non-alphanumeric character' is checked under\n'Password Policy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireSymbols': true","fix":"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Require at least one non-alphanumeric character'\n* Click 'Apply password policy'\n\n' Via CLI\n\n' aws iam update-account-password-policy --require-symbols\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.7\" do\n  title \"Ensure IAM password policy require at least one symbol\"\n  desc  \"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one symbol.\"\n  impact 0.3\n  tag \"rationale\": \"Setting a password complexity policy increases account\nresiliency against brute force login attempts.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.7\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78905-7\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Require at least one non-alphanumeric character' is checked under\n'Password Policy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireSymbols': true\"\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Require at least one non-alphanumeric character'\n* Click 'Apply password policy'\n\n' Via CLI\n\n' aws iam update-account-password-policy --require-symbols\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('require_symbols?') { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.7.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy require_symbols? should equal true","run_time":0.000107,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-3.1","title":"Ensure a log metric filter and alarm exist for unauthorized API calls","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for unauthorized API calls.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for unauthorized API calls."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring unauthorized API calls will help reveal\napplication errors and may reduce time to detect malicious activity.","cis_impact":"This alert may be triggered by normal read-only console\nactivities that attempt to opportunistically gather optional information, but\ngracefully fail if they don't have permissions.\n\n'If an excessive number of alerts are being generated then an organization may\nwish to consider adding read access to the limited IAM user permissions simply\nto quiet the alerts.\n\n'In some cases doing this may allow the users to actually view some areas of\nthe system - any additional access given should be reviewed for alignment with\nthe original limited IAM user intent.","cis_rid":"3.1","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79186-3","check":"Perform the following to determine if the account is configured\nas prescribed:\n1. Identify the log group name configured for use with CloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.errorCode = \\'*UnauthorizedOperation\\') ||\n($.errorCode = \\'AccessDenied*\\') }'\n5. Note the _<unauthorized_api_calls_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<unauthorized_api_calls_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<unauthorized_api_calls_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:\n1. Create a metric filter based on filter pattern provided which checks for\nunauthorized API calls and the <cloudtrail_log_group_name> taken from audit\nstep 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<unauthorized_api_calls_metric>_ --metric-transformations\nmetricName=_<unauthorized_api_calls_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.errorCode = '*UnauthorizedOperation') || ($.errorCode =\n'AccessDenied*') }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name\n<_<em>unauthorized_api_calls__alarm></em> --metric-name\n_<unauthorized_api_calls_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\nNOTE: set the period and threshold to values that fit your organization.\n"},"code":"control \"cis-aws-foundations-3.1\" do\n  title \"Ensure a log metric filter and alarm exist for unauthorized API calls\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for unauthorized API calls.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring unauthorized API calls will help reveal\napplication errors and may reduce time to detect malicious activity.\"\n  tag \"cis_impact\": \"This alert may be triggered by normal read-only console\nactivities that attempt to opportunistically gather optional information, but\ngracefully fail if they don't have permissions.\n\n'If an excessive number of alerts are being generated then an organization may\nwish to consider adding read access to the limited IAM user permissions simply\nto quiet the alerts.\n\n'In some cases doing this may allow the users to actually view some areas of\nthe system - any additional access given should be reviewed for alignment with\nthe original limited IAM user intent.\"\n  tag \"cis_rid\": \"3.1\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79186-3\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed:\n1. Identify the log group name configured for use with CloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.errorCode = \\\\'*UnauthorizedOperation\\\\') ||\n($.errorCode = \\\\'AccessDenied*\\\\') }'\n5. Note the _<unauthorized_api_calls_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<unauthorized_api_calls_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<unauthorized_api_calls_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:\n1. Create a metric filter based on filter pattern provided which checks for\nunauthorized API calls and the <cloudtrail_log_group_name> taken from audit\nstep 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<unauthorized_api_calls_metric>_ --metric-transformations\nmetricName=_<unauthorized_api_calls_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.errorCode = '*UnauthorizedOperation') || ($.errorCode =\n'AccessDenied*') }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name\n<_<em>unauthorized_api_calls__alarm></em> --metric-name\n_<unauthorized_api_calls_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\nNOTE: set the period and threshold to values that fit your organization.\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\") }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist}\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.1.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":9.6e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":7.4e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":6.1e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":8.8e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":7.4e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":8.5e-05,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-1.14","title":"Ensure hardware MFA is enabled for the 'root' account","desc":"The root account is the most privileged user in an AWS account. MFA\nadds an extra layer of protection on top of a user name and password. With MFA\nenabled, when a user signs in to an AWS website, they will be prompted for\ntheir user name and password as well as for an authentication code from their\nAWS MFA device. For Level 2, it is recommended that the root account be\nprotected with a hardware MFA.","descriptions":[{"label":"default","data":"The root account is the most privileged user in an AWS account. MFA\nadds an extra layer of protection on top of a user name and password. With MFA\nenabled, when a user signs in to an AWS website, they will be prompted for\ntheir user name and password as well as for an authentication code from their\nAWS MFA device. For Level 2, it is recommended that the root account be\nprotected with a hardware MFA."}],"impact":0.7,"refs":[],"tags":{"rationale":"A hardware MFA has a smaller attack surface than a virtual\nMFA. For example, a hardware MFA does not suffer the attack surface introduced\nby the mobile smartphone on which a virtual MFA resides.\n\n'NOTE: Using hardware MFA for many, many AWS accounts may create a logistical\ndevice management issue. If this is the case, consider implementing this Level\n2 recommendation selectively to the highest security AWS accounts and the Level\n1 recommendation applied to the remaining accounts.\n\n'Link to order AWS compatible hardware MFA device:\nhttp://onlinenoram.gemalto.com/ [http://onlinenoram.gemalto.com/]","cis_impact":"","cis_rid":"1.14","cis_level":2,"csc_control":[["5.6","11.4","12.6","16.11"],"6.0"],"nist":["IA-2(1)","SC-23","Rev_4"],"cce_id":"CCE-78911-5","check":"Perform the following to determine if the root account has a\nhardware MFA setup:\n\n\n* Run the following command to list all virtual MFA devices:\n\n'aws iam list-virtual-mfa-devices\n* If the output contains one MFA with the following Serial Number, it means the\nMFA is virtual, not hardware and the account is not compliant with this\nrecommendation:\n\n' 'SerialNumber':\n'arn:aws:iam::_<aws_account_number>_:mfa/root-account-mfa-device'\n","fix":"Perform the following to establish a hardware MFA for the root\naccount:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].<div\nclass='aws-note'>\n\n'Note: to manage MFA devices for the root AWS account, you must use your root\naccount credentials to sign in to AWS. You cannot manage MFA devices for the\nroot account using other credentials.\n\n\n 'Choose Dashboard, and under Security Status, expand Activate MFA on your root\naccount.\n\n 'Choose Activate MFA\n\n 'In the wizard, choose A hardware MFA device and then choose Next Step.\n\n 'In the Serial Number box, enter the serial number that is found on the back of\nthe MFA device.\n\n 'In the Authentication Code 1 box, enter the six-digit number displayed by the\nMFA device. You might need to press the button on the front of the device to\ndisplay the number.\n\n 'Wait 30 seconds while the device refreshes the code, and then enter the next\nsix-digit number into the Authentication Code 2 box. You might need to press\nthe button on the front of the device again to display the second number.\n\n 'Choose Next Step. The MFA device is now associated with the AWS account. The\nnext time you use your AWS account credentials to sign in, you must type a code\nfrom the hardware MFA device.\n"},"code":"control \"cis-aws-foundations-1.14\" do\n  title \"Ensure hardware MFA is enabled for the 'root' account\"\n  desc  \"The root account is the most privileged user in an AWS account. MFA\nadds an extra layer of protection on top of a user name and password. With MFA\nenabled, when a user signs in to an AWS website, they will be prompted for\ntheir user name and password as well as for an authentication code from their\nAWS MFA device. For Level 2, it is recommended that the root account be\nprotected with a hardware MFA.\"\n  impact 0.7\n  tag \"rationale\": \"A hardware MFA has a smaller attack surface than a virtual\nMFA. For example, a hardware MFA does not suffer the attack surface introduced\nby the mobile smartphone on which a virtual MFA resides.\n\n'NOTE: Using hardware MFA for many, many AWS accounts may create a logistical\ndevice management issue. If this is the case, consider implementing this Level\n2 recommendation selectively to the highest security AWS accounts and the Level\n1 recommendation applied to the remaining accounts.\n\n'Link to order AWS compatible hardware MFA device:\nhttp://onlinenoram.gemalto.com/ [http://onlinenoram.gemalto.com/]\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.14\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": [[\"5.6\", \"11.4\", \"12.6\", \"16.11\"], \"6.0\"]\n  tag \"nist\": [\"IA-2(1)\",\"SC-23\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78911-5\"\n  tag \"check\": \"Perform the following to determine if the root account has a\nhardware MFA setup:\n\n\n* Run the following command to list all virtual MFA devices:\n\n'aws iam list-virtual-mfa-devices\n* If the output contains one MFA with the following Serial Number, it means the\nMFA is virtual, not hardware and the account is not compliant with this\nrecommendation:\n\n' 'SerialNumber':\n'arn:aws:iam::_<aws_account_number>_:mfa/root-account-mfa-device'\n\"\n  tag \"fix\": \"Perform the following to establish a hardware MFA for the root\naccount:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].<div\nclass='aws-note'>\n\n'Note: to manage MFA devices for the root AWS account, you must use your root\naccount credentials to sign in to AWS. You cannot manage MFA devices for the\nroot account using other credentials.\n\n\n 'Choose Dashboard, and under Security Status, expand Activate MFA on your root\naccount.\n\n 'Choose Activate MFA\n\n 'In the wizard, choose A hardware MFA device and then choose Next Step.\n\n 'In the Serial Number box, enter the serial number that is found on the back of\nthe MFA device.\n\n 'In the Authentication Code 1 box, enter the six-digit number displayed by the\nMFA device. You might need to press the button on the front of the device to\ndisplay the number.\n\n 'Wait 30 seconds while the device refreshes the code, and then enter the next\nsix-digit number into the Authentication Code 2 box. You might need to press\nthe button on the front of the device again to display the second number.\n\n 'Choose Next Step. The MFA device is now associated with the AWS account. The\nnext time you use your AWS account credentials to sign in, you must type a code\nfrom the hardware MFA device.\n\"\n\n  describe aws_iam_root_user do\n    it { should_not have_virtual_mfa_enabled }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.14.rb"},"results":[{"status":"failed","code_desc":"AWS Root-User should not have virtual mfa enabled","run_time":0.102857,"start_time":"2018-11-18T20:21:35-05:00","message":"expected #has_virtual_mfa_enabled? to return false, got true"}]},{"id":"cis-aws-foundations-4.5","title":"Ensure routing tables for VPC peering are 'least access'","desc":"Once a VPC peering connection is estalished, routing tables must be\nupdated to establish any connections between the peered VPCs. These routes can\nbe as specific as desired - even peering a VPC to only a single host on the\nother side of the connection.","descriptions":[{"label":"default","data":"Once a VPC peering connection is estalished, routing tables must be\nupdated to establish any connections between the peered VPCs. These routes can\nbe as specific as desired - even peering a VPC to only a single host on the\nother side of the connection."}],"impact":0.7,"refs":[],"tags":{"rationale":"Being highly selective in peering routing tables is a very\neffective way of minimizing the impact of breach as resources outside of these\nroutes are inaccessible to the peered VPC.","cis_impact":"","cis_rid":"4.5","cis_level":2,"csc_control":"","nist":["SC-7","Rev_4"],"cce_id":"","check":"Review routing tables of peered VPCs for whether they route all\nsubnets of each VPC and whether that is necessary to accomplish the intended\npurposes for peering the VPCs.\n\n'Via CLI:\n\n* List all the route tables from a VPC and check if 'GatewayId' is pointing to\na _<peering_connection_id>_ (e.g. pcx-1a2b3c4d) and if 'DestinationCidrBlock'\nis as specific as desired.\n\n'aws ec2 describe-route-tables --filter 'Name=vpc-id,Values=_<vpc_id>_' --query\n'RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,\nAssociatedSubnets:Associations[*].SubnetId}'","fix":"Remove and add route table entries to ensure that the least\nnumber of subnets or hosts as is required to accomplish the purpose for peering\nare routable.\n\n'Via CLI:\n\n* For each _<route_table_id> _containing routes non compliant with your routing\npolicy (which grants more than desired 'least access'), delete the non\ncompliant route:\n\n'aws ec2 delete-route --route-table-id _<route_table_id>_\n--destination-cidr-block _<non_compliant_destination_CIDR>_\n\n' 2. Create a new compliant route:\n\n'aws ec2 create-route --route-table-id _<route_table_id>_\n--destination-cidr-block _<compliant_destination_CIDR>_\n--vpc-peering-connection-id _<peering_connection_id>_"},"code":"control \"cis-aws-foundations-4.5\" do\n  title \"Ensure routing tables for VPC peering are 'least access'\"\n  desc  \"Once a VPC peering connection is estalished, routing tables must be\nupdated to establish any connections between the peered VPCs. These routes can\nbe as specific as desired - even peering a VPC to only a single host on the\nother side of the connection.\"\n  impact 0.7\n  tag \"rationale\": \"Being highly selective in peering routing tables is a very\neffective way of minimizing the impact of breach as resources outside of these\nroutes are inaccessible to the peered VPC.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"4.5\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SC-7\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Review routing tables of peered VPCs for whether they route all\nsubnets of each VPC and whether that is necessary to accomplish the intended\npurposes for peering the VPCs.\n\n'Via CLI:\n\n* List all the route tables from a VPC and check if 'GatewayId' is pointing to\na _<peering_connection_id>_ (e.g. pcx-1a2b3c4d) and if 'DestinationCidrBlock'\nis as specific as desired.\n\n'aws ec2 describe-route-tables --filter 'Name=vpc-id,Values=_<vpc_id>_' --query\n'RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,\nAssociatedSubnets:Associations[*].SubnetId}'\"\n  tag \"fix\": \"Remove and add route table entries to ensure that the least\nnumber of subnets or hosts as is required to accomplish the purpose for peering\nare routable.\n\n'Via CLI:\n\n* For each _<route_table_id> _containing routes non compliant with your routing\npolicy (which grants more than desired 'least access'), delete the non\ncompliant route:\n\n'aws ec2 delete-route --route-table-id _<route_table_id>_\n--destination-cidr-block _<non_compliant_destination_CIDR>_\n\n' 2. Create a new compliant route:\n\n'aws ec2 create-route --route-table-id _<route_table_id>_\n--destination-cidr-block _<compliant_destination_CIDR>_\n--vpc-peering-connection-id _<peering_connection_id>_\"\n\n  aws_route_tables.route_table_ids.each do |route_table_id|\n    aws_route_table(route_table_id).routes.each do |route|\n      next unless route.key?(:vpc_peering_connection_id)\n      describe route do\n        its([:destination_cidr_block]) { should_not be nil } #verify with attributes\n      end\n    end\n    describe \"No routes with peering connection were found for the route table\" do\n      skip \"No routes with peering connection were found for the route_table #{route_table_id}\"\n    end if !aws_route_table(route_table_id).routes.any? { |route| route.key?(:vpc_peering_connection_id) }\n  end\n  describe \"Control skipped because no route tables were found\" do\n    skip \"This control is skipped since the aws_route_tables resource returned an empty route table list\"\n  end if aws_route_tables.route_table_ids.empty?\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-4.5.rb"},"results":[{"status":"skipped","code_desc":"No routes with peering connection were found for the route table","run_time":8.0e-06,"start_time":"2018-11-18T20:21:35-05:00","resource":"","skip_message":"No routes with peering connection were found for the route_table rtb-f6b2458a"}]},{"id":"cis-aws-foundations-1.20","title":"Ensure security contact information is registered","desc":"AWS provides customers with the option of specifying the contact\ninformation for account's security team. It is recommended that this\ninformation be provided.","descriptions":[{"label":"default","data":"AWS provides customers with the option of specifying the contact\ninformation for account's security team. It is recommended that this\ninformation be provided."}],"impact":0.3,"refs":[],"tags":{"rationale":"Specifying security-specific contact information will help\nensure that security advisories sent by AWS reach the team in your organization\nthat is best equipped to respond to them.","cis_impact":"","cis_rid":"1.20","cis_level":1,"csc_control":"","nist":["IA-4","Rev_4"],"cce_id":"CCE-79200-2","check":"Perform the following in the AWS Management Console to\ndetermine if security contact information is present:\n\n* Click on your account name at the top right corner of the console\n* From the drop-down menu Click My Account\n* Scroll down to the Alternate Contacts section\n* Ensure contact information is specified in the Security section","fix":"Perform the following in the AWS Management Console to establish\nsecurity contact information:\n\n* Click on your account name at the top right corner of the console.\n* From the drop-down menu Click My Account\n* Scroll down to the Alternate Contacts section\n* Enter contact information in the Security section\n\n'Note: Consider specifying an internal email distribution list to ensure emails\nare regularly monitored by more than one individual."},"code":"control \"cis-aws-foundations-1.20\" do\n  title \"Ensure security contact information is registered\"\n  desc  \"AWS provides customers with the option of specifying the contact\ninformation for account's security team. It is recommended that this\ninformation be provided.\"\n  impact 0.3\n  tag \"rationale\": \"Specifying security-specific contact information will help\nensure that security advisories sent by AWS reach the team in your organization\nthat is best equipped to respond to them.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.20\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-4\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79200-2\"\n  tag \"check\": \"Perform the following in the AWS Management Console to\ndetermine if security contact information is present:\n\n* Click on your account name at the top right corner of the console\n* From the drop-down menu Click My Account\n* Scroll down to the Alternate Contacts section\n* Ensure contact information is specified in the Security section\"\n  tag \"fix\": \"Perform the following in the AWS Management Console to establish\nsecurity contact information:\n\n* Click on your account name at the top right corner of the console.\n* From the drop-down menu Click My Account\n* Scroll down to the Alternate Contacts section\n* Enter contact information in the Security section\n\n'Note: Consider specifying an internal email distribution list to ensure emails\nare regularly monitored by more than one individual.\"\n\n  describe \"Control has to be tested manually\" do\n    skip \"This control must be manually reviewed\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.20.rb"},"results":[{"status":"skipped","code_desc":"Control has to be tested manually","run_time":4.0e-06,"start_time":"2018-11-18T20:21:35-05:00","resource":"","skip_message":"This control must be manually reviewed"}]},{"id":"cis-aws-foundations-3.10","title":"Ensure a log metric filter and alarm exist for security group changes","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Security Groups are a stateful packet filter that controls\ningress and egress traffic within a VPC. It is recommended that a metric filter\nand alarm be established changes to Security Groups.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Security Groups are a stateful packet filter that controls\ningress and egress traffic within a VPC. It is recommended that a metric filter\nand alarm be established changes to Security Groups."}],"impact":0.7,"refs":[],"tags":{"rationale":"Monitoring changes to security group will help ensure that\nresources and services are not unintentionally exposed.","cis_impact":"","cis_rid":"3.10","cis_level":2,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79195-4","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = AuthorizeSecurityGroupIngress) ||\n($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName =\nRevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) ||\n($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'\n5. Note the _<security_group_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<security_group_changes_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<security_group_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for security groups changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<security_group_changes_metric>_ --metric-transformations\nmetricName=_<security_group_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) ||\n($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName =\nRevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) ||\n($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<security_group_changes_alarm>_\n--metric-name _<security_group_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.10\" do\n  title \"Ensure a log metric filter and alarm exist for security group changes\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Security Groups are a stateful packet filter that controls\ningress and egress traffic within a VPC. It is recommended that a metric filter\nand alarm be established changes to Security Groups.\"\n  impact 0.7\n  tag \"rationale\": \"Monitoring changes to security group will help ensure that\nresources and services are not unintentionally exposed.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.10\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79195-4\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = AuthorizeSecurityGroupIngress) ||\n($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName =\nRevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) ||\n($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'\n5. Note the _<security_group_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<security_group_changes_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<security_group_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for security groups changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<security_group_changes_metric>_ --metric-transformations\nmetricName=_<security_group_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) ||\n($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName =\nRevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) ||\n($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<security_group_changes_alarm>_\n--metric-name _<security_group_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = \"{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }\"\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.10.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000138,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":6.3e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":6.5e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":8.5e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":5.4e-05,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":6.8e-05,"start_time":"2018-11-18T20:21:35-05:00"}]},{"id":"cis-aws-foundations-1.24","title":"Ensure IAM policies that allow full '*:*' administrative privileges\nare not created","desc":"IAM policies are the means by which privileges are granted to users,\ngroups, or roles. It is recommended and considered a standard security advice\nto grant _least privilege_--that is, granting only the permissions required to\nperform a task. Determine what users need to do and then craft policies for\nthem that let the users perform _only_ those tasks, instead of allowing full\nadministrative privileges.","descriptions":[{"label":"default","data":"IAM policies are the means by which privileges are granted to users,\ngroups, or roles. It is recommended and considered a standard security advice\nto grant _least privilege_--that is, granting only the permissions required to\nperform a task. Determine what users need to do and then craft policies for\nthem that let the users perform _only_ those tasks, instead of allowing full\nadministrative privileges."}],"impact":0.3,"refs":[],"tags":{"rationale":"It's more secure to start with a minimum set of permissions\nand grant additional permissions as necessary, rather than starting with\npermissions that are too lenient and then trying to tighten them later.\n\n'Providing full administrative privileges instead of restricting to the minimum\nset of permissions that the user is required to do exposes the resources to\npotentially unwanted actions.\n\n'IAM policies that have a statement with 'Effect': 'Allow' with 'Action': '*'\nover  'Resource': '*' should be removed.","cis_impact":"","cis_rid":"1.24","cis_level":1,"severity":"low","csc_control":"","nist":["AC-6","Rev_4"],"cce_id":"CCE-78912-3","check":"Perform the following to determine what policies are created:\n\n* Run the following to get a list of IAM policies:\n\n'aws iam list-policies --output text\n\n* For each policy returned, run the following command to determine if any\npolicies is allowing full administrative privileges on the account:\n\n'aws iam get-policy-version --policy-arn _<policy_arn>_ --version\n_<policy_version>_ --query 'PolicyVersion.Document.Statement[?Effect == 'Allow'\n&& contains(Resource, '*') && contains (Action, '*')]'\n* If the output of the command returns any policies, it's not compliant.","fix":"Using the GUI, perform the following to detach the policy that\nhas full administrative privileges:\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, click Policies and then search for the policy name\nfound in the audit step.\n\n 'Select the policy that needs to be deleted.\n\n 'In the policy action menu, select first Detach\n* Select all Users, Groups, Roles that have this policy attached\n\n 'Click Detach Policy\n\n 'In the policy action menu, select Detach\n\n'Using the CLI, perform the following to detach the policy that has full\nadministrative privileges as found in the audit step:\n\n'1. Lists all IAM users, groups, and roles that the specified managed policy is\nattached to.\n\n 'aws iam list-entities-for-policy --policy-arn _<policy_arn>_\n\n\n'2. Detach the policy from all IAM Users:\n\n 'aws iam detach-user-policy --user-name _<iam_user>_ --policy-arn _<policy_arn>_\n\n'3. Detach the policy from all IAM Groups:\n\n 'aws iam detach-group-policy --group-name _<iam_group>_ --policy-arn\n_<policy_arn>_\n\n\n'4. Detach the policy from all IAM Roles:\n\n\n 'aws iam detach-role-policy --role-name _<iam_role>_ --policy-arn _<policy_arn>_\n\n'\n"},"code":"control \"cis-aws-foundations-1.24\" do\n  title \"Ensure IAM policies that allow full '*:*' administrative privileges\nare not created\"\n  desc  \"IAM policies are the means by which privileges are granted to users,\ngroups, or roles. It is recommended and considered a standard security advice\nto grant _least privilege_--that is, granting only the permissions required to\nperform a task. Determine what users need to do and then craft policies for\nthem that let the users perform _only_ those tasks, instead of allowing full\nadministrative privileges.\"\n  impact 0.3\n  tag \"rationale\": \"It's more secure to start with a minimum set of permissions\nand grant additional permissions as necessary, rather than starting with\npermissions that are too lenient and then trying to tighten them later.\n\n'Providing full administrative privileges instead of restricting to the minimum\nset of permissions that the user is required to do exposes the resources to\npotentially unwanted actions.\n\n'IAM policies that have a statement with 'Effect': 'Allow' with 'Action': '*'\nover  'Resource': '*' should be removed.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.24\"\n  tag \"cis_level\": 1\n  tag \"severity\": \"low\"\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AC-6\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78912-3\"\n  tag \"check\": \"Perform the following to determine what policies are created:\n\n* Run the following to get a list of IAM policies:\n\n'aws iam list-policies --output text\n\n* For each policy returned, run the following command to determine if any\npolicies is allowing full administrative privileges on the account:\n\n'aws iam get-policy-version --policy-arn _<policy_arn>_ --version\n_<policy_version>_ --query 'PolicyVersion.Document.Statement[?Effect == 'Allow'\n&& contains(Resource, '*') && contains (Action, '*')]'\n* If the output of the command returns any policies, it's not compliant.\"\n  tag \"fix\": \"Using the GUI, perform the following to detach the policy that\nhas full administrative privileges:\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, click Policies and then search for the policy name\nfound in the audit step.\n\n 'Select the policy that needs to be deleted.\n\n 'In the policy action menu, select first Detach\n* Select all Users, Groups, Roles that have this policy attached\n\n 'Click Detach Policy\n\n 'In the policy action menu, select Detach\n\n'Using the CLI, perform the following to detach the policy that has full\nadministrative privileges as found in the audit step:\n\n'1. Lists all IAM users, groups, and roles that the specified managed policy is\nattached to.\n\n 'aws iam list-entities-for-policy --policy-arn _<policy_arn>_\n\n\n'2. Detach the policy from all IAM Users:\n\n 'aws iam detach-user-policy --user-name _<iam_user>_ --policy-arn _<policy_arn>_\n\n'3. Detach the policy from all IAM Groups:\n\n 'aws iam detach-group-policy --group-name _<iam_group>_ --policy-arn\n_<policy_arn>_\n\n\n'4. Detach the policy from all IAM Roles:\n\n\n 'aws iam detach-role-policy --role-name _<iam_role>_ --policy-arn _<policy_arn>_\n\n'\n\"\n# the following implementation covers cases where 'Action' and 'Resource' param of the\n# policy json is defined as an array or string\n# if recoded please confirm that it tests both cases\n\n  aws_iam_policies.policy_names.each do |policy|\n    describe \"Attached Policies #{policy} allows full '*:*' privileges?\" do\n      subject {\n        aws_iam_policy(policy).document.where(Effect:'Allow').actions.flatten.include?(\"*\") and\n        aws_iam_policy(policy).document.where(Effect:'Allow').resources.flatten.include?(\"*\")\n      }\n      it { should be false }\n    end if aws_iam_policy(policy).attached?\n  end\n\n  describe \"Control skipped because no iam policies were found\" do\n    skip \"This control is skipped since the aws_iam_policies resource returned an empty policy list\"\n  end if !aws_iam_policies.policy_names.any? { |policy| aws_iam_policy(policy).attached? }\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.24.rb"},"results":[{"status":"passed","code_desc":"Attached Policies iam-manager-policy allows full '*:*' privileges? should equal false","run_time":0.451091,"start_time":"2018-11-18T20:21:35-05:00"},{"status":"passed","code_desc":"Attached Policies iam-master-policy allows full '*:*' privileges? should equal false","run_time":0.379887,"start_time":"2018-11-18T20:21:36-05:00"},{"status":"passed","code_desc":"Attached Policies AutoScalingServiceRolePolicy allows full '*:*' privileges? should equal false","run_time":0.350478,"start_time":"2018-11-18T20:21:36-05:00"},{"status":"passed","code_desc":"Attached Policies AWSElasticBeanstalkEnhancedHealth allows full '*:*' privileges? should equal false","run_time":0.342087,"start_time":"2018-11-18T20:21:36-05:00"},{"status":"passed","code_desc":"Attached Policies AWSConfigRole allows full '*:*' privileges? should equal false","run_time":0.331988,"start_time":"2018-11-18T20:21:37-05:00"},{"status":"passed","code_desc":"Attached Policies AWSElasticBeanstalkWebTier allows full '*:*' privileges? should equal false","run_time":0.321783,"start_time":"2018-11-18T20:21:37-05:00"},{"status":"failed","code_desc":"Attached Policies AdministratorAccess allows full '*:*' privileges? should equal false","run_time":0.811945,"start_time":"2018-11-18T20:21:37-05:00","message":"\nexpected false\n     got true\n"},{"status":"passed","code_desc":"Attached Policies AWSElasticBeanstalkMulticontainerDocker allows full '*:*' privileges? should equal false","run_time":0.335938,"start_time":"2018-11-18T20:21:38-05:00"},{"status":"passed","code_desc":"Attached Policies AWSTrustedAdvisorServiceRolePolicy allows full '*:*' privileges? should equal false","run_time":0.329918,"start_time":"2018-11-18T20:21:38-05:00"},{"status":"passed","code_desc":"Attached Policies AWSElasticBeanstalkService allows full '*:*' privileges? should equal false","run_time":0.32477,"start_time":"2018-11-18T20:21:39-05:00"},{"status":"passed","code_desc":"Attached Policies AWSElasticBeanstalkWorkerTier allows full '*:*' privileges? should equal false","run_time":0.30521,"start_time":"2018-11-18T20:21:39-05:00"},{"status":"passed","code_desc":"Attached Policies AWSSupportAccess allows full '*:*' privileges? should equal false","run_time":0.308621,"start_time":"2018-11-18T20:21:39-05:00"},{"status":"passed","code_desc":"Attached Policies AWSSupportServiceRolePolicy allows full '*:*' privileges? should equal false","run_time":0.313051,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.10","title":"Ensure IAM password policy prevents password reuse","desc":"IAM password policies can prevent the reuse of a given password by the\nsame user. It is recommended that the password policy prevent the reuse of\npasswords.","descriptions":[{"label":"default","data":"IAM password policies can prevent the reuse of a given password by the\nsame user. It is recommended that the password policy prevent the reuse of\npasswords."}],"impact":0.3,"refs":[],"tags":{"rationale":"Preventing password reuse increases account resiliency\nagainst brute force login attempts.","cis_impact":"","cis_rid":"1.10","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78908-1","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Prevent password reuse' is checked\n* Ensure 'Number of passwords to remember' is set to 24\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'PasswordReusePrevention': 24","fix":"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Prevent password reuse'\n* Set 'Number of passwords to remember' is set to 24\n\n' Via CLI\n\n' aws iam update-account-password-policy --password-reuse-prevention 24\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.10\" do\n  title \"Ensure IAM password policy prevents password reuse\"\n  desc  \"IAM password policies can prevent the reuse of a given password by the\nsame user. It is recommended that the password policy prevent the reuse of\npasswords.\"\n  impact 0.3\n  tag \"rationale\": \"Preventing password reuse increases account resiliency\nagainst brute force login attempts.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.10\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78908-1\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Prevent password reuse' is checked\n* Ensure 'Number of passwords to remember' is set to 24\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'PasswordReusePrevention': 24\"\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Prevent password reuse'\n* Set 'Number of passwords to remember' is set to 24\n\n' Via CLI\n\n' aws iam update-account-password-policy --password-reuse-prevention 24\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('prevent_password_reuse?') { should be true }\n    its('number_of_passwords_to_remember') { should cmp <= 24 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.10.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy prevent_password_reuse? should equal true","run_time":0.000166,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM Password-Policy number_of_passwords_to_remember should cmp <= 24","run_time":0.000169,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-4.1","title":"Ensure no security groups allow ingress from 0.0.0.0/0 to port 22","desc":"Security groups provide stateful filtering of ingress/egress network\ntraffic to AWS resources. It is recommended that no security group allows\nunrestricted ingress access to port 22.","descriptions":[{"label":"default","data":"Security groups provide stateful filtering of ingress/egress network\ntraffic to AWS resources. It is recommended that no security group allows\nunrestricted ingress access to port 22."}],"impact":0.3,"refs":[],"tags":{"rationale":"Removing unfettered connectivity to remote console\nservices, such as SSH, reduces a server's exposure to risk.","cis_impact":"For updating an existing environment, care should be taken\nto ensure that administrators currently relying on an existing ingress from\n0.0.0.0/0 have access to ports 22 and/or 3389 through another security group.","cis_rid":"4.1","cis_level":1,"cis_control_number":"","nist":["SC-7(5)","Rev_4"],"cce_id":"","check":"Perform the following to determine if the account is configured\nas prescribed:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Ensure no rule exists that has a port range that includes port 22 and has a\nSource of 0.0.0.0/0\n\nNote: A Port value of ALL or a port range such as 0-1024 are inclusive of port\n22.\n","fix":"Perform the following to implement the prescribed state:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Identify the rules to be removed\n* Click the x in the Remove column\n* Click Save"},"code":"control \"cis-aws-foundations-4.1\" do\n  title \"Ensure no security groups allow ingress from 0.0.0.0/0 to port 22\"\n  desc  \"Security groups provide stateful filtering of ingress/egress network\ntraffic to AWS resources. It is recommended that no security group allows\nunrestricted ingress access to port 22.\"\n  impact 0.3\n  tag \"rationale\": \"Removing unfettered connectivity to remote console\nservices, such as SSH, reduces a server's exposure to risk.\"\n  tag \"cis_impact\": \"For updating an existing environment, care should be taken\nto ensure that administrators currently relying on an existing ingress from\n0.0.0.0/0 have access to ports 22 and/or 3389 through another security group.\"\n  tag \"cis_rid\": \"4.1\"\n  tag \"cis_level\": 1\n  tag \"cis_control_number\": \"\"\n  tag \"nist\": [\"SC-7(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Ensure no rule exists that has a port range that includes port 22 and has a\nSource of 0.0.0.0/0\n\nNote: A Port value of ALL or a port range such as 0-1024 are inclusive of port\n22.\n\"\n  tag \"fix\": \"Perform the following to implement the prescribed state:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Identify the rules to be removed\n* Click the x in the Remove column\n* Click Save\"\n\n  aws_security_groups.group_ids.each do |group_id|\n\n    describe \"Security Group not inspected because it is defined as an exception\" do\n      skip \"Security Group:: #{group_id} not insepcted because it is defined in EXCEPTION_SECURITY_GROUP_LIST.\"\n    end if EXCEPTION_SECURITY_GROUP_LIST.include?(group_id)\n\n    next if EXCEPTION_SECURITY_GROUP_LIST.include?(group_id)\n    describe aws_security_group(group_id) do\n      it { should_not allow_in(port: 22, ipv4_range: '0.0.0.0/0') }\n    end\n  end\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-4.1.rb"},"results":[{"status":"failed","code_desc":"EC2 Security Group sg-06ddca70a8ef4df8a should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>22}","run_time":0.000394,"start_time":"2018-11-18T20:21:40-05:00","message":"expected `EC2 Security Group sg-06ddca70a8ef4df8a.allow_in?({:ipv4_range=>\"0.0.0.0/0\", :port=>22})` to return false, got true"},{"status":"failed","code_desc":"EC2 Security Group sg-076d8bf7bcc63a093 should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>22}","run_time":0.000258,"start_time":"2018-11-18T20:21:40-05:00","message":"expected `EC2 Security Group sg-076d8bf7bcc63a093.allow_in?({:ipv4_range=>\"0.0.0.0/0\", :port=>22})` to return false, got true"},{"status":"failed","code_desc":"EC2 Security Group sg-094107f1c2b74147d should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>22}","run_time":0.000249,"start_time":"2018-11-18T20:21:40-05:00","message":"expected `EC2 Security Group sg-094107f1c2b74147d.allow_in?({:ipv4_range=>\"0.0.0.0/0\", :port=>22})` to return false, got true"},{"status":"passed","code_desc":"EC2 Security Group sg-732e0104 should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>22}","run_time":0.000132,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"failed","code_desc":"EC2 Security Group sg-ae3529d8 should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>22}","run_time":0.000257,"start_time":"2018-11-18T20:21:40-05:00","message":"expected `EC2 Security Group sg-ae3529d8.allow_in?({:ipv4_range=>\"0.0.0.0/0\", :port=>22})` to return false, got true"}]},{"id":"cis-aws-foundations-1.8","title":"Ensure IAM password policy require at least one number","desc":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one number.","descriptions":[{"label":"default","data":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one number."}],"impact":0.3,"refs":[],"tags":{"rationale":"Setting a password complexity policy increases account\nresiliency against brute force login attempts.","cis_impact":"","cis_rid":"1.8","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78906-5","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Require at least one number ' is checked under 'Password Policy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireNumbers': true","fix":"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Require at least one number'\n* Click 'Apply password policy'\n\n' Via CLI\n\n' aws iam update-account-password-policy --require-numbers\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.8\" do\n  title \"Ensure IAM password policy require at least one number\"\n  desc  \"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one number.\"\n  impact 0.3\n  tag \"rationale\": \"Setting a password complexity policy increases account\nresiliency against brute force login attempts.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.8\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78906-5\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Require at least one number ' is checked under 'Password Policy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireNumbers': true\"\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Require at least one number'\n* Click 'Apply password policy'\n\n' Via CLI\n\n' aws iam update-account-password-policy --require-numbers\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('require_numbers?') { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.8.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy require_numbers? should equal true","run_time":0.000191,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-3.14","title":"Ensure a log metric filter and alarm exist for VPC changes","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is possible to have more than 1 VPC within an account,\nin addition it is also possible to create a peer connection between 2 VPCs\nenabling network traffic to route between VPCs. It is recommended that a metric\nfilter and alarm be established for changes made to VPCs.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is possible to have more than 1 VPC within an account,\nin addition it is also possible to create a peer connection between 2 VPCs\nenabling network traffic to route between VPCs. It is recommended that a metric\nfilter and alarm be established for changes made to VPCs."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring changes to IAM policies will help ensure\nauthentication and authorization controls remain intact.","cis_impact":"","cis_rid":"3.14","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79199-6","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) ||\n($.eventName = ModifyVpcAttribute) || ($.eventName =\nAcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) ||\n($.eventName = DeleteVpcPeeringConnection) || ($.eventName =\nRejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) ||\n($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink)\n|| ($.eventName = EnableVpcClassicLink) }'\n5. Note the _<vpc_changes_metric>_ value associated with the filterPattern\nfound in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<unauthorized_api_calls_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<vpc_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for VPC changes and the <cloudtrail_log_group_name> taken\nfrom audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<vpc_changes_metric>_ --metric-transformations\nmetricName=_<vpc_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) ||\n($.eventName = ModifyVpcAttribute) || ($.eventName =\nAcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) ||\n($.eventName = DeleteVpcPeeringConnection) || ($.eventName =\nRejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) ||\n($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink)\n|| ($.eventName = EnableVpcClassicLink) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<vpc_changes_alarm>_\n--metric-name _<vpc_changes_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.14\" do\n  title \"Ensure a log metric filter and alarm exist for VPC changes\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is possible to have more than 1 VPC within an account,\nin addition it is also possible to create a peer connection between 2 VPCs\nenabling network traffic to route between VPCs. It is recommended that a metric\nfilter and alarm be established for changes made to VPCs.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring changes to IAM policies will help ensure\nauthentication and authorization controls remain intact.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.14\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79199-6\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) ||\n($.eventName = ModifyVpcAttribute) || ($.eventName =\nAcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) ||\n($.eventName = DeleteVpcPeeringConnection) || ($.eventName =\nRejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) ||\n($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink)\n|| ($.eventName = EnableVpcClassicLink) }'\n5. Note the _<vpc_changes_metric>_ value associated with the filterPattern\nfound in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<unauthorized_api_calls_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<vpc_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for VPC changes and the <cloudtrail_log_group_name> taken\nfrom audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<vpc_changes_metric>_ --metric-transformations\nmetricName=_<vpc_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) ||\n($.eventName = ModifyVpcAttribute) || ($.eventName =\nAcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) ||\n($.eventName = DeleteVpcPeeringConnection) || ($.eventName =\nRejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) ||\n($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink)\n|| ($.eventName = EnableVpcClassicLink) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<vpc_changes_alarm>_\n--metric-name _<vpc_changes_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.14.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000127,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":6.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":5.7e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":0.000101,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":8.6e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":8.0e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.11","title":"Ensure IAM password policy expires passwords within 90 days or less","desc":"IAM password policies can require passwords to be rotated or expired\nafter a given number of days. It is recommended that the password policy expire\npasswords after 90 days or less.","descriptions":[{"label":"default","data":"IAM password policies can require passwords to be rotated or expired\nafter a given number of days. It is recommended that the password policy expire\npasswords after 90 days or less."}],"impact":0.3,"refs":[],"tags":{"rationale":"Reducing the password lifetime increases account resiliency\nagainst brute force login attempts. Additionally, requiring regular password\nchanges help in the following scenarios:\n\n* Passwords can be stolen or compromised sometimes without your knowledge. This\ncan happen via a system compromise, software vulnerability, or internal threat.\n\n\n* Certain corporate and government web filters or proxy servers have the\nability to intercept and record traffic even if it's encrypted.\n* Many people use the same password for many systems such as work, email, and\npersonal.\n* Compromised end user workstations might have a keystroke logger.","cis_impact":"","cis_rid":"1.11","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78909-9","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console:\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Enable password expiration' is checked\n* Ensure 'Password expiration period (in days):' is set to 90 or less\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'MaxPasswordAge': 90 or less","fix":"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console:\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Enable password expiration'\n* Set 'Password expiration period (in days):' to 90 or less\n\n' Via CLI\n\n' aws iam update-account-password-policy --max-password-age 90\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.11\" do\n  title \"Ensure IAM password policy expires passwords within #{AWS_CRED_AGE} days or less\"\n  desc  \"IAM password policies can require passwords to be rotated or expired\nafter a given number of days. It is recommended that the password policy expire\npasswords after #{AWS_CRED_AGE} days or less.\"\n  impact 0.3\n  tag \"rationale\": \"Reducing the password lifetime increases account resiliency\nagainst brute force login attempts. Additionally, requiring regular password\nchanges help in the following scenarios:\n\n* Passwords can be stolen or compromised sometimes without your knowledge. This\ncan happen via a system compromise, software vulnerability, or internal threat.\n\n\n* Certain corporate and government web filters or proxy servers have the\nability to intercept and record traffic even if it's encrypted.\n* Many people use the same password for many systems such as work, email, and\npersonal.\n* Compromised end user workstations might have a keystroke logger.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.11\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78909-9\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console:\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Enable password expiration' is checked\n* Ensure 'Password expiration period (in days):' is set to #{AWS_CRED_AGE} or less\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'MaxPasswordAge': #{AWS_CRED_AGE} or less\"\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console:\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Enable password expiration'\n* Set 'Password expiration period (in days):' to #{AWS_CRED_AGE} or less\n\n' Via CLI\n\n' aws iam update-account-password-policy --max-password-age #{AWS_CRED_AGE}\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('expire_passwords?') { should be true }\n    its('max_password_age_in_days') { should cmp <= AWS_CRED_AGE }\n  end\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-1.11.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy expire_passwords? should equal true","run_time":9.8e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM Password-Policy max_password_age_in_days should cmp <= 90","run_time":0.000156,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.9","title":"Ensure IAM password policy requires minimum length of 14 or greater","desc":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are at least\na given length. It is recommended that the password policy require a minimum\npassword length 14.","descriptions":[{"label":"default","data":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are at least\na given length. It is recommended that the password policy require a minimum\npassword length 14."}],"impact":0.3,"refs":[],"tags":{"rationale":"Setting a password complexity policy increases account\nresiliency against brute force login attempts.","cis_impact":"","cis_rid":"1.9","cis_level":1,"csc_control":[["5.7","16.12"],"6.0"],"nist":["IA-5(1)","IA-2","Rev_4"],"cce_id":"CCE-78907-3","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Minimum password length' is set to 14 or greater.\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'MinimumPasswordLength': 14 (or\nhigher)","fix":"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Set 'Minimum password length' to 14 or greater.\n* Click 'Apply password policy'\n\n' Via CLI\n\n' aws iam update-account-password-policy --minimum-password-length 14\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.9\" do\n  title \"Ensure IAM password policy requires minimum length of #{PWD_LENGTH} or greater\"\n  desc  \"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are at least\na given length. It is recommended that the password policy require a minimum\npassword length #{PWD_LENGTH}.\"\n  impact 0.3\n  tag \"rationale\": \"Setting a password complexity policy increases account\nresiliency against brute force login attempts.\"\n  tag \"cis_impact\": ''\n  tag \"cis_rid\": \"1.9\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"5.7\", \"16.12\"], \"6.0\"]\n  tag \"nist\": [\"IA-5(1)\",\"IA-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78907-3\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Minimum password length' is set to #{PWD_LENGTH} or greater.\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'MinimumPasswordLength': #{PWD_LENGTH} (or\nhigher)\"\n\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Set 'Minimum password length' to #{PWD_LENGTH} or greater.\n* Click 'Apply password policy'\n\n' Via CLI\n\n' aws iam update-account-password-policy --minimum-password-length #{PWD_LENGTH}\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('minimum_password_length') { should cmp >= PWD_LENGTH }\n  end\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-1.9.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy minimum_password_length should cmp >= 14","run_time":0.000143,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-3.15","title":"Ensure appropriate subscribers to each SNS topic","desc":"AWS Simple Notification Service (SNS) is a web service that can\npublish messages from an application and immediately deliver them to\nsubscribers or other applications. Subscribers are clients interested in\nreceiving notifications from topics of interest; they can subscribe to a topic\nor be subscribed by the topic owner. When publishers have information or\nupdates to notify their subscribers about, they can publish a message to the\ntopic - which immediately triggers Amazon SNS to deliver the message to all\napplicable subscribers. It is recommended that the list of subscribers to given\ntopics be periodically reviewed for appropriateness.","descriptions":[{"label":"default","data":"AWS Simple Notification Service (SNS) is a web service that can\npublish messages from an application and immediately deliver them to\nsubscribers or other applications. Subscribers are clients interested in\nreceiving notifications from topics of interest; they can subscribe to a topic\nor be subscribed by the topic owner. When publishers have information or\nupdates to notify their subscribers about, they can publish a message to the\ntopic - which immediately triggers Amazon SNS to deliver the message to all\napplicable subscribers. It is recommended that the list of subscribers to given\ntopics be periodically reviewed for appropriateness."}],"impact":0.3,"refs":[],"tags":{"rationale":"Reviewing subscriber topics will help ensure that only\nexpected recipients receive information published to SNS topics.","cis_impact":"","cis_rid":"3.15","cis_level":1,"csc_control":"","nist":["AC-6","Rev_4"],"cce_id":"","check":"Perform the following to ensure appropriate subscribers:\n\n'Via the AWS Management console:\n\n 'Sign in to the AWS Management Console and open the SNS console at\nhttps://console.aws.amazon.com/sns/ [https://console.aws.amazon.com/sns/]\n* Click on Topics in the left navigation pane\n\n* Evaluate Topics by clicking on the value within the ARN column\n\n* Within a selected Topic evaluate:\n\n* Topic owner\n* Region\n\n* Within the Subscriptions_ _section evaluate:\n\n* _Subscription ID_\n* _Protocol_\n* _Endpoint_\n* _Subscriber_ (Account ID)\n\n'Via CLI:\n\n'aws sns list-topics\naws sns list-subscriptions-by-topic --topic-arn _<topic_arn>_","fix":"Perform the following to remove undesired subscriptions:\n\n'Via Management Console\n\n 'Sign in to the AWS Management Console and open the SNS console at\nhttps://console.aws.amazon.com/sns/ [https://console.aws.amazon.com/sns/]\n* Click on Subscriptions in the left navigation pane\n* For any undesired subscription, select the corresponding checkboxes\n* Click Actions\n* Click Delete Subscriptions"},"code":"control \"cis-aws-foundations-3.15\" do\n  title \"Ensure appropriate subscribers to each SNS topic\"\n  desc  \"AWS Simple Notification Service (SNS) is a web service that can\npublish messages from an application and immediately deliver them to\nsubscribers or other applications. Subscribers are clients interested in\nreceiving notifications from topics of interest; they can subscribe to a topic\nor be subscribed by the topic owner. When publishers have information or\nupdates to notify their subscribers about, they can publish a message to the\ntopic - which immediately triggers Amazon SNS to deliver the message to all\napplicable subscribers. It is recommended that the list of subscribers to given\ntopics be periodically reviewed for appropriateness.\"\n  impact 0.3\n  tag \"rationale\": \"Reviewing subscriber topics will help ensure that only\nexpected recipients receive information published to SNS topics.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.15\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AC-6\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Perform the following to ensure appropriate subscribers:\n\n'Via the AWS Management console:\n\n 'Sign in to the AWS Management Console and open the SNS console at\nhttps://console.aws.amazon.com/sns/ [https://console.aws.amazon.com/sns/]\n* Click on Topics in the left navigation pane\n\n* Evaluate Topics by clicking on the value within the ARN column\n\n* Within a selected Topic evaluate:\n\n* Topic owner\n* Region\n\n* Within the Subscriptions_ _section evaluate:\n\n* _Subscription ID_\n* _Protocol_\n* _Endpoint_\n* _Subscriber_ (Account ID)\n\n'Via CLI:\n\n'aws sns list-topics\naws sns list-subscriptions-by-topic --topic-arn _<topic_arn>_\"\n  tag \"fix\": \"Perform the following to remove undesired subscriptions:\n\n'Via Management Console\n\n 'Sign in to the AWS Management Console and open the SNS console at\nhttps://console.aws.amazon.com/sns/ [https://console.aws.amazon.com/sns/]\n* Click on Subscriptions in the left navigation pane\n* For any undesired subscription, select the corresponding checkboxes\n* Click Actions\n* Click Delete Subscriptions\"\n\n  SNS_TOPICS = attribute('sns_topics')\n  SNS_SUBSCRIPTIONS = attribute('sns_subscriptions')\n\n  attribute('aws_regions').each do |region|\n    ENV['AWS_REGION'] = region\n\n    aws_sns_topics.topic_arns.each do |topic|\n      describe aws_sns_topic(topic) do\n        its('owner') { should cmp SNS_TOPICS[topic]['owner'] } #verify with attributes\n        its('region') { should cmp SNS_TOPICS[topic]['region'] } #verify with attributes\n      end\n      aws_sns_topic(topic).subscriptions.each do |subscription|\n        describe aws_sns_subscription(subscription) do\n          its('arn') { should_not eq 'PendingConfirmation' }\n        end\n        describe aws_sns_subscription(subscription) do\n          its('endpoint') { should cmp SNS_SUBSCRIPTIONS[subscription]['endpoint'] } #verify with attributes\n          its('protocol') { should cmp SNS_SUBSCRIPTIONS[subscription]['protocol'] } #verify with attributes\n          its('owner') { should cmp SNS_SUBSCRIPTIONS[subscription]['owner'] } #verify with attributes\n        end unless aws_sns_subscription(subscription).arn.eql?(\"PendingConfirmation\")\n      end\n      describe \"SNS Subscriptions where not found for the Topic\" do\n        skip \"No SNS Subscriptions where found for the SNS Topic #{topic}\"\n      end if aws_sns_topic(topic).subscriptions.empty?\n    end\n    describe \"SNS Topics where not found in this region\" do\n      skip \"No SNS Topics where found for the region #{region}\"\n    end if aws_sns_topics.topic_arns.empty?\n  end\n  # reset to default region\n  ENV['AWS_REGION'] = attribute('default_aws_region')\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.15.rb"},"results":[{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-config-sns owner should cmp == \"484747447281\"","run_time":0.000164,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-config-sns region should cmp == \"us-east-1\"","run_time":0.000133,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-config-sns:4bafcf37-b7cf-4085-95d5-acb348373cf0 arn should not eq \"PendingConfirmation\"","run_time":0.001629,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-config-sns:4bafcf37-b7cf-4085-95d5-acb348373cf0 endpoint should cmp == \"arn:aws:sqs:us-east-1:484747447281:cis-config-sqs\"","run_time":0.000163,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-config-sns:4bafcf37-b7cf-4085-95d5-acb348373cf0 protocol should cmp == \"sqs\"","run_time":0.000155,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-config-sns:4bafcf37-b7cf-4085-95d5-acb348373cf0 owner should cmp == \"484747447281\"","run_time":0.000134,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns owner should cmp == \"484747447281\"","run_time":0.000157,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns region should cmp == \"us-east-1\"","run_time":0.000145,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-metric-sns:83ae1001-3792-447e-af85-e69fffab7cdf arn should not eq \"PendingConfirmation\"","run_time":7.6e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-metric-sns:83ae1001-3792-447e-af85-e69fffab7cdf endpoint should cmp == \"arn:aws:sqs:us-east-1:484747447281:cis-sqs-metric-sns\"","run_time":0.000135,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-metric-sns:83ae1001-3792-447e-af85-e69fffab7cdf protocol should cmp == \"sqs\"","run_time":0.000147,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-1:484747447281:cis-metric-sns:83ae1001-3792-447e-af85-e69fffab7cdf owner should cmp == \"484747447281\"","run_time":0.000128,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-2:484747447281:cis-config-sns owner should cmp == \"484747447281\"","run_time":0.000149,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-2:484747447281:cis-config-sns region should cmp == \"us-east-2\"","run_time":0.000137,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-2:484747447281:cis-config-sns:2bb1056e-dabc-4da8-bcc1-79db2151ec40 arn should not eq \"PendingConfirmation\"","run_time":9.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-2:484747447281:cis-config-sns:2bb1056e-dabc-4da8-bcc1-79db2151ec40 endpoint should cmp == \"arn:aws:sqs:us-east-2:484747447281:cis-config-sqs\"","run_time":0.000157,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-2:484747447281:cis-config-sns:2bb1056e-dabc-4da8-bcc1-79db2151ec40 protocol should cmp == \"sqs\"","run_time":0.000149,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-east-2:484747447281:cis-config-sns:2bb1056e-dabc-4da8-bcc1-79db2151ec40 owner should cmp == \"484747447281\"","run_time":0.00015,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-west-1:484747447281:cis-config-sns owner should cmp == \"484747447281\"","run_time":0.00016,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-west-1:484747447281:cis-config-sns region should cmp == \"us-west-1\"","run_time":0.000144,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-1:484747447281:cis-config-sns:a6691e64-43eb-4e0e-9784-486c87db07f8 arn should not eq \"PendingConfirmation\"","run_time":8.2e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-1:484747447281:cis-config-sns:a6691e64-43eb-4e0e-9784-486c87db07f8 endpoint should cmp == \"arn:aws:sqs:us-west-1:484747447281:cis-config-sqs\"","run_time":0.000148,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-1:484747447281:cis-config-sns:a6691e64-43eb-4e0e-9784-486c87db07f8 protocol should cmp == \"sqs\"","run_time":0.000141,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-1:484747447281:cis-config-sns:a6691e64-43eb-4e0e-9784-486c87db07f8 owner should cmp == \"484747447281\"","run_time":0.00016,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-west-2:484747447281:cis-config-sns owner should cmp == \"484747447281\"","run_time":0.000129,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-west-2:484747447281:cis-config-sns region should cmp == \"us-west-2\"","run_time":0.000125,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-2:484747447281:cis-config-sns:aaf151dc-e860-4b20-b4ea-a47dbded8460 arn should not eq \"PendingConfirmation\"","run_time":8.8e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-2:484747447281:cis-config-sns:aaf151dc-e860-4b20-b4ea-a47dbded8460 endpoint should cmp == \"arn:aws:sqs:us-west-2:484747447281:cis-config-sqs\"","run_time":0.000138,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-2:484747447281:cis-config-sns:aaf151dc-e860-4b20-b4ea-a47dbded8460 protocol should cmp == \"sqs\"","run_time":0.000148,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Subscription arn:aws:sns:us-west-2:484747447281:cis-config-sns:aaf151dc-e860-4b20-b4ea-a47dbded8460 owner should cmp == \"484747447281\"","run_time":0.000125,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.15","title":"Ensure security questions are registered in the AWS account","desc":"The AWS support portal allows account owners to establish security\nquestions that can be used to authenticate individuals calling AWS customer\nservice for support. It is recommended that security questions be established.","descriptions":[{"label":"default","data":"The AWS support portal allows account owners to establish security\nquestions that can be used to authenticate individuals calling AWS customer\nservice for support. It is recommended that security questions be established."}],"impact":0.3,"refs":[],"tags":{"rationale":"When creating a new AWS account, a default super user is\nautomatically created. This account is referred to as the 'root' account. It is\nrecommended that the use of this account be limited and highly controlled.\nDuring events in which the Root password is no longer accessible or the MFA\ntoken associated with root is lost/destroyed it is possible, through\nauthentication using secret questions and associated answers, to recover root\nlogin access.","cis_impact":"","cis_rid":"1.15","cis_level":1,"cis_control_number":"","nist":["IA-2","Rev_4"],"cce_id":"","check":"Perform the following in the AWS Management Console:\n\n* Login to the AWS account as root\n* On the top right you will see the _<Root_Account_Name>_\n* Click on the _<Root_Account_Name>_\n* From the drop-down menu Click My Account\n* In the Configure Security Challenge Questions section on the Personal\nInformation page, configure three security challenge questions.\n* Click Save questions.","fix":"Perform the following in the AWS Management Console:\n\n* Login to the AWS Account as root\n* Click on the _<Root_Account_Name>_ from the top right of the console\n* From the drop-down menu Click _My Account_\n* Scroll down to the Configure Security Questions section\n* Click on Edit\n\n* Click on each Question\n\n* From the drop-down select an appropriate question\n* Click on the Answer section\n\n* Enter an appropriate answer\n\n* Follow process for all 3 questions\n\n\n* Click Update when complete\n* Place Questions and Answers and place in a secure physical location"},"code":"control \"cis-aws-foundations-1.15\" do\n  title \"Ensure security questions are registered in the AWS account\"\n  desc  \"The AWS support portal allows account owners to establish security\nquestions that can be used to authenticate individuals calling AWS customer\nservice for support. It is recommended that security questions be established.\"\n  impact 0.3\n  tag \"rationale\": \"When creating a new AWS account, a default super user is\nautomatically created. This account is referred to as the 'root' account. It is\nrecommended that the use of this account be limited and highly controlled.\nDuring events in which the Root password is no longer accessible or the MFA\ntoken associated with root is lost/destroyed it is possible, through\nauthentication using secret questions and associated answers, to recover root\nlogin access.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.15\"\n  tag \"cis_level\": 1\n  tag \"cis_control_number\": \"\"\n  tag \"nist\": [\"IA-2\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Perform the following in the AWS Management Console:\n\n* Login to the AWS account as root\n* On the top right you will see the _<Root_Account_Name>_\n* Click on the _<Root_Account_Name>_\n* From the drop-down menu Click My Account\n* In the Configure Security Challenge Questions section on the Personal\nInformation page, configure three security challenge questions.\n* Click Save questions.\"\n  tag \"fix\": \"Perform the following in the AWS Management Console:\n\n* Login to the AWS Account as root\n* Click on the _<Root_Account_Name>_ from the top right of the console\n* From the drop-down menu Click _My Account_\n* Scroll down to the Configure Security Questions section\n* Click on Edit\n\n* Click on each Question\n\n* From the drop-down select an appropriate question\n* Click on the Answer section\n\n* Enter an appropriate answer\n\n* Follow process for all 3 questions\n\n\n* Click Update when complete\n* Place Questions and Answers and place in a secure physical location\"\n\n  describe \"Control has to be tested manually\" do\n    skip \"This control must be manually reviewed\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.15.rb"},"results":[{"status":"skipped","code_desc":"Control has to be tested manually","run_time":6.0e-06,"start_time":"2018-11-18T20:21:40-05:00","resource":"","skip_message":"This control must be manually reviewed"}]},{"id":"cis-aws-foundations-4.4","title":"Ensure the default security group of every VPC restricts all traffic","desc":"A VPC comes with a default security group whose initial settings deny\nall inbound traffic, allow all outbound traffic, and allow all traffic between\ninstances assigned to the security group. If you don't specify a security group\nwhen you launch an instance, the instance is automatically assigned to this\ndefault security group. Security groups provide stateful filtering of\ningress/egress network traffic to AWS resources. It is recommended that the\ndefault security group restrict all traffic.\n\n'The default VPC in every region should have it's default security group\nupdated to comply. Any newly created VPCs will automatically contain a default\nsecurity group that will need remediation to comply with this recommendation.\n\n'NOTE: When implementing this recommendation, VPC flow logging is invaluable in\ndetermining the least privilege port access required by systems to work\nproperly because it can log all packet acceptances and rejections occurring\nunder the current security groups. This dramatically reduces the primary\nbarrier to least privilege engineering - discovering the minimum ports required\nby systems in the environment. Even if the VPC flow logging recommendation in\nthis benchmark is not adopted as a permanent security measure, it should be\nused during any period of discovery and engineering for least privileged\nsecurity groups.","descriptions":[{"label":"default","data":"A VPC comes with a default security group whose initial settings deny\nall inbound traffic, allow all outbound traffic, and allow all traffic between\ninstances assigned to the security group. If you don't specify a security group\nwhen you launch an instance, the instance is automatically assigned to this\ndefault security group. Security groups provide stateful filtering of\ningress/egress network traffic to AWS resources. It is recommended that the\ndefault security group restrict all traffic.\n\n'The default VPC in every region should have it's default security group\nupdated to comply. Any newly created VPCs will automatically contain a default\nsecurity group that will need remediation to comply with this recommendation.\n\n'NOTE: When implementing this recommendation, VPC flow logging is invaluable in\ndetermining the least privilege port access required by systems to work\nproperly because it can log all packet acceptances and rejections occurring\nunder the current security groups. This dramatically reduces the primary\nbarrier to least privilege engineering - discovering the minimum ports required\nby systems in the environment. Even if the VPC flow logging recommendation in\nthis benchmark is not adopted as a permanent security measure, it should be\nused during any period of discovery and engineering for least privileged\nsecurity groups."}],"impact":0.7,"refs":[],"tags":{"rationale":"Configuring all VPC default security groups to restrict all\ntraffic will encourage least privilege security group development and mindful\nplacement of AWS resources into security groups which will in-turn reduce the\nexposure of those resources.","cis_impact":"Implementing this recommendation in an existing VPC\ncontaining operating resources requires extremely careful migration planning as\nthe default security groups are likely to be enabling many ports that are\nunknown. Enabling VPC flow logging (of accepts) in an existing environment that\nis know to be breach free will reveal the current pattern of ports being used\nfor each instance to communicate successfully.","cis_rid":"4.4","cis_level":2,"csc_control":[["9.2"],"6.0"],"nist":["SC-7(5)","Rev_4"],"cce_id":"CCE-79201-0","check":"Perform the following to determine if the account is configured\nas prescribed:\n\n'Security Group State\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* Repeat the next steps for all VPCs - including the default VPC in each AWS\nregion:\n* In the left pane, click Security Groups\n* For each default security group, perform the following:\n\n* Select the default security group\n* Click the Inbound Rules tab\n* Ensure no rule exist\n* Click the Outbound Rules tab\n* Ensure no rules exist\n\n'Security Group Members\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* Repeat the next steps for all default groups in all VPCs - including the\ndefault VPC in each AWS region:\n* In the left pane, click Security Groups\n* Copy the id of the default security group.\n* Change to the EC2 Management Console at\nhttps://console.aws.amazon.com/ec2/v2/home\n* In the filter column type 'Security Group ID : <security group id from #4>'","fix":"Security Group Members\n\n'Perform the following to implement the prescribed state:\n\n* Identify AWS resources that exist within the default security group\n* Create a set of least privilege security groups for those resources\n* Place the resources in those security groups\n* Remove the resources noted in #1 from the default security group\n\n'Security Group State\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* Repeat the next steps for all VPCs - including the default VPC in each AWS\nregion:\n* In the left pane, click Security Groups\n* For each default security group, perform the following:\n\n* Select the default security group\n* Click the Inbound Rules tab\n* Remove any inbound rules\n* Click the Outbound Rules tab\n* Remove any inbound rules\n\n'Recommended:\n\n'IAM groups allow you to edit the 'name' field. After remediating default\ngroups rules for all VPCs in all regions, edit this field to add text similar\nto 'DO NOT USE. DO NOT ADD RULES'"},"code":"control \"cis-aws-foundations-4.4\" do\n  title \"Ensure the default security group of every VPC restricts all traffic\"\n  desc  \"A VPC comes with a default security group whose initial settings deny\nall inbound traffic, allow all outbound traffic, and allow all traffic between\ninstances assigned to the security group. If you don't specify a security group\nwhen you launch an instance, the instance is automatically assigned to this\ndefault security group. Security groups provide stateful filtering of\ningress/egress network traffic to AWS resources. It is recommended that the\ndefault security group restrict all traffic.\n\n'The default VPC in every region should have it's default security group\nupdated to comply. Any newly created VPCs will automatically contain a default\nsecurity group that will need remediation to comply with this recommendation.\n\n'NOTE: When implementing this recommendation, VPC flow logging is invaluable in\ndetermining the least privilege port access required by systems to work\nproperly because it can log all packet acceptances and rejections occurring\nunder the current security groups. This dramatically reduces the primary\nbarrier to least privilege engineering - discovering the minimum ports required\nby systems in the environment. Even if the VPC flow logging recommendation in\nthis benchmark is not adopted as a permanent security measure, it should be\nused during any period of discovery and engineering for least privileged\nsecurity groups.\"\n  impact 0.7\n  tag \"rationale\": \"Configuring all VPC default security groups to restrict all\ntraffic will encourage least privilege security group development and mindful\nplacement of AWS resources into security groups which will in-turn reduce the\nexposure of those resources.\"\n  tag \"cis_impact\": \"Implementing this recommendation in an existing VPC\ncontaining operating resources requires extremely careful migration planning as\nthe default security groups are likely to be enabling many ports that are\nunknown. Enabling VPC flow logging (of accepts) in an existing environment that\nis know to be breach free will reveal the current pattern of ports being used\nfor each instance to communicate successfully.\"\n  tag \"cis_rid\": \"4.4\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": [[\"9.2\"], \"6.0\"]\n  tag \"nist\": [\"SC-7(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79201-0\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed:\n\n'Security Group State\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* Repeat the next steps for all VPCs - including the default VPC in each AWS\nregion:\n* In the left pane, click Security Groups\n* For each default security group, perform the following:\n\n* Select the default security group\n* Click the Inbound Rules tab\n* Ensure no rule exist\n* Click the Outbound Rules tab\n* Ensure no rules exist\n\n'Security Group Members\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* Repeat the next steps for all default groups in all VPCs - including the\ndefault VPC in each AWS region:\n* In the left pane, click Security Groups\n* Copy the id of the default security group.\n* Change to the EC2 Management Console at\nhttps://console.aws.amazon.com/ec2/v2/home\n* In the filter column type 'Security Group ID : <security group id from #4>'\"\n  tag \"fix\": \"Security Group Members\n\n'Perform the following to implement the prescribed state:\n\n* Identify AWS resources that exist within the default security group\n* Create a set of least privilege security groups for those resources\n* Place the resources in those security groups\n* Remove the resources noted in #1 from the default security group\n\n'Security Group State\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* Repeat the next steps for all VPCs - including the default VPC in each AWS\nregion:\n* In the left pane, click Security Groups\n* For each default security group, perform the following:\n\n* Select the default security group\n* Click the Inbound Rules tab\n* Remove any inbound rules\n* Click the Outbound Rules tab\n* Remove any inbound rules\n\n'Recommended:\n\n'IAM groups allow you to edit the 'name' field. After remediating default\ngroups rules for all VPCs in all regions, edit this field to add text similar\nto 'DO NOT USE. DO NOT ADD RULES'\"\n\n  aws_vpcs.vpc_ids.each do |vpc|\n    describe aws_security_group(group_name: 'default', vpc_id: vpc) do\n      its('inbound_rules') { should be_empty }\n      its('outbound_rules') { should be_empty }\n    end\n  end\n  describe \"Control skipped because no vpcs were found\" do\n    skip \"This control is skipped since the aws_vpcs resource returned an empty vpc list\"\n  end if aws_vpcs.vpc_ids.empty?\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-4.4.rb"},"results":[{"status":"passed","code_desc":"EC2 Security Group sg-732e0104 inbound_rules should be empty","run_time":9.4e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"EC2 Security Group sg-732e0104 outbound_rules should be empty","run_time":7.2e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.21","title":"Ensure IAM instance roles are used for AWS resource access from\ninstances","desc":"AWS access from within AWS instances can be done by either encoding\nAWS keys into AWS API calls or by assigning the instance to a role which has an\nappropriate permissions policy for the required access. 'AWS Access' means\naccessing the APIs of AWS in order to access AWS resources or manage AWS\naccount resources.","descriptions":[{"label":"default","data":"AWS access from within AWS instances can be done by either encoding\nAWS keys into AWS API calls or by assigning the instance to a role which has an\nappropriate permissions policy for the required access. 'AWS Access' means\naccessing the APIs of AWS in order to access AWS resources or manage AWS\naccount resources."}],"impact":0.7,"refs":[],"tags":{"rationale":"AWS IAM roles reduce the risks associated with sharing and\nrotating credentials that can be used outside of AWS itself. If credentials are\ncompromised, they can be used from outside of the the AWS account they give\naccess to. In contrast, in order to leverage role permissions an attacker would\nneed to gain and maintain access to a specific instance to use the privileges\nassociated with it.\n\n'Additionally, if credentials are encoded into compiled applications or other\nhard to change mechanisms, then they are even more unlikely to be properly\nrotated due to service disruption risks. As time goes on, credentials that\ncannot be rotated are more likely to be known by an increasing number of\nindividuals who no longer work for the organization owning the credentials.","cis_impact":"","cis_rid":"1.21","cis_level":2,"csc_control":[["16.14"],"6.0"],"nist":["SC-28","Rev_4"],"cce_id":"","check":"Whether an Instance Is Associated With a Role\n\n'For instances that are known to perform AWS actions, ensure that they belong\nto an instance role that has the necessary permissions:\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Open the EC2 Dashboard and choose 'Instances'\n* Click the EC2 instance that performs AWS actions, in the lower pane details\nfind 'IAM Role'\n* If the Role is blank, the instance is not assigned to one.\n* If the Role is filled in, it does not mean the instance might not *also* have\ncredentials encoded on it for some activities.\n\n'Whether an Instance Contains Embedded Credentials\n\n'On the instance that is known to perform AWS actions, audit all scripts and\nenvironment variables to ensure that none of them contain AWS credentials.\n\n'Whether an Instance Application Contains Embedded Credentials\n\n'Applications that run on an instance may also have credentials embedded. This\nis a bad practice, but even worse if the source code is stored in a public code\nrepository such as github. When an application contains credentials can be\ndetermined by eliminating all other sources of credentials and if the\napplication can still access AWS resources - it likely contains embedded\ncredentials. Another method is to examine all source code and configuration\nfiles of the application.","fix":"IAM roles can only be associated at the launch of an instance. To\nremediate an instance to add it to a role you must create a new instance.\n\n'If the instance has no external dependencies on it's current private ip or\npublic addresses are elastic IPs:\n\n* In AWS IAM create a new role. Assign a permissions policy if needed\npermissions are already known.\n* In the AWS console launch a new instance with identical settings to the\nexisting instance, and ensure that the newly created role is selected.\n* Shutdown both the existing instance and the new instance.\n* Detach disks from both instances.\n* Attach the existing instance disks to the new instance.\n* Boot the new instance and you should have the same machine, but with the\nassociated role.\n\n'Note: if your environment has dependencies on a dynamically assigned PRIVATE\nIP address you can create an AMI from the existing instance, destroy the old\none and then when launching from the AMI, manually assign the previous private\nIP address.\n\n'Note: if your environment has dependencies on a dynamically assigned PUBLIC IP\naddress there is not a way ensure the address is retained and assign an\ninstance role. Dependencies on dynamically assigned public IP addresses are a\nbad practice and, if possible, you may wish to rebuild the instance with a new\nelastic IP address and make the investment to remediate affected systems while\nassigning the system to a role."},"code":"control \"cis-aws-foundations-1.21\" do\n  title \"Ensure IAM instance roles are used for AWS resource access from\ninstances\"\n  desc  \"AWS access from within AWS instances can be done by either encoding\nAWS keys into AWS API calls or by assigning the instance to a role which has an\nappropriate permissions policy for the required access. 'AWS Access' means\naccessing the APIs of AWS in order to access AWS resources or manage AWS\naccount resources.\"\n  impact 0.7\n  tag \"rationale\": \"AWS IAM roles reduce the risks associated with sharing and\nrotating credentials that can be used outside of AWS itself. If credentials are\ncompromised, they can be used from outside of the the AWS account they give\naccess to. In contrast, in order to leverage role permissions an attacker would\nneed to gain and maintain access to a specific instance to use the privileges\nassociated with it.\n\n'Additionally, if credentials are encoded into compiled applications or other\nhard to change mechanisms, then they are even more unlikely to be properly\nrotated due to service disruption risks. As time goes on, credentials that\ncannot be rotated are more likely to be known by an increasing number of\nindividuals who no longer work for the organization owning the credentials.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.21\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": [[\"16.14\"], \"6.0\"]\n  tag \"nist\": [\"SC-28\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Whether an Instance Is Associated With a Role\n\n'For instances that are known to perform AWS actions, ensure that they belong\nto an instance role that has the necessary permissions:\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Open the EC2 Dashboard and choose 'Instances'\n* Click the EC2 instance that performs AWS actions, in the lower pane details\nfind 'IAM Role'\n* If the Role is blank, the instance is not assigned to one.\n* If the Role is filled in, it does not mean the instance might not *also* have\ncredentials encoded on it for some activities.\n\n'Whether an Instance Contains Embedded Credentials\n\n'On the instance that is known to perform AWS actions, audit all scripts and\nenvironment variables to ensure that none of them contain AWS credentials.\n\n'Whether an Instance Application Contains Embedded Credentials\n\n'Applications that run on an instance may also have credentials embedded. This\nis a bad practice, but even worse if the source code is stored in a public code\nrepository such as github. When an application contains credentials can be\ndetermined by eliminating all other sources of credentials and if the\napplication can still access AWS resources - it likely contains embedded\ncredentials. Another method is to examine all source code and configuration\nfiles of the application.\"\n  tag \"fix\": \"IAM roles can only be associated at the launch of an instance. To\nremediate an instance to add it to a role you must create a new instance.\n\n'If the instance has no external dependencies on it's current private ip or\npublic addresses are elastic IPs:\n\n* In AWS IAM create a new role. Assign a permissions policy if needed\npermissions are already known.\n* In the AWS console launch a new instance with identical settings to the\nexisting instance, and ensure that the newly created role is selected.\n* Shutdown both the existing instance and the new instance.\n* Detach disks from both instances.\n* Attach the existing instance disks to the new instance.\n* Boot the new instance and you should have the same machine, but with the\nassociated role.\n\n'Note: if your environment has dependencies on a dynamically assigned PRIVATE\nIP address you can create an AMI from the existing instance, destroy the old\none and then when launching from the AMI, manually assign the previous private\nIP address.\n\n'Note: if your environment has dependencies on a dynamically assigned PUBLIC IP\naddress there is not a way ensure the address is retained and assign an\ninstance role. Dependencies on dynamically assigned public IP addresses are a\nbad practice and, if possible, you may wish to rebuild the instance with a new\nelastic IP address and make the investment to remediate affected systems while\nassigning the system to a role.\"\n\n  describe \"Control has to be tested manually\" do\n    skip \"This control must be manually reviewed\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.21.rb"},"results":[{"status":"skipped","code_desc":"Control has to be tested manually","run_time":4.0e-06,"start_time":"2018-11-18T20:21:40-05:00","resource":"","skip_message":"This control must be manually reviewed"}]},{"id":"cis-aws-foundations-3.11","title":"Ensure a log metric filter and alarm exist for changes to Network\nAccess Control Lists (NACL)","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. NACLs are used as a stateless packet filter to control\ningress and egress traffic for subnets within a VPC. It is recommended that a\nmetric filter and alarm be established for changes made to NACLs.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. NACLs are used as a stateless packet filter to control\ningress and egress traffic for subnets within a VPC. It is recommended that a\nmetric filter and alarm be established for changes made to NACLs."}],"impact":0.7,"refs":[],"tags":{"rationale":"Monitoring changes to NACLs will help ensure that AWS\nresources and services are not unintentionally exposed.","cis_impact":"","cis_rid":"3.11","cis_level":2,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79196-2","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateNetworkAcl) || ($.eventName =\nCreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =\nDeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) ||\n($.eventName = ReplaceNetworkAclAssociation) }'\n5. Note the _<nacl_changes_metric>_ value associated with the filterPattern\nfound in step 4.\n6. Get a list of CloudWatch alarms and filter on the _<nacl_changes_metric>_\ncaptured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<nacl_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for NACL changes and the <cloudtrail_log_group_name>\ntaken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<nacl_changes_metric>_ --metric-transformations\nmetricName=_<nacl_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateNetworkAcl) || ($.eventName =\nCreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =\nDeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) ||\n($.eventName = ReplaceNetworkAclAssociation) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<nacl_changes_alarm>_\n--metric-name _<nacl_changes_metric>_ --statistic Sum --period 300 --threshold\n1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.11\" do\n  title \"Ensure a log metric filter and alarm exist for changes to Network\nAccess Control Lists (NACL)\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. NACLs are used as a stateless packet filter to control\ningress and egress traffic for subnets within a VPC. It is recommended that a\nmetric filter and alarm be established for changes made to NACLs.\"\n  impact 0.7\n  tag \"rationale\": \"Monitoring changes to NACLs will help ensure that AWS\nresources and services are not unintentionally exposed.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.11\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79196-2\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateNetworkAcl) || ($.eventName =\nCreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =\nDeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) ||\n($.eventName = ReplaceNetworkAclAssociation) }'\n5. Note the _<nacl_changes_metric>_ value associated with the filterPattern\nfound in step 4.\n6. Get a list of CloudWatch alarms and filter on the _<nacl_changes_metric>_\ncaptured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<nacl_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for NACL changes and the <cloudtrail_log_group_name>\ntaken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<nacl_changes_metric>_ --metric-transformations\nmetricName=_<nacl_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateNetworkAcl) || ($.eventName =\nCreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =\nDeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) ||\n($.eventName = ReplaceNetworkAclAssociation) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<nacl_changes_alarm>_\n--metric-name _<nacl_changes_metric>_ --statistic Sum --period 300 --threshold\n1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist}\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.11.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":9.3e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":5.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":5.3e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":6.6e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":5.3e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":6.7e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-4.3","title":"Ensure VPC flow logging is enabled in all VPCs","desc":"VPC Flow Logs is a feature that enables you to capture information\nabout the IP traffic going to and from network interfaces in your VPC. After\nyou've created a flow log, you can view and retrieve its data in Amazon\nCloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet\n'Rejects' for VPCs.","descriptions":[{"label":"default","data":"VPC Flow Logs is a feature that enables you to capture information\nabout the IP traffic going to and from network interfaces in your VPC. After\nyou've created a flow log, you can view and retrieve its data in Amazon\nCloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet\n'Rejects' for VPCs."}],"impact":0.7,"refs":[],"tags":{"rationale":"VPC Flow Logs provide visibility into network traffic that\ntraverses the VPC and can be used to detect anomalous traffic or insight during\nsecurity workflows.","cis_impact":"By default, CloudWatch Logs will store Logs indefinitely\nunless a specific retention period is defined for the log group. When choosing\nthe number of days to retain, keep in mind the average days it takes an\norganization to realize they have been breached is 210 days (at the time of\nthis writing). Since additional time is required to research a breach, a\nminimum 365 day retention policy allows time for detection and research. You\nmay also wish to archive the logs to a cheaper storage service rather than\nsimply deleting them. See the following AWS resource to manage CloudWatch Logs\nretention periods:\n\n*\nhttp://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html","cis_rid":"4.3","cis_level":2,"cis_control_number":"","nist":["SI-4(4)","Rev_4"],"cce_id":"CCE-79202-8","check":"Perform the following to determine if VPC Flow logs is enabled:\n\n\n'Via the Management Console:\n\n* Sign into the management console\n* Select Services then VPC\n* In the left navigation pane, select Your VPCs\n* Select a VPC\n* In the right pane, select the Flow Logs tab.\n* Ensure a Log Flow exists that has Active in the Status column.","fix":"Perform the following to determine if VPC Flow logs is enabled:\n\n'Via the Management Console:\n\n* Sign into the management console\n* Select Services then VPC\n* In the left navigation pane, select Your VPCs\n* Select a VPC\n* In the right pane, select the Flow Logs tab.\n* If no Flow Log exists, click Create Flow Log\n* For Filter, select Reject\n* Enter in a Role and Destination Log Group\n* Click Create Log Flow\n* Click on CloudWatch Logs Group\n\n'NOTE: Setting the filter to 'Reject' will dramatically reduce the logging data\naccumulation for this recommendation and provide sufficient information for the\npurposes of breach detection, research and remediation. However, during periods\nof least privilege security group engineering, setting this the filter to 'All'\ncan be very helpful in discovering existing traffic flows required for proper\noperation of an already running environment.\n\n'\n"},"code":"control \"cis-aws-foundations-4.3\" do\n  title \"Ensure VPC flow logging is enabled in all VPCs\"\n  desc  \"VPC Flow Logs is a feature that enables you to capture information\nabout the IP traffic going to and from network interfaces in your VPC. After\nyou've created a flow log, you can view and retrieve its data in Amazon\nCloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet\n'Rejects' for VPCs.\"\n  impact 0.7\n  tag \"rationale\": \"VPC Flow Logs provide visibility into network traffic that\ntraverses the VPC and can be used to detect anomalous traffic or insight during\nsecurity workflows.\"\n  tag \"cis_impact\": \"By default, CloudWatch Logs will store Logs indefinitely\nunless a specific retention period is defined for the log group. When choosing\nthe number of days to retain, keep in mind the average days it takes an\norganization to realize they have been breached is 210 days (at the time of\nthis writing). Since additional time is required to research a breach, a\nminimum 365 day retention policy allows time for detection and research. You\nmay also wish to archive the logs to a cheaper storage service rather than\nsimply deleting them. See the following AWS resource to manage CloudWatch Logs\nretention periods:\n\n*\nhttp://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html\"\n  tag \"cis_rid\": \"4.3\"\n  tag \"cis_level\": 2\n  tag \"cis_control_number\": \"\"\n  tag \"nist\": [\"SI-4(4)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79202-8\"\n  tag \"check\": \"Perform the following to determine if VPC Flow logs is enabled:\n\n\n'Via the Management Console:\n\n* Sign into the management console\n* Select Services then VPC\n* In the left navigation pane, select Your VPCs\n* Select a VPC\n* In the right pane, select the Flow Logs tab.\n* Ensure a Log Flow exists that has Active in the Status column.\"\n  tag \"fix\": \"Perform the following to determine if VPC Flow logs is enabled:\n\n'Via the Management Console:\n\n* Sign into the management console\n* Select Services then VPC\n* In the left navigation pane, select Your VPCs\n* Select a VPC\n* In the right pane, select the Flow Logs tab.\n* If no Flow Log exists, click Create Flow Log\n* For Filter, select Reject\n* Enter in a Role and Destination Log Group\n* Click Create Log Flow\n* Click on CloudWatch Logs Group\n\n'NOTE: Setting the filter to 'Reject' will dramatically reduce the logging data\naccumulation for this recommendation and provide sufficient information for the\npurposes of breach detection, research and remediation. However, during periods\nof least privilege security group engineering, setting this the filter to 'All'\ncan be very helpful in discovering existing traffic flows required for proper\noperation of an already running environment.\n\n'\n\"\n  aws_vpcs.vpc_ids.each do |vpc|\n    describe aws_vpc(vpc) do\n      it { should be_flow_logs_enabled }\n    end\n    describe.one do\n      aws_vpc(vpc).flow_logs.each do |flow_log|\n        describe \"flow log settings\" do\n          subject { flow_log }\n          its('traffic_type') { should match /REJECT|ALL/ }\n        end\n      end\n    end\n  end\n  describe \"Control skipped because no vpcs were found\" do\n    skip \"This control is skipped since the aws_vpcs resource returned an empty vpc list\"\n  end if aws_vpcs.vpc_ids.empty?\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-4.3.rb"},"results":[{"status":"passed","code_desc":"VPC vpc-0ddd1276 should be flow logs enabled","run_time":0.106048,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"flow log settings traffic_type should match /REJECT|ALL/","run_time":0.000165,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.12","title":"Ensure no root account access key exists","desc":"The root account is the most privileged user in an AWS account. AWS\nAccess Keys provide programmatic access to a given AWS account. It is\nrecommended that all access keys associated with the root account be removed.","descriptions":[{"label":"default","data":"The root account is the most privileged user in an AWS account. AWS\nAccess Keys provide programmatic access to a given AWS account. It is\nrecommended that all access keys associated with the root account be removed."}],"impact":0.3,"refs":[],"tags":{"rationale":"Removing access keys associated with the root account\nlimits vectors by which the account can be compromised. Additionally, removing\nthe root access keys encourages the creation and use of role based accounts\nthat are least privileged.","cis_impact":"","cis_rid":"1.12","cis_level":1,"csc_control":[["5.1"],"6.0"],"nist":["AC-6(9)","Rev_4"],"cce_id":"CCE-78910-7","check":"Perform the following to determine if the root account has\naccess keys:\n\n'Via the AWS Console\n\n* Login to the AWS Management Console\n* Click Services\n* Click IAM\n* Click on Credential Report\n* This will download an .xls file which contains credential usage for all IAM\nusers within an AWS Account - open this file\n* For the <root_account> user, ensure the access_key_1_active and\naccess_key_2_active fields are set to FALSE.\n\n'Via CLI\n\n* Run the following commands:\n\n'aws iam generate-credential-report\naws iam get-credential-report --query 'Content' --output text | base64 -d | cut\n-d, -f1,9,14 | grep -B1 '<root_account>'\n* For the <root_account> user, ensure the access_key_1_active and\naccess_key_2_active fields are set to FALSE.","fix":"Perform the following to delete or disable active root access\nkeys being\n\n'Via the AWS Console\n\n 'Sign in to the AWS Management Console as Root and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'Click on _<Root_Account_Name>_ at the top right and select Security\nCredentials from the drop down list\n\n 'On the pop out screen Click on Continue to Security Credentials\n* Click on Access Keys _(Access Key ID and Secret Access Key)_\n\n* Under the Status column if there are any Keys which are Active\n\n* Click on Make Inactive - (Temporarily disable Key - may be needed again)\n* Click Delete - (Deleted keys cannot be recovered)\n"},"code":"control \"cis-aws-foundations-1.12\" do\n  title \"Ensure no root account access key exists\"\n  desc  \"The root account is the most privileged user in an AWS account. AWS\nAccess Keys provide programmatic access to a given AWS account. It is\nrecommended that all access keys associated with the root account be removed.\"\n  impact 0.3\n  tag \"rationale\": \"Removing access keys associated with the root account\nlimits vectors by which the account can be compromised. Additionally, removing\nthe root access keys encourages the creation and use of role based accounts\nthat are least privileged.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.12\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"5.1\"], \"6.0\"]\n  tag \"nist\": [\"AC-6(9)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78910-7\"\n  tag \"check\": \"Perform the following to determine if the root account has\naccess keys:\n\n'Via the AWS Console\n\n* Login to the AWS Management Console\n* Click Services\n* Click IAM\n* Click on Credential Report\n* This will download an .xls file which contains credential usage for all IAM\nusers within an AWS Account - open this file\n* For the <root_account> user, ensure the access_key_1_active and\naccess_key_2_active fields are set to FALSE.\n\n'Via CLI\n\n* Run the following commands:\n\n'aws iam generate-credential-report\naws iam get-credential-report --query 'Content' --output text | base64 -d | cut\n-d, -f1,9,14 | grep -B1 '<root_account>'\n* For the <root_account> user, ensure the access_key_1_active and\naccess_key_2_active fields are set to FALSE.\"\n  tag \"fix\": \"Perform the following to delete or disable active root access\nkeys being\n\n'Via the AWS Console\n\n 'Sign in to the AWS Management Console as Root and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'Click on _<Root_Account_Name>_ at the top right and select Security\nCredentials from the drop down list\n\n 'On the pop out screen Click on Continue to Security Credentials\n* Click on Access Keys _(Access Key ID and Secret Access Key)_\n\n* Under the Status column if there are any Keys which are Active\n\n* Click on Make Inactive - (Temporarily disable Key - may be needed again)\n* Click Delete - (Deleted keys cannot be recovered)\n\"\n  describe aws_iam_root_user do\n    it { should_not have_access_key }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.12.rb"},"results":[{"status":"failed","code_desc":"AWS Root-User should not have access key","run_time":0.046486,"start_time":"2018-11-18T20:21:40-05:00","message":"expected #has_access_key? to return false, got true"}]},{"id":"cis-aws-foundations-1.16","title":"Ensure IAM policies are attached only to groups or roles","desc":"By default, IAM users, groups, and roles have no access to AWS\nresources. IAM policies are the means by which privileges are granted to users,\ngroups, or roles. It is recommended that IAM policies be applied directly to\ngroups and roles but not users.","descriptions":[{"label":"default","data":"By default, IAM users, groups, and roles have no access to AWS\nresources. IAM policies are the means by which privileges are granted to users,\ngroups, or roles. It is recommended that IAM policies be applied directly to\ngroups and roles but not users."}],"impact":0.3,"refs":[],"tags":{"rationale":"Assigning privileges at the group or role level reduces the\ncomplexity of access management as the number of users grow. Reducing access\nmanagement complexity may in-turn reduce opportunity for a principal to\ninadvertently receive or retain excessive privileges.","cis_impact":"","cis_rid":"1.16","cis_level":1,"csc_control":"","nist":["AC-6(7)","Rev_4"],"cce_id":"CCE-78912-3","check":"Perform the following to determine if policies are attached\ndirectly to users:\n\n* Run the following to get a list of IAM users:\n\n'aws iam list-users --query 'Users[*].UserName' --output text\n\n* For each user returned, run the following command to determine if any\npolicies are attached to them:\n\n'aws iam list-attached-user-policies --user-name <_iam_user_>\naws iam list-user-policies --user-name _<iam_user>_\n* If any policies are returned, the user has a direct policy attachment.","fix":"Perform the following to create an IAM group and assign a policy\nto it:\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, click Groups and then click Create New Group.\n\n 'In the Group Name box, type the name of the group and then click Next Step.\n\n 'In the list of policies, select the check box for each policy that you want to\napply to all members of the group. Then click Next Step.\n\n 'Click Create Group\n\n\nPerform the following to add a user to a given group:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, click Groups\n\n 'Select the group to add a user to\n\n 'Click Add Users To Group\n\n 'Select the users to be added to the group\n* Click Add Users\n\n\nPerform the following to remove a direct association between a user and policy:\n\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n* In the left navigation pane, click on Users\n\n* For each user:\n\n* Select the user\n* Click on the Permissions tab\n* Expand Managed Policies\n* Click Detach Policy for each policy\n* Expand Inline Policies\n* Click Remove Policy for each policy\n\n'\n"},"code":"control \"cis-aws-foundations-1.16\" do\n  title \"Ensure IAM policies are attached only to groups or roles\"\n  desc  \"By default, IAM users, groups, and roles have no access to AWS\nresources. IAM policies are the means by which privileges are granted to users,\ngroups, or roles. It is recommended that IAM policies be applied directly to\ngroups and roles but not users.\"\n  impact 0.3\n  tag \"rationale\": \"Assigning privileges at the group or role level reduces the\ncomplexity of access management as the number of users grow. Reducing access\nmanagement complexity may in-turn reduce opportunity for a principal to\ninadvertently receive or retain excessive privileges.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.16\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AC-6(7)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78912-3\"\n  tag \"check\": \"Perform the following to determine if policies are attached\ndirectly to users:\n\n* Run the following to get a list of IAM users:\n\n'aws iam list-users --query 'Users[*].UserName' --output text\n\n* For each user returned, run the following command to determine if any\npolicies are attached to them:\n\n'aws iam list-attached-user-policies --user-name <_iam_user_>\naws iam list-user-policies --user-name _<iam_user>_\n* If any policies are returned, the user has a direct policy attachment.\"\n  tag \"fix\": \"Perform the following to create an IAM group and assign a policy\nto it:\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, click Groups and then click Create New Group.\n\n 'In the Group Name box, type the name of the group and then click Next Step.\n\n 'In the list of policies, select the check box for each policy that you want to\napply to all members of the group. Then click Next Step.\n\n 'Click Create Group\n\n\nPerform the following to add a user to a given group:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n\n 'In the navigation pane, click Groups\n\n 'Select the group to add a user to\n\n 'Click Add Users To Group\n\n 'Select the users to be added to the group\n* Click Add Users\n\n\nPerform the following to remove a direct association between a user and policy:\n\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].\n* In the left navigation pane, click on Users\n\n* For each user:\n\n* Select the user\n* Click on the Permissions tab\n* Expand Managed Policies\n* Click Detach Policy for each policy\n* Expand Inline Policies\n* Click Remove Policy for each policy\n\n'\n\"\n  aws_iam_users.entries.each do |user|\n    describe aws_iam_user(username: user.user_name) do\n      it { should_not have_inline_policies }\n      it { should_not have_attached_policies }\n    end\n  end\n\n  describe \"Control skipped because no iam users were found\" do\n    skip \"This control is skipped since the aws_iam_users resource returned an empty user list\"\n  end if aws_iam_users.entries.empty?\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.16.rb"},"results":[{"status":"passed","code_desc":"IAM User cis-iam-manager should not have inline policies","run_time":0.000183,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM User cis-iam-manager should not have attached policies","run_time":0.000185,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM User cis-iam-master should not have inline policies","run_time":0.000124,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM User cis-iam-master should not have attached policies","run_time":0.000108,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM User test-fixture-maker should not have inline policies","run_time":0.000131,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"IAM User test-fixture-maker should not have attached policies","run_time":0.00011,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.22","title":"Ensure a support role has been created to manage incidents with AWS\nSupport","desc":"AWS provides a support center that can be used for incident\nnotification and response, as well as technical support and customer services.\nCreate an IAM Role to allow authorized users to manage incidents with AWS\nSupport.","descriptions":[{"label":"default","data":"AWS provides a support center that can be used for incident\nnotification and response, as well as technical support and customer services.\nCreate an IAM Role to allow authorized users to manage incidents with AWS\nSupport."}],"impact":0.3,"refs":[],"tags":{"rationale":"By implementing least privilege for access control, an IAM\nRole will require an appropriate IAM Policy to allow Support Center Access in\norder to manage Incidents with AWS Support.","cis_impact":"All AWS Support plans include an unlimited number of\naccount and billing support cases, with no long-term contracts.\n\nSupport billing calculations are performed on a per-account basis for all\nplans. Enterprise Support plan customers have the option to include multiple\nenabled accounts in an aggregated monthly billing calculation.\n\nMonthly charges for the Business and Enterprise support plans are based on each\nmonth's AWS usage charges, subject to a monthly minimum, billed in advance.","cis_rid":"1.22","cis_level":1,"csc_control":"","nist":["IR-7","Rev_4"],"cce_id":"","check":"Using the Amazon unified command line interface:\n\n* List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note\nthe 'Arn' element value:\n\n 'aws iam list-policies --query 'Policies[?PolicyName == 'AWSSupportAccess']'\n\n\n* Check if the 'AWSSupportAccess' is attached to any IAM user, group or role:\n\n 'aws iam list-entities-for-policy --policy-arn <iam_policy_arn>\n","fix":"Using the Amazon unified command line interface:\n\n* Create an IAM role for managing incidents with AWS:\n\n* Create a trust relationship policy document that allows <iam_user> to manage\nAWS incidents, and save it locally as /tmp/TrustPolicy.json:\n\n '{\n 'Version': '2012-10-17',\n 'Statement': [\n {\n 'Effect': 'Allow',\n 'Principal': {\n 'AWS': '<iam_user>'\n },\n 'Action': 'sts:AssumeRole'\n }\n ]\n}\n\n\n * Create the IAM role using the above trust policy:\n\n 'aws iam create-role --role-name <_aws_support_iam_role_>\n--assume-role-policy-document file:///tmp/TrustPolicy.json\n\n\n * Attach 'AWSSupportAccess' managed policy to the created IAM role:\n\n 'aws iam attach-role-policy --policy-arn <iam_policy_arn> --role-name\n<_aws_support_iam_role_>\n\n"},"code":"control \"cis-aws-foundations-1.22\" do\n  title \"Ensure a support role has been created to manage incidents with AWS\nSupport\"\n  desc  \"AWS provides a support center that can be used for incident\nnotification and response, as well as technical support and customer services.\nCreate an IAM Role to allow authorized users to manage incidents with AWS\nSupport.\"\n  impact 0.3\n  tag \"rationale\": \"By implementing least privilege for access control, an IAM\nRole will require an appropriate IAM Policy to allow Support Center Access in\norder to manage Incidents with AWS Support.\"\n  tag \"cis_impact\": \"All AWS Support plans include an unlimited number of\naccount and billing support cases, with no long-term contracts.\n\nSupport billing calculations are performed on a per-account basis for all\nplans. Enterprise Support plan customers have the option to include multiple\nenabled accounts in an aggregated monthly billing calculation.\n\nMonthly charges for the Business and Enterprise support plans are based on each\nmonth's AWS usage charges, subject to a monthly minimum, billed in advance.\"\n  tag \"cis_rid\": \"1.22\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IR-7\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Using the Amazon unified command line interface:\n\n* List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note\nthe 'Arn' element value:\n\n 'aws iam list-policies --query 'Policies[?PolicyName == 'AWSSupportAccess']'\n\n\n* Check if the 'AWSSupportAccess' is attached to any IAM user, group or role:\n\n 'aws iam list-entities-for-policy --policy-arn <iam_policy_arn>\n\"\n  tag \"fix\": \"Using the Amazon unified command line interface:\n\n* Create an IAM role for managing incidents with AWS:\n\n* Create a trust relationship policy document that allows <iam_user> to manage\nAWS incidents, and save it locally as /tmp/TrustPolicy.json:\n\n '{\n 'Version': '2012-10-17',\n 'Statement': [\n {\n 'Effect': 'Allow',\n 'Principal': {\n 'AWS': '<iam_user>'\n },\n 'Action': 'sts:AssumeRole'\n }\n ]\n}\n\n\n * Create the IAM role using the above trust policy:\n\n 'aws iam create-role --role-name <_aws_support_iam_role_>\n--assume-role-policy-document file:///tmp/TrustPolicy.json\n\n\n * Attach 'AWSSupportAccess' managed policy to the created IAM role:\n\n 'aws iam attach-role-policy --policy-arn <iam_policy_arn> --role-name\n<_aws_support_iam_role_>\n\n\"\n\n  describe aws_iam_policy('AWSSupportAccess') do\n    it{ should be_attached }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.22.rb"},"results":[{"status":"passed","code_desc":"Policy AWSSupportAccess should be attached","run_time":9.8e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-3.8","title":"Ensure a log metric filter and alarm exist for S3 bucket policy\nchanges","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for changes to S3 bucket policies.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for changes to S3 bucket policies."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring changes to S3 bucket policies may reduce time to\ndetect and correct permissive policies on sensitive S3 buckets.","cis_impact":"","cis_rid":"3.8","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79193-9","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventSource = s3.amazonaws.com) &'><sns_topic_arn> _\n\n'\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for S3 Bucket Policy changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<s3_bucket_policy_changes_metric>_ --metric-transformations\nmetricName=_<s3_bucket_policy_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventSource = s3.amazonaws.com) &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name\n_<s3_bucket_policy_changes_alarm>_ --metric-name\n_<s3_bucket_policy_changes_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.8\" do\n  title \"Ensure a log metric filter and alarm exist for S3 bucket policy\nchanges\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for changes to S3 bucket policies.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring changes to S3 bucket policies may reduce time to\ndetect and correct permissive policies on sensitive S3 buckets.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.8\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79193-9\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventSource = s3.amazonaws.com) &'><sns_topic_arn> _\n\n'\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for S3 Bucket Policy changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<s3_bucket_policy_changes_metric>_ --metric-transformations\nmetricName=_<s3_bucket_policy_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventSource = s3.amazonaws.com) &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name\n_<s3_bucket_policy_changes_alarm>_ --metric-name\n_<s3_bucket_policy_changes_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.8.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000123,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":7.2e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":6.8e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":9.9e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":7.1e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":9.4e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-3.12","title":"Ensure a log metric filter and alarm exist for changes to network\ngateways","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Network gateways are required to send/receive traffic to a\ndestination outside of a VPC. It is recommended that a metric filter and alarm\nbe established for changes to network gateways.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Network gateways are required to send/receive traffic to a\ndestination outside of a VPC. It is recommended that a metric filter and alarm\nbe established for changes to network gateways."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring changes to network gateways will help ensure\nthat all ingress/egress traffic traverses the VPC border via a controlled path.","cis_impact":"","cis_rid":"3.12","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79197-0","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateCustomerGateway) || ($.eventName =\nDeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName\n= CreateInternetGateway) || ($.eventName = DeleteInternetGateway) ||\n($.eventName = DetachInternetGateway) }'\n5. Note the _<network_gw_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<network_gw_changes_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<network_gw_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for network gateways changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<network_gw_changes_metric>_ --metric-transformations\nmetricName=_<network_gw_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName =\nDeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName\n= CreateInternetGateway) || ($.eventName = DeleteInternetGateway) ||\n($.eventName = DetachInternetGateway) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<network_gw_changes_alarm>_\n--metric-name _<network_gw_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.12\" do\n  title \"Ensure a log metric filter and alarm exist for changes to network\ngateways\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Network gateways are required to send/receive traffic to a\ndestination outside of a VPC. It is recommended that a metric filter and alarm\nbe established for changes to network gateways.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring changes to network gateways will help ensure\nthat all ingress/egress traffic traverses the VPC border via a controlled path.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.12\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79197-0\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateCustomerGateway) || ($.eventName =\nDeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName\n= CreateInternetGateway) || ($.eventName = DeleteInternetGateway) ||\n($.eventName = DetachInternetGateway) }'\n5. Note the _<network_gw_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<network_gw_changes_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<network_gw_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for network gateways changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<network_gw_changes_metric>_ --metric-transformations\nmetricName=_<network_gw_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName =\nDeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName\n= CreateInternetGateway) || ($.eventName = DeleteInternetGateway) ||\n($.eventName = DetachInternetGateway) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<network_gw_changes_alarm>_\n--metric-name _<network_gw_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.12.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":9.7e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":6.6e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":6.2e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":7.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":6.2e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":7.5e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.17","title":"Enable detailed billing","desc":"Enable Detailed Billing to cause the generation of a log record for\nevery event or hourly ongoing activity which incurs cost in an AWS account.\nThese records are aggregated into CSV files of hourly records, and written to\nan S3 bucket. A CSV (Comma Separated Values) file of billing records is written\nat least every 24 hours; writing of files is often more frequent.","descriptions":[{"label":"default","data":"Enable Detailed Billing to cause the generation of a log record for\nevery event or hourly ongoing activity which incurs cost in an AWS account.\nThese records are aggregated into CSV files of hourly records, and written to\nan S3 bucket. A CSV (Comma Separated Values) file of billing records is written\nat least every 24 hours; writing of files is often more frequent."}],"impact":0.3,"refs":[],"tags":{"rationale":"Detailed Billing records can be used as an overview of AWS\nactivity across the whole of an account, in addition to per-Region CloudTrail,\nConfig and other service-specific JSON-based logs. Billing records can be\ngraphed over time using the Cost Explorer tool, and budgeting alerts can be\nconfigured on billing records and pushed to SNS in the event of spend over\ntime, or predicted spend at current rate, going above a customer-set threshold\n- this can be used as a simple means of detecting anomalous utilisation of AWS\nresources and thereby triggering investigation activities. Billing records can\nalso be broken out by tag, which can serve as a starting point in identifying\nwhich part of the environment, or organisation, the anomalous activity is\noccurring in.","cis_impact":"","cis_rid":"1.17","cis_level":1,"csc_control":"","nist":["AU-12","Rev_4"],"cce_id":"","check":"There is currently no AWS CLI support for this operation, so it\nis necessary to use the Management Console.\n\nAs a user with IAM permission to read billing information\n(aws-portal:ViewBilling):\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/.\n* On the navigation pane, choose Preferences.\n* Verify whether the 'Receive Billing Reports' check box is ticked. If it is\nnot, billing reports are not being generated.","fix":"There is currently no AWS CLI support for this operation, so it\nis necessary to use the Management Console.\n\n'As a user with IAM permission to read and write billing information\n(aws-portal:*Billing):\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/\n[https://console.aws.amazon.com/billing/home#/].\n* On the navigation pane, choose Preferences.\n* Select the Receive Billing Reports check box.\n* Designate the Amazon S3 bucket _<S3_billing_bucket>_ where you want AWS to\npublish your detailed billing reports.\n* Ensure that policy allows read access only to appropriate groups of users\n(finance, auditors, etc). For appropriate groups in IAM who you want to have\nread access, include the following policy element:\n\n' 'Statement':[\n\n' {\n\n' 'Effect':'Allow',\n\n' 'Action':[\n\n' 's3:GetObject',\n\n' 's3:GetObjectVersion',\n\n' 's3:GetBucketLocation'\n\n' ],\n\n' 'Resource':'arn:aws:s3:::_<S3_billing_bucket>_/*'\n\n' }\n\n' ]\n\n* After your S3 bucket has been verified, under Report, select the check boxes\nfor the reports that you want to receive.\n* Choose Save preferences\n* Detailed billing reports can take up to 24 hours to start being generated.\nWait >24 hours, and examine your designated S3 bucket to verify that files with\nnames of the form (eg) <AWS account\nnumber>-<aws-billing-detailed-line-items-with-resources-and-tags-yyyy-mm>.csv.zip\nare being generated."},"code":"control \"cis-aws-foundations-1.17\" do\n  title \"Enable detailed billing\"\n  desc  \"Enable Detailed Billing to cause the generation of a log record for\nevery event or hourly ongoing activity which incurs cost in an AWS account.\nThese records are aggregated into CSV files of hourly records, and written to\nan S3 bucket. A CSV (Comma Separated Values) file of billing records is written\nat least every 24 hours; writing of files is often more frequent.\"\n  impact 0.3\n  tag \"rationale\": \"Detailed Billing records can be used as an overview of AWS\nactivity across the whole of an account, in addition to per-Region CloudTrail,\nConfig and other service-specific JSON-based logs. Billing records can be\ngraphed over time using the Cost Explorer tool, and budgeting alerts can be\nconfigured on billing records and pushed to SNS in the event of spend over\ntime, or predicted spend at current rate, going above a customer-set threshold\n- this can be used as a simple means of detecting anomalous utilisation of AWS\nresources and thereby triggering investigation activities. Billing records can\nalso be broken out by tag, which can serve as a starting point in identifying\nwhich part of the environment, or organisation, the anomalous activity is\noccurring in.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.17\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AU-12\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"There is currently no AWS CLI support for this operation, so it\nis necessary to use the Management Console.\n\nAs a user with IAM permission to read billing information\n(aws-portal:ViewBilling):\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/.\n* On the navigation pane, choose Preferences.\n* Verify whether the 'Receive Billing Reports' check box is ticked. If it is\nnot, billing reports are not being generated.\"\n  tag \"fix\": \"There is currently no AWS CLI support for this operation, so it\nis necessary to use the Management Console.\n\n'As a user with IAM permission to read and write billing information\n(aws-portal:*Billing):\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/\n[https://console.aws.amazon.com/billing/home#/].\n* On the navigation pane, choose Preferences.\n* Select the Receive Billing Reports check box.\n* Designate the Amazon S3 bucket _<S3_billing_bucket>_ where you want AWS to\npublish your detailed billing reports.\n* Ensure that policy allows read access only to appropriate groups of users\n(finance, auditors, etc). For appropriate groups in IAM who you want to have\nread access, include the following policy element:\n\n' 'Statement':[\n\n' {\n\n' 'Effect':'Allow',\n\n' 'Action':[\n\n' 's3:GetObject',\n\n' 's3:GetObjectVersion',\n\n' 's3:GetBucketLocation'\n\n' ],\n\n' 'Resource':'arn:aws:s3:::_<S3_billing_bucket>_/*'\n\n' }\n\n' ]\n\n* After your S3 bucket has been verified, under Report, select the check boxes\nfor the reports that you want to receive.\n* Choose Save preferences\n* Detailed billing reports can take up to 24 hours to start being generated.\nWait >24 hours, and examine your designated S3 bucket to verify that files with\nnames of the form (eg) <AWS account\nnumber>-<aws-billing-detailed-line-items-with-resources-and-tags-yyyy-mm>.csv.zip\nare being generated.\"\n\n  describe \"Control has to be tested manually\" do\n    skip \"This control must be manually reviewed\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.17.rb"},"results":[{"status":"skipped","code_desc":"Control has to be tested manually","run_time":5.0e-06,"start_time":"2018-11-18T20:21:40-05:00","resource":"","skip_message":"This control must be manually reviewed"}]},{"id":"cis-aws-foundations-1.23","title":"Do not setup access keys during initial user setup for all IAM users\nthat have a console password","desc":"AWS console defaults the checkbox for creating access keys to enabled.\nThis results in many access keys being generated unnecessarily. In addition to\nunnecessary credentials, it also generates unnecessary management work in\nauditing and rotating these keys.","descriptions":[{"label":"default","data":"AWS console defaults the checkbox for creating access keys to enabled.\nThis results in many access keys being generated unnecessarily. In addition to\nunnecessary credentials, it also generates unnecessary management work in\nauditing and rotating these keys."}],"impact":0.3,"refs":[],"tags":{"rationale":"Requiring that additional steps be taken by the user after\ntheir profile has been created will give a stronger indication of intent that\naccess keys are [a] necessary for their work and [b] once the access key is\nestablished on an account, that the keys may be in use somewhere in the\norganization.\n\n'NOTE: Even if it is known the user will need access keys, require them to\ncreate the keys themselves or put in a support ticket to have the created as a\nseparate step from user creation.","cis_impact":"","cis_rid":"1.23","cis_level":1,"csc_control":"","nist":["AC-6","Rev_4"],"cce_id":"","check":"Perform the following to determine if access keys are rotated\nas prescribed:\n\n* Login to the AWS Management Console\n* ClickServices\n* ClickIAM\n* Click onA User\n* Compare the user creation date to the key 1 creation date.\n* For any that match, the key was created during initial user setup.\n\n * Keys that were created at the same time as the user profile and do not have a\nlast used date should be deleted.\n\n' Via the CLI\n\n\n* Run the following command (OSX/Linux/UNIX) to generate a list of all IAM\nusers along with their access keys utilization:\n\n'aws iam generate-credential-report\n\n'aws iam get-credential-report --query 'Content' --output text | base64 -d |\ncut -d, -f1,4,9,11,14,16\n\n* The output of this command will produce a table similar to the following:\n\n'user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_key_2_active,access_key_2_last_used_date\n\nelise,false,true,2015-04-16T15:14:00+00:00,false,N/A\nbrandon,true,true,N/A,false,N/A\nrakesh,false,false,N/A,false,N/A\nhelene,false,true,2015-11-18T17:47:00+00:00,false,N/A\nparas,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00\nanitha,true,true,2016-06-08T11:43:00+00:00,true,N/A\n* For any user having access_key_last_used_date set to N/A, ensure that access\nkey is deleted.\n\n\n","fix":"Perform the following to delete access keys that do not pass the\naudit:\n\n* Login to the AWS Management Console:\n* Click Services\n* Click IAM\n* Click on Users\n* Click on Security Credentials\n\n* As an Administrator\n\n* Click on Delete for keys that were created at the same time as the user\nprofile but have not been used.\n\n* As an IAM User\n\n* Click on Delete for keys that were created at the same time as the user\nprofile but have not been used.\n\n'Via CLI\n\n'aws iam delete-access-key"},"code":"control \"cis-aws-foundations-1.23\" do\n  title \"Do not setup access keys during initial user setup for all IAM users\nthat have a console password\"\n  desc  \"AWS console defaults the checkbox for creating access keys to enabled.\nThis results in many access keys being generated unnecessarily. In addition to\nunnecessary credentials, it also generates unnecessary management work in\nauditing and rotating these keys.\"\n  impact 0.3\n  tag \"rationale\": \"Requiring that additional steps be taken by the user after\ntheir profile has been created will give a stronger indication of intent that\naccess keys are [a] necessary for their work and [b] once the access key is\nestablished on an account, that the keys may be in use somewhere in the\norganization.\n\n'NOTE: Even if it is known the user will need access keys, require them to\ncreate the keys themselves or put in a support ticket to have the created as a\nseparate step from user creation.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.23\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AC-6\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Perform the following to determine if access keys are rotated\nas prescribed:\n\n* Login to the AWS Management Console\n* ClickServices\n* ClickIAM\n* Click onA User\n* Compare the user creation date to the key 1 creation date.\n* For any that match, the key was created during initial user setup.\n\n * Keys that were created at the same time as the user profile and do not have a\nlast used date should be deleted.\n\n' Via the CLI\n\n\n* Run the following command (OSX/Linux/UNIX) to generate a list of all IAM\nusers along with their access keys utilization:\n\n'aws iam generate-credential-report\n\n'aws iam get-credential-report --query 'Content' --output text | base64 -d |\ncut -d, -f1,4,9,11,14,16\n\n* The output of this command will produce a table similar to the following:\n\n'user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_key_2_active,access_key_2_last_used_date\n\nelise,false,true,2015-04-16T15:14:00+00:00,false,N/A\nbrandon,true,true,N/A,false,N/A\nrakesh,false,false,N/A,false,N/A\nhelene,false,true,2015-11-18T17:47:00+00:00,false,N/A\nparas,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00\nanitha,true,true,2016-06-08T11:43:00+00:00,true,N/A\n* For any user having access_key_last_used_date set to N/A, ensure that access\nkey is deleted.\n\n\n\"\n  tag \"fix\": \"Perform the following to delete access keys that do not pass the\naudit:\n\n* Login to the AWS Management Console:\n* Click Services\n* Click IAM\n* Click on Users\n* Click on Security Credentials\n\n* As an Administrator\n\n* Click on Delete for keys that were created at the same time as the user\nprofile but have not been used.\n\n* As an IAM User\n\n* Click on Delete for keys that were created at the same time as the user\nprofile but have not been used.\n\n'Via CLI\n\n'aws iam delete-access-key\"\n\n  aws_iam_access_keys.entries.each do |key|\n    describe key.username do\n      context key do\n        its('last_used_days_ago') { should_not be_nil }\n      end\n    end\n  end\n\n  describe \"Control skipped because no iam access keys were found\" do\n    skip \"This control is skipped since the aws_iam_access_keys resource returned an empty access key list\"\n  end if aws_iam_access_keys.entries.empty?\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.23.rb"},"results":[{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with one entry last_used_days_ago should not be nil","run_time":8.7e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with one entry last_used_days_ago should not be nil","run_time":7.8e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-2.8","title":"Ensure rotation for customer created CMKs is enabled","desc":"AWS Key Management Service (KMS) allows customers to rotate the\nbacking key which is key material stored within the KMS which is tied to the\nkey ID of the Customer Created customer master key (CMK). It is the backing key\nthat is used to perform cryptographic operations such as encryption and\ndecryption. Automated key rotation currently retains all prior backing keys so\nthat decryption of encrypted data can take place transparently. It is\nrecommended that CMK key rotation be enabled.","descriptions":[{"label":"default","data":"AWS Key Management Service (KMS) allows customers to rotate the\nbacking key which is key material stored within the KMS which is tied to the\nkey ID of the Customer Created customer master key (CMK). It is the backing key\nthat is used to perform cryptographic operations such as encryption and\ndecryption. Automated key rotation currently retains all prior backing keys so\nthat decryption of encrypted data can take place transparently. It is\nrecommended that CMK key rotation be enabled."}],"impact":0.7,"refs":[],"tags":{"rationale":"Rotating encryption keys helps reduce the potential impact\nof a compromised key as data encrypted with a new key cannot be accessed with a\nprevious key that may have been exposed.","cis_impact":"","cis_rid":"2.8","cis_level":2,"csc_control":"","nist":["SC-12","Rev_4"],"cce_id":"CCE-78920-6","check":"Via the Management Console:\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam [https://console.aws.amazon.com/iam].\n\n 'In the left navigation pane, choose Encryption Keys.\n* Select a customer created master key (CMK)\n* Under the Key Policy section, move down to Key Rotation_._\n* Ensure the Rotate this key every year checkbox is checked.\n\n'Via CLI\n\n* Run the following command to get a list of all keys and their associated\nKeyIds\n\n'aws kms list-keys\n\n* For each key, note the KeyId and run the following command\n\n'aws kms get-key-rotation-status --key-id _<kms_key_id>_\n* Ensure KeyRotationEnabled is set to true","fix":"Via the Management Console:\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam [https://console.aws.amazon.com/iam].\n\n 'In the left navigation pane, choose Encryption Keys.\n* Select a customer created master key (CMK)\n* Under the Key Policy section, move down to Key Rotation_._\n* Check the Rotate this key every year checkbox.\n\n'Via CLI\n\n* Run the following command to enable key rotation:\n\n'aws kms enable-key-rotation --key-id _<kms_key_id>_\n"},"code":"control \"cis-aws-foundations-2.8\" do\n  title \"Ensure rotation for customer created CMKs is enabled\"\n  desc  \"AWS Key Management Service (KMS) allows customers to rotate the\nbacking key which is key material stored within the KMS which is tied to the\nkey ID of the Customer Created customer master key (CMK). It is the backing key\nthat is used to perform cryptographic operations such as encryption and\ndecryption. Automated key rotation currently retains all prior backing keys so\nthat decryption of encrypted data can take place transparently. It is\nrecommended that CMK key rotation be enabled.\"\n  impact 0.7\n  tag \"rationale\": \"Rotating encryption keys helps reduce the potential impact\nof a compromised key as data encrypted with a new key cannot be accessed with a\nprevious key that may have been exposed.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"2.8\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SC-12\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78920-6\"\n  tag \"check\": \"Via the Management Console:\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam [https://console.aws.amazon.com/iam].\n\n 'In the left navigation pane, choose Encryption Keys.\n* Select a customer created master key (CMK)\n* Under the Key Policy section, move down to Key Rotation_._\n* Ensure the Rotate this key every year checkbox is checked.\n\n'Via CLI\n\n* Run the following command to get a list of all keys and their associated\nKeyIds\n\n'aws kms list-keys\n\n* For each key, note the KeyId and run the following command\n\n'aws kms get-key-rotation-status --key-id _<kms_key_id>_\n* Ensure KeyRotationEnabled is set to true\"\n  tag \"fix\": \"Via the Management Console:\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam [https://console.aws.amazon.com/iam].\n\n 'In the left navigation pane, choose Encryption Keys.\n* Select a customer created master key (CMK)\n* Under the Key Policy section, move down to Key Rotation_._\n* Check the Rotate this key every year checkbox.\n\n'Via CLI\n\n* Run the following command to enable key rotation:\n\n'aws kms enable-key-rotation --key-id _<kms_key_id>_\n\"\n  aws_kms_keys.key_arns.each do |key|\n    describe aws_kms_key(key) do\n      it { should have_rotation_enabled }\n    end if aws_kms_key(key).enabled? && !aws_kms_key(key).managed_by_aws?\n  end\n\n  describe \"Control skipped because no enabled kms keys were found\" do\n    skip \"This control is skipped since the aws_kms_keys resource returned an empty coustomer managed and enabled kms key list\"\n  end if !aws_kms_keys.key_arns.any? { |key| aws_kms_key(key).enabled? && !aws_kms_key(key).managed_by_aws? }    \nend","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-2.8.rb"},"results":[{"status":"passed","code_desc":"KMS Key 40a4edeb-5150-4ec6-abab-0651b8083f02 should have rotation enabled","run_time":0.000127,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"KMS Key f865fb5c-7e5b-45de-afea-f729181596b9 should have rotation enabled","run_time":0.000133,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-3.9","title":"Ensure a log metric filter and alarm exist for AWS Config\nconfiguration changes","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for detecting changes to CloudTrail's configurations.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for detecting changes to CloudTrail's configurations."}],"impact":0.7,"refs":[],"tags":{"rationale":"Monitoring changes to AWS Config configuration will help\nensure sustained visibility of configuration items within the AWS account.","cis_impact":"","cis_rid":"3.9","cis_level":2,"csc_control":[["5.4"],"6.0"],"nist":["AC-2(4)","Rev_4"],"cce_id":"CCE-79194-7","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{($.eventSource = config.amazonaws.com) &'><sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for AWS Config changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<aws_config_changes_metric>_ --metric-transformations\nmetricName=_<aws_config_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{($.eventSource = config.amazonaws.com) &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<aws_config_changes_alarm>_\n--metric-name _<aws_config_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.9\" do\n  title \"Ensure a log metric filter and alarm exist for AWS Config\nconfiguration changes\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for detecting changes to CloudTrail's configurations.\"\n  impact 0.7\n  tag \"rationale\": \"Monitoring changes to AWS Config configuration will help\nensure sustained visibility of configuration items within the AWS account.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.9\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": [[\"5.4\"], \"6.0\"]\n  tag \"nist\": [\"AC-2(4)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79194-7\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{($.eventSource = config.amazonaws.com) &'><sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for AWS Config changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<aws_config_changes_metric>_ --metric-transformations\nmetricName=_<aws_config_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{($.eventSource = config.amazonaws.com) &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<aws_config_changes_alarm>_\n--metric-name _<aws_config_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = \"{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}\"\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.9.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000112,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":6.8e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":6.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":8.4e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":5.6e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":7.0e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-3.13","title":"Ensure a log metric filter and alarm exist for route table changes","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Routing tables are used to route network traffic between\nsubnets and to network gateways. It is recommended that a metric filter and\nalarm be established for changes to route tables.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Routing tables are used to route network traffic between\nsubnets and to network gateways. It is recommended that a metric filter and\nalarm be established for changes to route tables."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring changes to route tables will help ensure that\nall VPC traffic flows through an expected path.","cis_impact":"","cis_rid":"3.13","cis_level":1,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79198-8","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateRoute) || ($.eventName =\nCreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =\nReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) ||\n($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'\n5. Note the _<route_table_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<route_table_changes_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<route_table_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for route table changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<route_table_changes_metric>_ --metric-transformations\nmetricName=_<route_table_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateRoute) || ($.eventName =\nCreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =\nReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) ||\n($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<route_table_changes_alarm>_\n--metric-name _<route_table_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.13\" do\n  title \"Ensure a log metric filter and alarm exist for route table changes\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. Routing tables are used to route network traffic between\nsubnets and to network gateways. It is recommended that a metric filter and\nalarm be established for changes to route tables.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring changes to route tables will help ensure that\nall VPC traffic flows through an expected path.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.13\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79198-8\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = CreateRoute) || ($.eventName =\nCreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =\nReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) ||\n($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'\n5. Note the _<route_table_changes_metric>_ value associated with the\nfilterPattern found in step 4.\n6. Get a list of CloudWatch alarms and filter on the\n_<route_table_changes_metric>_ captured in step 5.\n\n\n'aws cloudwatch describe-alarms --query\n'MetricAlarms[?MetricName==`_<route_table_changes_metric>_`]'\n7. Note the AlarmActions value - this will provide the SNS topic ARN value.\n8. Ensure there is at least one subscriber to the SNS topic\n\n\n'aws sns list-subscriptions-by-topic --topic-arn _<sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for route table changes and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<route_table_changes_metric>_ --metric-transformations\nmetricName=_<route_table_changes_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = CreateRoute) || ($.eventName =\nCreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =\nReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) ||\n($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'\nNOTE: You can choose your own metricName and metricNamespace strings. Using the\nsame metricNamespace for all Foundations Benchmark metrics will group them\ntogether.\n2. Create an SNS topic that the alarm will notify\n\n\n'aws sns create-topic --name _<sns_topic_name>_\nNOTE: you can execute this command once and then re-use the same topic for all\nmonitoring alarms.\n3. Create an SNS subscription to the topic created in step 2\n\n\n'aws sns subscribe --topic-arn <sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<route_table_changes_alarm>_\n--metric-name _<route_table_changes_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.13.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":7.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":5.5e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":5.3e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":6.9e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":5.6e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":7.8e-05,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-4.2","title":"Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389","desc":"Security groups provide stateful filtering of ingress/egress network\ntraffic to AWS resources. It is recommended that no security group allows\nunrestricted ingress access to port 3389.","descriptions":[{"label":"default","data":"Security groups provide stateful filtering of ingress/egress network\ntraffic to AWS resources. It is recommended that no security group allows\nunrestricted ingress access to port 3389."}],"impact":0.3,"refs":[],"tags":{"rationale":"Removing unfettered connectivity to remote console\nservices, such as RDP, reduces a server's exposure to risk.","cis_impact":"For updating an existing environment, care should be taken\nto ensure that administrators currently relying on an existing ingress from\n0.0.0.0/0 have access to ports 22 and/or 3389 through another security group.","cis_rid":"4.2","cis_level":1,"cis_control_number":"","nist":["SC-7(5)","Rev_4"],"cce_id":"","check":"Perform the following to determine if the account is configured\nas prescribed:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Ensure no rule exists that has a port range that includes port 3389 and has a\nSource of 0.0.0.0/0\n\nNote: A Port value of ALL or a port range such as 1024-4098 are inclusive of\nport 3389.\n","fix":"Perform the following to implement the prescribed state:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Identify the rules to be removed\n* Click the x in the Remove column\n* Click Save"},"code":"control \"cis-aws-foundations-4.2\" do\n  title \"Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389\"\n  desc  \"Security groups provide stateful filtering of ingress/egress network\ntraffic to AWS resources. It is recommended that no security group allows\nunrestricted ingress access to port 3389.\"\n  impact 0.3\n  tag \"rationale\": \"Removing unfettered connectivity to remote console\nservices, such as RDP, reduces a server's exposure to risk.\"\n  tag \"cis_impact\": \"For updating an existing environment, care should be taken\nto ensure that administrators currently relying on an existing ingress from\n0.0.0.0/0 have access to ports 22 and/or 3389 through another security group.\"\n  tag \"cis_rid\": \"4.2\"\n  tag \"cis_level\": 1\n  tag \"cis_control_number\": \"\"\n  tag \"nist\": [\"SC-7(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Ensure no rule exists that has a port range that includes port 3389 and has a\nSource of 0.0.0.0/0\n\nNote: A Port value of ALL or a port range such as 1024-4098 are inclusive of\nport 3389.\n\"\n  tag \"fix\": \"Perform the following to implement the prescribed state:\n\n* Login to the AWS Management Console at\nhttps://console.aws.amazon.com/vpc/home\n[https://console.aws.amazon.com/vpc/home]\n* In the left pane, click Security Groups\n* For each security group, perform the following:\n\n* Select the security group\n* Click the Inbound Rules tab\n* Identify the rules to be removed\n* Click the x in the Remove column\n* Click Save\"\n\n  aws_security_groups.group_ids.each do |group_id|\n\n    describe \"Security Group not inspected because it is defined as an exception\" do\n      skip \"Security Group:: #{group_id} not insepcted because it is defined in EXCEPTION_SECURITY_GROUP_LIST.\"\n    end if EXCEPTION_SECURITY_GROUP_LIST.include?(group_id)\n\n    next if EXCEPTION_SECURITY_GROUP_LIST.include?(group_id)\n    describe aws_security_group(group_id) do\n      it { should_not allow_in(port: 3389, ipv4_range: '0.0.0.0/0') }\n    end\n  end\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-4.2.rb"},"results":[{"status":"passed","code_desc":"EC2 Security Group sg-06ddca70a8ef4df8a should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>3389}","run_time":0.000201,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"EC2 Security Group sg-076d8bf7bcc63a093 should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>3389}","run_time":0.000138,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"EC2 Security Group sg-094107f1c2b74147d should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>3389}","run_time":0.000128,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"EC2 Security Group sg-732e0104 should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>3389}","run_time":0.000134,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"EC2 Security Group sg-ae3529d8 should not allow in {:ipv4_range=>\"0.0.0.0/0\", :port=>3389}","run_time":0.000138,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.13","title":"Ensure MFA is enabled for the 'root' account","desc":"The root account is the most privileged user in an AWS account. MFA\nadds an extra layer of protection on top of a user name and password. With MFA\nenabled, when a user signs in to an AWS website, they will be prompted for\ntheir user name and password as well as for an authentication code from their\nAWS MFA device.\n\n'NOTE: When virtual MFA is used for root accounts, it is recommended that the\ndevice used is NOT a personal device, but rather a dedicated mobile device\n(tablet or phone) that is managed to be kept charged and secured independent of\nany individual personal devices. ('non-personal virtual MFA') This lessens the\nrisks of losing access to the MFA due to device loss, device trade-in or if the\nindividual owning the device is no longer employed at the company.","descriptions":[{"label":"default","data":"The root account is the most privileged user in an AWS account. MFA\nadds an extra layer of protection on top of a user name and password. With MFA\nenabled, when a user signs in to an AWS website, they will be prompted for\ntheir user name and password as well as for an authentication code from their\nAWS MFA device.\n\n'NOTE: When virtual MFA is used for root accounts, it is recommended that the\ndevice used is NOT a personal device, but rather a dedicated mobile device\n(tablet or phone) that is managed to be kept charged and secured independent of\nany individual personal devices. ('non-personal virtual MFA') This lessens the\nrisks of losing access to the MFA due to device loss, device trade-in or if the\nindividual owning the device is no longer employed at the company."}],"impact":0.3,"refs":[],"tags":{"rationale":"Enabling MFA provides increased security for console access\nas it requires the authenticating principal to possess a device that emits a\ntime-sensitive key and have knowledge of a credential.","cis_impact":"","cis_rid":"1.13","cis_level":1,"csc_control":[["5.6","11.4","12.6","16.11"],"6.0"],"nist":["IA-2(1)","SC-23","Rev_4"],"cce_id":"CCE-78911-5","check":"Perform the following to determine if the root account has MFA\nsetup:\n\n\n* Run the following command:\n\n'aws iam get-account-summary | grep 'AccountMFAEnabled'\n* Ensure the AccountMFAEnabled property is set to 1\n\n\n","fix":"Perform the following to establish MFA for the root account:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].<div\nclass='aws-note'>\n\n'Note: to manage MFA devices for the root AWS account, you must use your root\naccount credentials to sign in to AWS. You cannot manage MFA devices for the\nroot account using other credentials.\n\n\n 'Choose Dashboard, and under Security Status, expand Activate MFA on your root\naccount.\n\n 'Choose Activate MFA\n\n 'In the wizard, choose A virtual MFA device and then choose Next Step.\n\n 'IAM generates and displays configuration information for the virtual MFA\ndevice, including a QR code graphic. The graphic is a representation of the\n'secret configuration key' that is available for manual entry on devices that\ndo not support QR codes.\n\n 'Open your virtual MFA application. (For a list of apps that you can use for\nhosting virtual MFA devices, see Virtual MFA Applications\n[http://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications].) If the\nvirtual MFA application supports multiple accounts (multiple virtual MFA\ndevices), choose the option to create a new account (a new virtual MFA device).\n\n 'Determine whether the MFA app supports QR codes, and then do one of the\nfollowing:\n\n 'Use the app to scan the QR code. For example, you might choose the camera icon\nor choose an option similar to Scan code, and then use the device's camera to\nscan the code.\n\n 'In the Manage MFA Device wizard, choose Show secret key for manual\nconfiguration, and then type the secret configuration key into your MFA\napplication.\n\n\n'When you are finished, the virtual MFA device starts generating one-time\npasswords.\n\n 'In the Manage MFA Device wizard, in the Authentication Code 1 box, type the\none-time password that currently appears in the virtual MFA device. Wait up to\n30 seconds for the device to generate a new one-time password. Then type the\nsecond one-time password into the Authentication Code 2 box. Choose Active\nVirtual MFA.\n"},"code":"control \"cis-aws-foundations-1.13\" do\n  title \"Ensure MFA is enabled for the 'root' account\"\n  desc  \"The root account is the most privileged user in an AWS account. MFA\nadds an extra layer of protection on top of a user name and password. With MFA\nenabled, when a user signs in to an AWS website, they will be prompted for\ntheir user name and password as well as for an authentication code from their\nAWS MFA device.\n\n'NOTE: When virtual MFA is used for root accounts, it is recommended that the\ndevice used is NOT a personal device, but rather a dedicated mobile device\n(tablet or phone) that is managed to be kept charged and secured independent of\nany individual personal devices. ('non-personal virtual MFA') This lessens the\nrisks of losing access to the MFA due to device loss, device trade-in or if the\nindividual owning the device is no longer employed at the company.\"\n  impact 0.3\n  tag \"rationale\": \"Enabling MFA provides increased security for console access\nas it requires the authenticating principal to possess a device that emits a\ntime-sensitive key and have knowledge of a credential.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.13\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"5.6\", \"11.4\", \"12.6\", \"16.11\"], \"6.0\"]\n  tag \"nist\": [\"IA-2(1)\",\"SC-23\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78911-5\"\n  tag \"check\": \"Perform the following to determine if the root account has MFA\nsetup:\n\n\n* Run the following command:\n\n'aws iam get-account-summary | grep 'AccountMFAEnabled'\n* Ensure the AccountMFAEnabled property is set to 1\n\n\n\"\n  tag \"fix\": \"Perform the following to establish MFA for the root account:\n\n\n 'Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/iam/ [https://console.aws.amazon.com/iam/].<div\nclass='aws-note'>\n\n'Note: to manage MFA devices for the root AWS account, you must use your root\naccount credentials to sign in to AWS. You cannot manage MFA devices for the\nroot account using other credentials.\n\n\n 'Choose Dashboard, and under Security Status, expand Activate MFA on your root\naccount.\n\n 'Choose Activate MFA\n\n 'In the wizard, choose A virtual MFA device and then choose Next Step.\n\n 'IAM generates and displays configuration information for the virtual MFA\ndevice, including a QR code graphic. The graphic is a representation of the\n'secret configuration key' that is available for manual entry on devices that\ndo not support QR codes.\n\n 'Open your virtual MFA application. (For a list of apps that you can use for\nhosting virtual MFA devices, see Virtual MFA Applications\n[http://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications].) If the\nvirtual MFA application supports multiple accounts (multiple virtual MFA\ndevices), choose the option to create a new account (a new virtual MFA device).\n\n 'Determine whether the MFA app supports QR codes, and then do one of the\nfollowing:\n\n 'Use the app to scan the QR code. For example, you might choose the camera icon\nor choose an option similar to Scan code, and then use the device's camera to\nscan the code.\n\n 'In the Manage MFA Device wizard, choose Show secret key for manual\nconfiguration, and then type the secret configuration key into your MFA\napplication.\n\n\n'When you are finished, the virtual MFA device starts generating one-time\npasswords.\n\n 'In the Manage MFA Device wizard, in the Authentication Code 1 box, type the\none-time password that currently appears in the virtual MFA device. Wait up to\n30 seconds for the device to generate a new one-time password. Then type the\nsecond one-time password into the Authentication Code 2 box. Choose Active\nVirtual MFA.\n\"\n  describe aws_iam_root_user do\n    its('has_mfa_enabled?') { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.13.rb"},"results":[{"status":"passed","code_desc":"AWS Root-User has_mfa_enabled? should equal true","run_time":0.134626,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-2.7","title":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs","desc":"AWS CloudTrail is a web service that records AWS API calls for an\naccount and makes those logs available to users and resources in accordance\nwith IAM policies. AWS Key Management Service (KMS) is a managed service that\nhelps create and control the encryption keys used to encrypt account data, and\nuses Hardware Security Modules (HSMs) to protect the security of encryption\nkeys. CloudTrail logs can be configured to leverage server side encryption\n(SSE) and KMS customer created master keys (CMK) to further protect CloudTrail\nlogs. It is recommended that CloudTrail be configured to use SSE-KMS.","descriptions":[{"label":"default","data":"AWS CloudTrail is a web service that records AWS API calls for an\naccount and makes those logs available to users and resources in accordance\nwith IAM policies. AWS Key Management Service (KMS) is a managed service that\nhelps create and control the encryption keys used to encrypt account data, and\nuses Hardware Security Modules (HSMs) to protect the security of encryption\nkeys. CloudTrail logs can be configured to leverage server side encryption\n(SSE) and KMS customer created master keys (CMK) to further protect CloudTrail\nlogs. It is recommended that CloudTrail be configured to use SSE-KMS."}],"impact":0.7,"refs":[],"tags":{"rationale":"Configuring CloudTrail to use SSE-KMS provides additional\nconfidentiality controls on log data as a given user must have S3 read\npermission on the corresponding log bucket and must be granted decrypt\npermission by the CMK policy.","cis_impact":"Customer created keys incur an additional cost. See\nhttps://aws.amazon.com/kms/pricing/ for more information.","cis_rid":"2.7","cis_level":2,"csc_control":[["13.1"],"6.0"],"nist":["AU-9","Rev_4"],"cce_id":"CCE-78919-8","check":"Perform the following to determine if CloudTrail is configured\nto use SSE-KMS:\n\n'Via the Management Console\n\n 'Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* In the left navigation pane, choose Trails.\n* Select a Trail\n* Under the S3 section, ensure Encrypt log files is set to Yes and a KMS key ID\nis specified in the KSM Key Id field.\n\n'Via CLI\n\n* Run the following command:\n\n'aws cloudtrail describe-trails\n* For each trail listed, SSE-KMS is enabled if the trail has a KmsKeyId\nproperty defined.","fix":"Perform the following to configure CloudTrail to use SSE-KMS:\n\n'Via the Management Console\n\n 'Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* In the left navigation pane, choose Trails.\n* Click on a Trail\n* Under the S3 section click on the edit button (pencil icon)\n* Click Advanced\n\n* Select an existing CMK from the KMS key Id drop-down menu\n\n* Note: Ensure the CMK is located in the same region as the S3 bucket\n* Note: You will need to apply a KMS Key policy on the selected CMK in order\nfor CloudTrail as a service to encrypt and decrypt log files using the CMK\nprovided. Steps are provided here\n[https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html]\nfor editing the selected CMK Key policy\n\n\n* Click Save\n* You will see a notification message stating that you need to have decrypt\npermissions on the specified KMS key to decrypt log files.\n* Click Yes\n\n'Via CLI\n\n'aws cloudtrail update-trail --name <_trail_name_> --kms-id\n<_cloudtrail_kms_key_>\naws kms put-key-policy --key-id <_cloudtrail_kms_key_> --policy\n<_cloudtrail_kms_key_policy_>"},"code":"control \"cis-aws-foundations-2.7\" do\n  title \"Ensure CloudTrail logs are encrypted at rest using KMS CMKs\"\n  desc  \"AWS CloudTrail is a web service that records AWS API calls for an\naccount and makes those logs available to users and resources in accordance\nwith IAM policies. AWS Key Management Service (KMS) is a managed service that\nhelps create and control the encryption keys used to encrypt account data, and\nuses Hardware Security Modules (HSMs) to protect the security of encryption\nkeys. CloudTrail logs can be configured to leverage server side encryption\n(SSE) and KMS customer created master keys (CMK) to further protect CloudTrail\nlogs. It is recommended that CloudTrail be configured to use SSE-KMS.\"\n  impact 0.7\n  tag \"rationale\": \"Configuring CloudTrail to use SSE-KMS provides additional\nconfidentiality controls on log data as a given user must have S3 read\npermission on the corresponding log bucket and must be granted decrypt\npermission by the CMK policy.\"\n  tag \"cis_impact\": \"Customer created keys incur an additional cost. See\nhttps://aws.amazon.com/kms/pricing/ for more information.\"\n  tag \"cis_rid\": \"2.7\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": [[\"13.1\"], \"6.0\"]\n  tag \"nist\": [\"AU-9\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78919-8\"\n  tag \"check\": \"Perform the following to determine if CloudTrail is configured\nto use SSE-KMS:\n\n'Via the Management Console\n\n 'Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* In the left navigation pane, choose Trails.\n* Select a Trail\n* Under the S3 section, ensure Encrypt log files is set to Yes and a KMS key ID\nis specified in the KSM Key Id field.\n\n'Via CLI\n\n* Run the following command:\n\n'aws cloudtrail describe-trails\n* For each trail listed, SSE-KMS is enabled if the trail has a KmsKeyId\nproperty defined.\"\n  tag \"fix\": \"Perform the following to configure CloudTrail to use SSE-KMS:\n\n'Via the Management Console\n\n 'Sign in to the AWS Management Console and open the CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* In the left navigation pane, choose Trails.\n* Click on a Trail\n* Under the S3 section click on the edit button (pencil icon)\n* Click Advanced\n\n* Select an existing CMK from the KMS key Id drop-down menu\n\n* Note: Ensure the CMK is located in the same region as the S3 bucket\n* Note: You will need to apply a KMS Key policy on the selected CMK in order\nfor CloudTrail as a service to encrypt and decrypt log files using the CMK\nprovided. Steps are provided here\n[https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html]\nfor editing the selected CMK Key policy\n\n\n* Click Save\n* You will see a notification message stating that you need to have decrypt\npermissions on the specified KMS key to decrypt log files.\n* Click Yes\n\n'Via CLI\n\n'aws cloudtrail update-trail --name <_trail_name_> --kms-id\n<_cloudtrail_kms_key_>\naws kms put-key-policy --key-id <_cloudtrail_kms_key_> --policy\n<_cloudtrail_kms_key_policy_>\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  aws_cloudtrail_trails.trail_arns.each do |trail|\n    describe aws_cloudtrail_trail(trail) do\n      its('kms_key_id') { should_not be_nil}\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-2.7.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000138,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"CloudTrail arn:aws:cloudtrail:us-east-1:484747447281:trail/cis-trail-01 kms_key_id should not be nil","run_time":0.000111,"start_time":"2018-11-18T20:21:40-05:00"}]},{"id":"cis-aws-foundations-1.18","title":"Ensure IAM Master and IAM Manager roles are active","desc":"Ensure IAM Master and IAM Manager roles are in place for IAM\nadministration and assignment of administrative permissions for other services\nto other roles.\n\n'An IAM role is conceptually 'a container of permissions resembling a user\naccount which cannot be directly logged into, but which must instead be assumed\nfrom an existing user account which has appropriate permissions to do so', in\nthe manner of roles in Unix Role-Based Access Control (RBAC). In AWS, roles can\nalso be assigned to EC2 instances and Lambda functions.\n\nControl over IAM, which is also defined and mediated by a number of\nfine-grained permissions, should be divided between a number of roles, such\nthat no individual user in a production account has full control over IAM.","descriptions":[{"label":"default","data":"Ensure IAM Master and IAM Manager roles are in place for IAM\nadministration and assignment of administrative permissions for other services\nto other roles.\n\n'An IAM role is conceptually 'a container of permissions resembling a user\naccount which cannot be directly logged into, but which must instead be assumed\nfrom an existing user account which has appropriate permissions to do so', in\nthe manner of roles in Unix Role-Based Access Control (RBAC). In AWS, roles can\nalso be assigned to EC2 instances and Lambda functions.\n\nControl over IAM, which is also defined and mediated by a number of\nfine-grained permissions, should be divided between a number of roles, such\nthat no individual user in a production account has full control over IAM."}],"impact":0.3,"refs":[],"tags":{"rationale":"IAM is the principal point of control for service\nconfiguration access, and 'control over IAM' means 'control over the\nconfiguration of all other assets in the AWS account'. Therefore it is\nrecommended that control of this degree of security criticality should be\ndivided among multiple individuals within an organisation, in a manner such\nthat no individual retains enough control over IAM to 'rewrite themselves to\nroot'.\n\nRoles are recommended for security-sensitive capabilities, as the act of\nassuming a role generates a set of ephemeral credentials using the Security\nToken Service (STS) and these credentials - being a token, an AWS Access Key\nand an AWS Secret Access Key - are needed to make API calls in the context of\nthe role. STS credentials expire after a configurable period (default 12 hours,\nminimum 15 minutes, maximum 36 hours), and this reduces the risk of engineers\nhard-wiring these keys into code, and therefore further reduces the risk of the\nkeys being mishandled.\n\nThe current recommendation is to divide account and permission configuration\npermissions between 2 roles, which are:\n\nIAM Master: creates users, groups and roles; assigns permissions to roles\nIAM Manager: assigns users and roles to groups\n\nIn this model, IAM Master and IAM Manager must work together in a 2-person rule\nmanner, in order for a user to gain access to a permission.","cis_impact":"","cis_rid":"1.18","cis_level":1,"csc_control":"","nist":["AC-6(7)","Rev_4"],"cce_id":"","check":"Using the Amazon unified CLI, from a user or role which has the\niam:ListRoles and iam:GetRolePolicy permissions:\n\nList the configured roles:\n\n'aws iam list-roles --query 'Roles[*].{RoleName:RoleName, Arn:Arn}'\n\n'The output should contain entries with 'RoleName': '_<iam_manager_role_name>_'\nand 'Rolename': '_<iam_master_role_name>_'\n\nExamine the permissions associated with each of these roles:\n\n'aws iam get-role-policy --role-name _<iam_manager_role_name>_\n\n'aws iam get-role-policy --role-name _<iam_master_role_name>_\n\nThe _<iam_master_role_name>_ role should include the following Actions with an\nAllow effect:\n\niam:AttachRolePolicy\niam:CreateGroup\niam:CreatePolicy\niam:CreatePolicyVersion\niam:CreateRole\niam:CreateUser\niam:DeleteGroup\niam:DeletePolicy\niam:DeletePolicyVersion\niam:DeleteRole\niam:DeleteRolePolicy\niam:DeleteUser\niam:PutRolePolicy\niam:GetPolicy\niam:GetPolicyVersion\niam:GetRole\niam:GetRolePolicy\niam:GetUser\niam:GetUserPolicy\niam:ListEntitiesForPolicy\niam:ListGroupPolicies\niam:ListGroups\niam:ListGroupsForUser\niam:ListPolicies\niam:ListPoliciesGrantingServiceAccess\niam:ListPolicyVersions\niam:ListRolePolicies\niam:ListAttachedGroupPolicies\niam:ListAttachedRolePolicies\niam:ListAttachedUserPolicies\niam:ListRoles\niam:ListUsers\n\nand the following Actions with a Deny effect:\n\niam:AddUserToGroup\niam:AttachGroupPolicy\niam:DeleteGroupPolicy\niam:DeleteUserPolicy\niam:DetachGroupPolicy\niam:DetachRolePolicy\niam:DetachUserPolicy\niam:PutGroupPolicy\niam:PutUserPolicy\niam:RemoveUserFromGroup\niam:UpdateGroup\niam:UpdateAssumeRolePolicy\niam:UpdateUser\n\nThe _<iam_manager_role_name>_ role should include the following Actions with an\nAllow effect:\n\niam:AddUserToGroup\niam:AttachGroupPolicy\niam:DeleteGroupPolicy\niam:DeleteUserPolicy\niam:DetachGroupPolicy\niam:DetachRolePolicy\niam:DetachUserPolicy\niam:PutGroupPolicy\niam:PutUserPolicy\niam:RemoveUserFromGroup\niam:UpdateGroup\niam:UpdateAssumeRolePolicy\niam:UpdateUser\niam:GetPolicy\niam:GetPolicyVersion\niam:GetRole\niam:GetRolePolicy\niam:GetUser\niam:GetUserPolicy\niam:ListEntitiesForPolicy\niam:ListGroupPolicies\niam:ListGroups\niam:ListGroupsForUser\niam:ListPolicies\niam:ListPoliciesGrantingServiceAccess\niam:ListPolicyVersions\niam:ListRolePolicies\niam:ListAttachedGroupPolicies\niam:ListAttachedRolePolicies\niam:ListAttachedUserPolicies\niam:ListRoles\niam:ListUsers\n\nand the following Actions with a Deny effect:\n\niam: AttachRolePolicy\niam:CreateGroup\niam:CreatePolicy\niam:CreatePolicyVersion\niam:CreateRole\niam:CreateUser\niam:DeleteGroup\niam:DeletePolicy\niam:DeletePolicyVersion\niam:DeleteRole\niam:DeleteRolePolicy\niam:DeleteUser\niam:PutRolePolicy\n\nOther iam:* Actions may be included in these policies as needed.\n\nBoth policies should also be limited by a Condition that MFA authentication is\nin effect, by containing:\n\n'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'true'}}\n\nin the Allow effect section (provided IAM Federation has not been configured).\n\n\nEach role needs to be assumable by at least one user or group:\n\n'aws iam get-role --role-name _<iam_manager_role_name>_\n\n'aws iam get-role --role-name _<iam_master_role_name>_\n\n'should display the AssumeRolePolicyDocument indicating which users and groups\nare able to assume the roles. No user or group should be able to assume both\nroles.","fix":"Using the Amazon unified CLI, from a user or role which has the\niam:CreateRole, iam:CreatePolicy and iam:PutRolePolicy permissions:\n\n'aws iam create-role --role-name _<iam_manager_role_name>_\n\n'aws iam create-role --role-name _<iam_master_role_name>_\n\n'aws iam put-role-policy --role-name _<iam_manager_role_name>_ --policy-name\n_<iam_manager_permissions_policy>_ --policy-document\n<a>file://IAM-Manager-policy.json</a>\n\n'aws iam put-role-policy --role-name _<iam_master_role_name>_ --policy-name\n_<iam_master_permissions_policy>_ --policy-document\n<a>file://IAM-Master-policy.json</a>\n\n'where IAM-Master-policy.json contains:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': [{\n\n' 'Action': [\n\n' 'iam:CreateGroup',\n\n''iam:CreatePolicy',\n\n''iam:CreatePolicyVersion',\n\n''iam:CreateRole',\n\n''iam:CreateUser',\n\n''iam:DeleteGroup',\n\n''iam:DeletePolicy',\n\n''iam:DeletePolicyVersion',\n\n''iam:DeleteRole',\n\n''iam:DeleteRolePolicy',\n\n''iam:DeleteUser',\n\n''iam:PutRolePolicy',\n\n''iam:GetPolicy',\n\n''iam:GetPolicyVersion',\n\n''iam:GetRole',\n\n''iam:GetRolePolicy',\n\n''iam:GetUser',\n\n''iam:GetUserPolicy',\n\n''iam:ListEntitiesForPolicy',\n\n''iam:ListGroupPolicies',\n\n''iam:ListGroups',\n\n''iam:ListGroupsForUser',\n\n''iam:ListPolicies',\n\n''iam:ListPoliciesGrantingServiceAccess',\n\n''iam:ListPolicyVersions',\n\n''iam:ListRolePolicies',\n\n''iam:ListAttachedGroupPolicies',\n\n''iam:ListAttachedRolePolicies',\n\n''iam:ListAttachedUserPolicies',\n\n''iam:ListRoles',\n\n''iam:ListUsers'\n\n' ],\n\n' 'Effect': 'Allow',\n\n' 'Resource': '*',\n\n' 'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'true'}}\n\n' }],\n\n' 'Action': [\n\n''iam:AddUserToGroup',\n\n''iam:AttachGroupPolicy',\n\n''iam:DeleteGroupPolicy',\n\n''iam:DeleteUserPolicy',\n\n''iam:DetachGroupPolicy',\n\n''iam:DetachRolePolicy',\n\n''iam:DetachUserPolicy',\n\n''iam:PutGroupPolicy',\n\n''iam:PutUserPolicy',\n\n''iam:RemoveUserFromGroup',\n\n''iam:UpdateGroup',\n\n''iam:UpdateAssumeRolePolicy',\n\n''iam:UpdateUser'\n\n' ],\n\n' 'Effect': 'Deny',\n\n' 'Resource': '*'\n\n' }]\n\n'}\n\n'and where IAM-Manager-policy.json contains:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': [{\n\n' 'Action': [\n\n''iam:AddUserToGroup',\n\n''iam:AttachGroupPolicy',\n\n''iam:DeleteGroupPolicy',\n\n''iam:DeleteUserPolicy',\n\n''iam:DetachGroupPolicy',\n\n''iam:DetachRolePolicy',\n\n''iam:DetachUserPolicy',\n\n''iam:PutGroupPolicy',\n\n''iam:PutUserPolicy',\n\n''iam:RemoveUserFromGroup',\n\n''iam:UpdateGroup',\n\n''iam:UpdateAssumeRolePolicy',\n\n''iam:UpdateUser',\n\n''iam:GetPolicy',\n\n''iam:GetPolicyVersion',\n\n''iam:GetRole',\n\n''iam:GetRolePolicy',\n\n''iam:GetUser',\n\n''iam:GetUserPolicy',\n\n''iam:ListEntitiesForPolicy',\n\n''iam:ListGroupPolicies',\n\n''iam:ListGroups',\n\n''iam:ListGroupsForUser',\n\n''iam:ListPolicies',\n\n''iam:ListPoliciesGrantingServiceAccess',\n\n''iam:ListPolicyVersions',\n\n''iam:ListRolePolicies',\n\n''iam:ListAttachedGroupPolicies',\n\n''iam:ListAttachedRolePolicies',\n\n''iam:ListAttachedUserPolicies',\n\n''iam:ListRoles',\n\n''iam:ListUsers'\n\n' ],\n\n' 'Effect': 'Allow',\n\n' 'Resource': '*',\n\n' 'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'true'}}\n\n' }],\n\n' 'Action': [\n\n' 'iam:CreateGroup',\n\n''iam:CreatePolicy',\n\n''iam:CreatePolicyVersion',\n\n''iam:CreateRole',\n\n''iam:CreateUser',\n\n''iam:DeleteGroup',\n\n''iam:DeletePolicy',\n\n''iam:DeletePolicyVersion',\n\n''iam:DeleteRole',\n\n''iam:DeleteRolePolicy',\n\n''iam:DeleteUser',\n\n''iam:PutRolePolicy'\n\n' ],\n\n' 'Effect': 'Deny',\n\n' 'Resource': '*'\n\n' }]\n\n'}\n\n'Note that each of IAM-Manager-policy.json and IAM-Master-policy.json can\ncontain other iam:* permissions in either Allow or Deny Action lists, depending\non what other requirements are in place in the account.\n\n'Each of these roles needs to be assumable by a different user or group.\n\n'For appropriate users or groups (groups are recommended):\n\n'aws iam put-user-policy --user-name _<iam_user>_ --policy-name\n_<assume_iam_master_role_policy>_ --policy-document\n<a>file://Assume-IAM-Master.json</a>\n\n'aws iam put-user-policy --user-name _<iam_user>_ --policy-name\n_<assume_iam_manager_role_policy>_ --policy-document\n<a>file://Assume-IAM-Manager.json</a>\n\n'or\n\n'aws iam put-group-policy --group-name _<iam_group>_  --policy-name\n_<assume_iam_master_role_policy>_ --policy-document\n<a>file://Assume-IAM-Master.json</a>\n\n'aws iam put-group-policy --group-name _<iam_group>_ --policy-name\n_<assume_iam_manager_role_policy> _--policy-document\n<a>file://Assume-IAM-Manager.json</a>\n\n'where Assume-IAM-Master.json is:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': {\n\n' 'Effect': 'Allow',\n\n' 'Action': 'sts:AssumeRole',\n\n' 'Resource': 'arn:aws:iam::_<aws_account_number>_:role/<iam_master_role_name>'\n\n\n' }\n\n'}\n\n'and Assume-IAM-Manager.json is:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': {\n\n' 'Effect': 'Allow',\n\n' 'Action': 'sts:AssumeRole',\n\n' 'Resource': 'arn:aws:iam::<aws_account_number>:role/<iam_manager_role_name>'\n\n\n' }\n\n'}"},"code":"control \"cis-aws-foundations-1.18\" do\n  title \"Ensure IAM Master and IAM Manager roles are active\"\n  desc  \"Ensure IAM Master and IAM Manager roles are in place for IAM\nadministration and assignment of administrative permissions for other services\nto other roles.\n\n'An IAM role is conceptually 'a container of permissions resembling a user\naccount which cannot be directly logged into, but which must instead be assumed\nfrom an existing user account which has appropriate permissions to do so', in\nthe manner of roles in Unix Role-Based Access Control (RBAC). In AWS, roles can\nalso be assigned to EC2 instances and Lambda functions.\n\nControl over IAM, which is also defined and mediated by a number of\nfine-grained permissions, should be divided between a number of roles, such\nthat no individual user in a production account has full control over IAM.\"\n  impact 0.3\n  tag \"rationale\": \"IAM is the principal point of control for service\nconfiguration access, and 'control over IAM' means 'control over the\nconfiguration of all other assets in the AWS account'. Therefore it is\nrecommended that control of this degree of security criticality should be\ndivided among multiple individuals within an organisation, in a manner such\nthat no individual retains enough control over IAM to 'rewrite themselves to\nroot'.\n\nRoles are recommended for security-sensitive capabilities, as the act of\nassuming a role generates a set of ephemeral credentials using the Security\nToken Service (STS) and these credentials - being a token, an AWS Access Key\nand an AWS Secret Access Key - are needed to make API calls in the context of\nthe role. STS credentials expire after a configurable period (default 12 hours,\nminimum 15 minutes, maximum 36 hours), and this reduces the risk of engineers\nhard-wiring these keys into code, and therefore further reduces the risk of the\nkeys being mishandled.\n\nThe current recommendation is to divide account and permission configuration\npermissions between 2 roles, which are:\n\nIAM Master: creates users, groups and roles; assigns permissions to roles\nIAM Manager: assigns users and roles to groups\n\nIn this model, IAM Master and IAM Manager must work together in a 2-person rule\nmanner, in order for a user to gain access to a permission.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.18\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AC-6(7)\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"Using the Amazon unified CLI, from a user or role which has the\niam:ListRoles and iam:GetRolePolicy permissions:\n\nList the configured roles:\n\n'aws iam list-roles --query 'Roles[*].{RoleName:RoleName, Arn:Arn}'\n\n'The output should contain entries with 'RoleName': '_<iam_manager_role_name>_'\nand 'Rolename': '_<iam_master_role_name>_'\n\nExamine the permissions associated with each of these roles:\n\n'aws iam get-role-policy --role-name _<iam_manager_role_name>_\n\n'aws iam get-role-policy --role-name _<iam_master_role_name>_\n\nThe _<iam_master_role_name>_ role should include the following Actions with an\nAllow effect:\n\niam:AttachRolePolicy\niam:CreateGroup\niam:CreatePolicy\niam:CreatePolicyVersion\niam:CreateRole\niam:CreateUser\niam:DeleteGroup\niam:DeletePolicy\niam:DeletePolicyVersion\niam:DeleteRole\niam:DeleteRolePolicy\niam:DeleteUser\niam:PutRolePolicy\niam:GetPolicy\niam:GetPolicyVersion\niam:GetRole\niam:GetRolePolicy\niam:GetUser\niam:GetUserPolicy\niam:ListEntitiesForPolicy\niam:ListGroupPolicies\niam:ListGroups\niam:ListGroupsForUser\niam:ListPolicies\niam:ListPoliciesGrantingServiceAccess\niam:ListPolicyVersions\niam:ListRolePolicies\niam:ListAttachedGroupPolicies\niam:ListAttachedRolePolicies\niam:ListAttachedUserPolicies\niam:ListRoles\niam:ListUsers\n\nand the following Actions with a Deny effect:\n\niam:AddUserToGroup\niam:AttachGroupPolicy\niam:DeleteGroupPolicy\niam:DeleteUserPolicy\niam:DetachGroupPolicy\niam:DetachRolePolicy\niam:DetachUserPolicy\niam:PutGroupPolicy\niam:PutUserPolicy\niam:RemoveUserFromGroup\niam:UpdateGroup\niam:UpdateAssumeRolePolicy\niam:UpdateUser\n\nThe _<iam_manager_role_name>_ role should include the following Actions with an\nAllow effect:\n\niam:AddUserToGroup\niam:AttachGroupPolicy\niam:DeleteGroupPolicy\niam:DeleteUserPolicy\niam:DetachGroupPolicy\niam:DetachRolePolicy\niam:DetachUserPolicy\niam:PutGroupPolicy\niam:PutUserPolicy\niam:RemoveUserFromGroup\niam:UpdateGroup\niam:UpdateAssumeRolePolicy\niam:UpdateUser\niam:GetPolicy\niam:GetPolicyVersion\niam:GetRole\niam:GetRolePolicy\niam:GetUser\niam:GetUserPolicy\niam:ListEntitiesForPolicy\niam:ListGroupPolicies\niam:ListGroups\niam:ListGroupsForUser\niam:ListPolicies\niam:ListPoliciesGrantingServiceAccess\niam:ListPolicyVersions\niam:ListRolePolicies\niam:ListAttachedGroupPolicies\niam:ListAttachedRolePolicies\niam:ListAttachedUserPolicies\niam:ListRoles\niam:ListUsers\n\nand the following Actions with a Deny effect:\n\niam: AttachRolePolicy\niam:CreateGroup\niam:CreatePolicy\niam:CreatePolicyVersion\niam:CreateRole\niam:CreateUser\niam:DeleteGroup\niam:DeletePolicy\niam:DeletePolicyVersion\niam:DeleteRole\niam:DeleteRolePolicy\niam:DeleteUser\niam:PutRolePolicy\n\nOther iam:* Actions may be included in these policies as needed.\n\nBoth policies should also be limited by a Condition that MFA authentication is\nin effect, by containing:\n\n'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'true'}}\n\nin the Allow effect section (provided IAM Federation has not been configured).\n\n\nEach role needs to be assumable by at least one user or group:\n\n'aws iam get-role --role-name _<iam_manager_role_name>_\n\n'aws iam get-role --role-name _<iam_master_role_name>_\n\n'should display the AssumeRolePolicyDocument indicating which users and groups\nare able to assume the roles. No user or group should be able to assume both\nroles.\"\n  tag \"fix\": \"Using the Amazon unified CLI, from a user or role which has the\niam:CreateRole, iam:CreatePolicy and iam:PutRolePolicy permissions:\n\n'aws iam create-role --role-name _<iam_manager_role_name>_\n\n'aws iam create-role --role-name _<iam_master_role_name>_\n\n'aws iam put-role-policy --role-name _<iam_manager_role_name>_ --policy-name\n_<iam_manager_permissions_policy>_ --policy-document\n<a>file://IAM-Manager-policy.json</a>\n\n'aws iam put-role-policy --role-name _<iam_master_role_name>_ --policy-name\n_<iam_master_permissions_policy>_ --policy-document\n<a>file://IAM-Master-policy.json</a>\n\n'where IAM-Master-policy.json contains:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': [{\n\n' 'Action': [\n\n' 'iam:CreateGroup',\n\n''iam:CreatePolicy',\n\n''iam:CreatePolicyVersion',\n\n''iam:CreateRole',\n\n''iam:CreateUser',\n\n''iam:DeleteGroup',\n\n''iam:DeletePolicy',\n\n''iam:DeletePolicyVersion',\n\n''iam:DeleteRole',\n\n''iam:DeleteRolePolicy',\n\n''iam:DeleteUser',\n\n''iam:PutRolePolicy',\n\n''iam:GetPolicy',\n\n''iam:GetPolicyVersion',\n\n''iam:GetRole',\n\n''iam:GetRolePolicy',\n\n''iam:GetUser',\n\n''iam:GetUserPolicy',\n\n''iam:ListEntitiesForPolicy',\n\n''iam:ListGroupPolicies',\n\n''iam:ListGroups',\n\n''iam:ListGroupsForUser',\n\n''iam:ListPolicies',\n\n''iam:ListPoliciesGrantingServiceAccess',\n\n''iam:ListPolicyVersions',\n\n''iam:ListRolePolicies',\n\n''iam:ListAttachedGroupPolicies',\n\n''iam:ListAttachedRolePolicies',\n\n''iam:ListAttachedUserPolicies',\n\n''iam:ListRoles',\n\n''iam:ListUsers'\n\n' ],\n\n' 'Effect': 'Allow',\n\n' 'Resource': '*',\n\n' 'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'true'}}\n\n' }],\n\n' 'Action': [\n\n''iam:AddUserToGroup',\n\n''iam:AttachGroupPolicy',\n\n''iam:DeleteGroupPolicy',\n\n''iam:DeleteUserPolicy',\n\n''iam:DetachGroupPolicy',\n\n''iam:DetachRolePolicy',\n\n''iam:DetachUserPolicy',\n\n''iam:PutGroupPolicy',\n\n''iam:PutUserPolicy',\n\n''iam:RemoveUserFromGroup',\n\n''iam:UpdateGroup',\n\n''iam:UpdateAssumeRolePolicy',\n\n''iam:UpdateUser'\n\n' ],\n\n' 'Effect': 'Deny',\n\n' 'Resource': '*'\n\n' }]\n\n'}\n\n'and where IAM-Manager-policy.json contains:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': [{\n\n' 'Action': [\n\n''iam:AddUserToGroup',\n\n''iam:AttachGroupPolicy',\n\n''iam:DeleteGroupPolicy',\n\n''iam:DeleteUserPolicy',\n\n''iam:DetachGroupPolicy',\n\n''iam:DetachRolePolicy',\n\n''iam:DetachUserPolicy',\n\n''iam:PutGroupPolicy',\n\n''iam:PutUserPolicy',\n\n''iam:RemoveUserFromGroup',\n\n''iam:UpdateGroup',\n\n''iam:UpdateAssumeRolePolicy',\n\n''iam:UpdateUser',\n\n''iam:GetPolicy',\n\n''iam:GetPolicyVersion',\n\n''iam:GetRole',\n\n''iam:GetRolePolicy',\n\n''iam:GetUser',\n\n''iam:GetUserPolicy',\n\n''iam:ListEntitiesForPolicy',\n\n''iam:ListGroupPolicies',\n\n''iam:ListGroups',\n\n''iam:ListGroupsForUser',\n\n''iam:ListPolicies',\n\n''iam:ListPoliciesGrantingServiceAccess',\n\n''iam:ListPolicyVersions',\n\n''iam:ListRolePolicies',\n\n''iam:ListAttachedGroupPolicies',\n\n''iam:ListAttachedRolePolicies',\n\n''iam:ListAttachedUserPolicies',\n\n''iam:ListRoles',\n\n''iam:ListUsers'\n\n' ],\n\n' 'Effect': 'Allow',\n\n' 'Resource': '*',\n\n' 'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'true'}}\n\n' }],\n\n' 'Action': [\n\n' 'iam:CreateGroup',\n\n''iam:CreatePolicy',\n\n''iam:CreatePolicyVersion',\n\n''iam:CreateRole',\n\n''iam:CreateUser',\n\n''iam:DeleteGroup',\n\n''iam:DeletePolicy',\n\n''iam:DeletePolicyVersion',\n\n''iam:DeleteRole',\n\n''iam:DeleteRolePolicy',\n\n''iam:DeleteUser',\n\n''iam:PutRolePolicy'\n\n' ],\n\n' 'Effect': 'Deny',\n\n' 'Resource': '*'\n\n' }]\n\n'}\n\n'Note that each of IAM-Manager-policy.json and IAM-Master-policy.json can\ncontain other iam:* permissions in either Allow or Deny Action lists, depending\non what other requirements are in place in the account.\n\n'Each of these roles needs to be assumable by a different user or group.\n\n'For appropriate users or groups (groups are recommended):\n\n'aws iam put-user-policy --user-name _<iam_user>_ --policy-name\n_<assume_iam_master_role_policy>_ --policy-document\n<a>file://Assume-IAM-Master.json</a>\n\n'aws iam put-user-policy --user-name _<iam_user>_ --policy-name\n_<assume_iam_manager_role_policy>_ --policy-document\n<a>file://Assume-IAM-Manager.json</a>\n\n'or\n\n'aws iam put-group-policy --group-name _<iam_group>_  --policy-name\n_<assume_iam_master_role_policy>_ --policy-document\n<a>file://Assume-IAM-Master.json</a>\n\n'aws iam put-group-policy --group-name _<iam_group>_ --policy-name\n_<assume_iam_manager_role_policy> _--policy-document\n<a>file://Assume-IAM-Manager.json</a>\n\n'where Assume-IAM-Master.json is:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': {\n\n' 'Effect': 'Allow',\n\n' 'Action': 'sts:AssumeRole',\n\n' 'Resource': 'arn:aws:iam::_<aws_account_number>_:role/<iam_master_role_name>'\n\n\n' }\n\n'}\n\n'and Assume-IAM-Manager.json is:\n\n'{\n\n' 'Version': '2012-10-17',\n\n' 'Statement': {\n\n' 'Effect': 'Allow',\n\n' 'Action': 'sts:AssumeRole',\n\n' 'Resource': 'arn:aws:iam::<aws_account_number>:role/<iam_manager_role_name>'\n\n\n' }\n\n'}\"\n\nmaster_allow_actions = [\n  \"iam:AttachRolePolicy\",\n  \"iam:CreateGroup\",\n  \"iam:CreatePolicy\",\n  \"iam:CreatePolicyVersion\",\n  \"iam:CreateRole\",\n  \"iam:CreateUser\",\n  \"iam:DeleteGroup\",\n  \"iam:DeletePolicy\",\n  \"iam:DeletePolicyVersion\",\n  \"iam:DeleteRole\",\n  \"iam:DeleteRolePolicy\",\n  \"iam:DeleteUser\",\n  \"iam:PutRolePolicy\",\n  \"iam:GetPolicy\",\n  \"iam:GetPolicyVersion\",\n  \"iam:GetRole\",\n  \"iam:GetRolePolicy\",\n  \"iam:GetUser\",\n  \"iam:GetUserPolicy\",\n  \"iam:ListEntitiesForPolicy\",\n  \"iam:ListGroupPolicies\",\n  \"iam:ListGroups\",\n  \"iam:ListGroupsForUser\",\n  \"iam:ListPolicies\",\n  \"iam:ListPoliciesGrantingServiceAccess\",\n  \"iam:ListPolicyVersions\",\n  \"iam:ListRolePolicies\",\n  \"iam:ListAttachedGroupPolicies\",\n  \"iam:ListAttachedRolePolicies\",\n  \"iam:ListAttachedUserPolicies\",\n  \"iam:ListRoles\",\n  \"iam:ListUsers\",\n]\n\nmaster_deny_actions= [\n \"iam:AddUserToGroup\",\n \"iam:AttachGroupPolicy\",\n \"iam:DeleteGroupPolicy\",\n \"iam:DeleteUserPolicy\",\n \"iam:DetachGroupPolicy\",\n \"iam:DetachRolePolicy\",\n \"iam:DetachUserPolicy\",\n \"iam:PutGroupPolicy\",\n \"iam:PutUserPolicy\",\n \"iam:RemoveUserFromGroup\",\n \"iam:UpdateGroup\",\n \"iam:UpdateAssumeRolePolicy\",\n \"iam:UpdateUser\"\n]\n\n\nmanager_allow_actions=  [\n \"iam:AddUserToGroup\",\n \"iam:AttachGroupPolicy\",\n \"iam:DeleteGroupPolicy\",\n \"iam:DeleteUserPolicy\",\n \"iam:DetachGroupPolicy\",\n \"iam:DetachRolePolicy\",\n \"iam:DetachUserPolicy\",\n \"iam:PutGroupPolicy\",\n \"iam:PutUserPolicy\",\n \"iam:RemoveUserFromGroup\",\n \"iam:UpdateGroup\",\n \"iam:UpdateAssumeRolePolicy\",\n \"iam:UpdateUser\",\n \"iam:GetPolicy\",\n \"iam:GetPolicyVersion\",\n \"iam:GetRole\",\n \"iam:GetRolePolicy\",\n \"iam:GetUser\",\n \"iam:GetUserPolicy\",\n \"iam:ListEntitiesForPolicy\",\n \"iam:ListGroupPolicies\",\n \"iam:ListGroups\",\n \"iam:ListGroupsForUser\",\n \"iam:ListPolicies\",\n \"iam:ListPoliciesGrantingServiceAccess\",\n \"iam:ListPolicyVersions\",\n \"iam:ListRolePolicies\",\n \"iam:ListAttachedGroupPolicies\",\n \"iam:ListAttachedRolePolicies\",\n \"iam:ListAttachedUserPolicies\",\n \"iam:ListRoles\",\n \"iam:ListUsers\"\n]\n\nmanager_deny_actions= [\n \"iam:AttachRolePolicy\",\n \"iam:CreateGroup\",\n \"iam:CreatePolicy\",\n \"iam:CreatePolicyVersion\",\n \"iam:CreateRole\",\n \"iam:CreateUser\",\n \"iam:DeleteGroup\",\n \"iam:DeletePolicy\",\n \"iam:DeletePolicyVersion\",\n \"iam:DeleteRole\",\n \"iam:DeleteRolePolicy\",\n \"iam:DeleteUser\",\n \"iam:PutRolePolicy\"\n]\n\nmfa_condition = {\n                    \"Bool\": {\n                        \"aws:MultiFactorAuthPresent\": \"true\"\n                    }\n                }\n\n  describe \"Master Policy Allow Actions \" do\n    subject { master_allow_actions }\n    it { should_not be_empty }\n    it { should be_in aws_iam_policy(IAM_MASTER_POLICY_NAME).document.where(Effect: \"Allow\").actions.flatten }\n  end\n\n  describe \"Master Policy Deny Actions \" do\n    subject { master_deny_actions }\n    it { should_not be_empty }\n    it { should be_in aws_iam_policy(IAM_MASTER_POLICY_NAME).document.where(Effect: \"Deny\").actions.flatten}\n  end\n\n  describe aws_iam_policy(IAM_MASTER_POLICY_NAME) do\n    it { should be_attached_to_role(IAM_MASTER_ROLE_NAME) }\n  end\n\n  describe aws_iam_role(IAM_MASTER_ROLE_NAME).assume_role_policy_document do\n    its('actions') { should_not be_empty }\n    its('actions') { should be_in ['sts:AssumeRole','sts:AssumeRoleWithSAML','sts:AssumeRoleWithWebIdentity'] }\n  end\n\n  describe aws_iam_role(IAM_MASTER_ROLE_NAME).assume_role_policy_document.where(Action: \"sts:AssumeRole\").where(Effect: \"Allow\") do\n    its(\"principals.to_s\") { should match \":user/#{IAM_MASTER_USER_NAME}\"}\n    its(\"principals.to_s\") { should_not match \":user/#{IAM_MANAGER_USER_NAME}\"}\n  end if aws_iam_role(IAM_MANAGER_ROLE_NAME).assume_role_policy_document.where(Action: \"sts:AssumeRole\").exists?\n\n  describe \"Manager Policy Allow Actions \" do\n    subject { manager_allow_actions }\n    it { should_not be_empty }\n    it { should be_in aws_iam_policy(IAM_MANAGER_POLICY_NAME).document.where(Effect: \"Allow\").actions.flatten }\n  end\n\n  describe \"Manager Policy Deny Actions \" do\n    subject { manager_deny_actions }\n    it { should_not be_empty }\n    it { should be_in aws_iam_policy(IAM_MANAGER_POLICY_NAME).document.where(Effect: \"Deny\").actions.flatten}\n  end\n\n  describe aws_iam_policy(IAM_MANAGER_POLICY_NAME) do\n    it { should be_attached_to_role(IAM_MANAGER_ROLE_NAME) }\n  end\n\n  describe aws_iam_role(IAM_MANAGER_ROLE_NAME).assume_role_policy_document do\n    its('actions') { should_not be_empty }\n    its('actions') { should be_in ['sts:AssumeRole','sts:AssumeRoleWithSAML','sts:AssumeRoleWithWebIdentity'] }\n  end\n\n  describe aws_iam_role(IAM_MANAGER_ROLE_NAME).assume_role_policy_document.where(Action: \"sts:AssumeRole\").where(Effect: \"Allow\") do\n    its(\"principals.to_s\") { should match \":user/#{IAM_MANAGER_USER_NAME}\"}\n    its(\"principals.to_s\") { should_not match \":user/#{IAM_MASTER_USER_NAME}\"}\n  end if aws_iam_role(IAM_MANAGER_ROLE_NAME).assume_role_policy_document.where(Action: \"sts:AssumeRole\").exists?\nend\n","source_location":{"line":13,"ref":"./controls/cis-aws-foundations-1.18.rb"},"results":[{"status":"passed","code_desc":"Master Policy Allow Actions  should not be empty","run_time":9.7e-05,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"Master Policy Allow Actions  should be in \"iam:PutRolePolicy\", \"iam:ListUsers\", \"iam:ListRoles\", \"iam:ListRolePolicies\", \"iam:ListPolicyVersions\", \"iam:ListPoliciesGrantingServiceAccess\", \"iam:ListPolicies\", \"iam:ListGroupsForUser\", \"iam:ListGroups\", \"iam:ListGroupPolicies\", \"iam:ListEntitiesForPolicy\", \"iam:ListAttachedUserPolicies\", \"iam:ListAttachedRolePolicies\", \"iam:ListAttachedGroupPolicies\", \"iam:GetUserPolicy\", \"iam:GetUser\", \"iam:GetRolePolicy\", \"iam:GetRole\", \"iam:GetPolicyVersion\", \"iam:GetPolicy\", \"iam:DeleteUser\", \"iam:DeleteRolePolicy\", \"iam:DeleteRole\", \"iam:DeletePolicyVersion\", \"iam:DeletePolicy\", \"iam:DeleteGroup\", \"iam:CreateUser\", \"iam:CreateRole\", \"iam:CreatePolicyVersion\", \"iam:CreatePolicy\", \"iam:CreateGroup\", and \"iam:AttachRolePolicy\"","run_time":0.314016,"start_time":"2018-11-18T20:21:40-05:00"},{"status":"passed","code_desc":"Master Policy Deny Actions  should not be empty","run_time":0.000155,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"passed","code_desc":"Master Policy Deny Actions  should be in \"iam:UpdateUser\", \"iam:UpdateGroup\", \"iam:UpdateAssumeRolePolicy\", \"iam:RemoveUserFromGroup\", \"iam:PutUserPolicy\", \"iam:PutGroupPolicy\", \"iam:DetachUserPolicy\", \"iam:DetachRolePolicy\", \"iam:DetachGroupPolicy\", \"iam:DeleteUserPolicy\", \"iam:DeleteGroupPolicy\", \"iam:AttachGroupPolicy\", and \"iam:AddUserToGroup\"","run_time":0.332938,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"failed","code_desc":"Policy iam-master-policy should be attached to role \"iam-master-role-name\"","run_time":0.028694,"start_time":"2018-11-18T20:21:41-05:00","message":"expected `Policy iam-master-policy.attached_to_role?(\"iam-master-role-name\")` to return true, got false"},{"status":"failed","code_desc":"Assume Role Rolicy actions should not be empty","run_time":0.000225,"start_time":"2018-11-18T20:21:41-05:00","message":"expected `[].empty?` to return false, got true"},{"status":"passed","code_desc":"Assume Role Rolicy actions should be in \"sts:AssumeRole\", \"sts:AssumeRoleWithSAML\", and \"sts:AssumeRoleWithWebIdentity\"","run_time":0.000205,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"passed","code_desc":"Manager Policy Allow Actions  should not be empty","run_time":0.000106,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"passed","code_desc":"Manager Policy Allow Actions  should be in \"iam:UpdateUser\", \"iam:UpdateGroup\", \"iam:UpdateAssumeRolePolicy\", \"iam:RemoveUserFromGroup\", \"iam:PutUserPolicy\", \"iam:PutGroupPolicy\", \"iam:ListUsers\", \"iam:ListRoles\", \"iam:ListRolePolicies\", \"iam:ListPolicyVersions\", \"iam:ListPoliciesGrantingServiceAccess\", \"iam:ListPolicies\", \"iam:ListGroupsForUser\", \"iam:ListGroups\", \"iam:ListGroupPolicies\", \"iam:ListEntitiesForPolicy\", \"iam:ListAttachedUserPolicies\", \"iam:ListAttachedRolePolicies\", \"iam:ListAttachedGroupPolicies\", \"iam:GetUserPolicy\", \"iam:GetUser\", \"iam:GetRolePolicy\", \"iam:GetRole\", \"iam:GetPolicyVersion\", \"iam:GetPolicy\", \"iam:DetachUserPolicy\", \"iam:DetachRolePolicy\", \"iam:DetachGroupPolicy\", \"iam:DeleteUserPolicy\", \"iam:DeleteGroupPolicy\", \"iam:AttachGroupPolicy\", and \"iam:AddUserToGroup\"","run_time":0.356967,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"passed","code_desc":"Manager Policy Deny Actions  should not be empty","run_time":0.000169,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"passed","code_desc":"Manager Policy Deny Actions  should be in \"iam:PutRolePolicy\", \"iam:DeleteUser\", \"iam:DeleteRolePolicy\", \"iam:DeleteRole\", \"iam:DeletePolicyVersion\", \"iam:DeletePolicy\", \"iam:DeleteGroup\", \"iam:CreateUser\", \"iam:CreateRole\", \"iam:CreatePolicyVersion\", \"iam:CreatePolicy\", \"iam:CreateGroup\", and \"iam:AttachRolePolicy\"","run_time":0.360173,"start_time":"2018-11-18T20:21:41-05:00"},{"status":"failed","code_desc":"Policy iam-manager-policy should be attached to role \"iam-manager-role-name\"","run_time":0.026921,"start_time":"2018-11-18T20:21:42-05:00","message":"expected `Policy iam-manager-policy.attached_to_role?(\"iam-manager-role-name\")` to return true, got false"},{"status":"failed","code_desc":"Assume Role Rolicy actions should not be empty","run_time":0.000246,"start_time":"2018-11-18T20:21:42-05:00","message":"expected `[].empty?` to return false, got true"},{"status":"passed","code_desc":"Assume Role Rolicy actions should be in \"sts:AssumeRole\", \"sts:AssumeRoleWithSAML\", and \"sts:AssumeRoleWithWebIdentity\"","run_time":0.000197,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-3.6","title":"Ensure a log metric filter and alarm exist for AWS Management Console\nauthentication failures","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for failed console authentication attempts.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for failed console authentication attempts."}],"impact":0.7,"refs":[],"tags":{"rationale":"Monitoring failed console logins may decrease lead time to\ndetect an attempt to brute force a credential, which may provide an indicator,\nsuch as source IP, that can be used in other event correlation.","cis_impact":"","cis_rid":"3.6","cis_level":2,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79191-3","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = ConsoleLogin) &'><sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for AWS Management Console authentication failures and\nthe <cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<console_signin_failure_metric>_ --metric-transformations\nmetricName=_<console_signin_failure_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = ConsoleLogin) &'><sns_topic_arn> --protocol\n_<protocol_for_sns>_ --notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<console_signin_failure_alarm>_\n--metric-name _<console_signin_failure_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.6\" do\n  title \"Ensure a log metric filter and alarm exist for AWS Management Console\nauthentication failures\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for failed console authentication attempts.\"\n  impact 0.7\n  tag \"rationale\": \"Monitoring failed console logins may decrease lead time to\ndetect an attempt to brute force a credential, which may provide an indicator,\nsuch as source IP, that can be used in other event correlation.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.6\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79191-3\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = ConsoleLogin) &'><sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for AWS Management Console authentication failures and\nthe <cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<console_signin_failure_metric>_ --metric-transformations\nmetricName=_<console_signin_failure_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = ConsoleLogin) &'><sns_topic_arn> --protocol\n_<protocol_for_sns>_ --notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<console_signin_failure_alarm>_\n--metric-name _<console_signin_failure_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = \"{ ($.eventName = ConsoleLogin) && ($.errorMessage = \\\"Failed authentication\\\") }\"\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.6.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000125,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":8.0e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":7.1e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":9.5e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":7.2e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":0.000117,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-1.4","title":"Ensure access keys are rotated every 90 days or less","desc":"Access keys consist of an access key ID and secret access key, which\nare used to sign programmatic requests that you make to AWS. AWS users need\ntheir own access keys to make programmatic calls to AWS from the AWS Command\nLine Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct\nHTTP calls using the APIs for individual AWS services. It is recommended that\nall access keys be regularly rotated.","descriptions":[{"label":"default","data":"Access keys consist of an access key ID and secret access key, which\nare used to sign programmatic requests that you make to AWS. AWS users need\ntheir own access keys to make programmatic calls to AWS from the AWS Command\nLine Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct\nHTTP calls using the APIs for individual AWS services. It is recommended that\nall access keys be regularly rotated."}],"impact":0.3,"refs":[],"tags":{"rationale":"Rotating access keys will reduce the window of opportunity\nfor an access key that is associated with a compromised or terminated account\nto be used.\n\n'Access keys should be rotated to ensure that data cannot be accessed with an\nold key which might have been lost, cracked, or stolen.","cis_impact":"","cis_rid":"1.4","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78902-4","check":"Perform the following to determine if access keys are rotated\nas prescribed:\n\n* Login to the AWS Management Console\n* Click Services\n* Click IAM\n* Click on Credential Report\n* This will download an .xls file which contains Access Key usage for all IAM\nusers within an AWS Account - open this file\n\n* Focus on the following columns (where x = 1 or 2)\n\n* access_key_X_active\n* access_key_X_last_rotated\n* access_key_X_last_used_date\n\n\n* Ensure all active keys have been rotated within 90 days\n\n* Ensure all active keys have been used since last rotation\n\n* Keys not in-use since last rotation should be disabled/deleted\n\n'Via CLI\n\n'aws iam generate-credential-report\naws iam get-credential-report --query 'Content' --output text | base64 -d","fix":"Perform the following to rotate access keys:\n\n* Login to the AWS Management Console:\n* Click Services\n* Click IAM\n* Click on Users\n* Click on Security Credentials\n\n* As an Administrator\n\n* Click on Make Inactive for keys that have not been rotated in 90 Days\n\n* As an IAM User\n\n* Click on Make Inactive or Delete for keys which have not been rotated or used\nin the last 90 days\n\n\n* Click on Create Access Key\n* Update programmatic call with new Access Key credentials\n\n'Via CLI\n\n'aws iam update-access-key\naws iam create-access-key\naws iam delete-access-key"},"code":"control \"cis-aws-foundations-1.4\" do\n  title \"Ensure access keys are rotated every #{AWS_KEY_AGE} days or less\"\n  desc  \"Access keys consist of an access key ID and secret access key, which\nare used to sign programmatic requests that you make to AWS. AWS users need\ntheir own access keys to make programmatic calls to AWS from the AWS Command\nLine Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct\nHTTP calls using the APIs for individual AWS services. It is recommended that\nall access keys be regularly rotated.\"\n  impact 0.3\n  tag \"rationale\": \"Rotating access keys will reduce the window of opportunity\nfor an access key that is associated with a compromised or terminated account\nto be used.\n\n'Access keys should be rotated to ensure that data cannot be accessed with an\nold key which might have been lost, cracked, or stolen.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.4\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78902-4\"\n  tag \"check\": \"Perform the following to determine if access keys are rotated\nas prescribed:\n\n* Login to the AWS Management Console\n* Click Services\n* Click IAM\n* Click on Credential Report\n* This will download an .xls file which contains Access Key usage for all IAM\nusers within an AWS Account - open this file\n\n* Focus on the following columns (where x = 1 or 2)\n\n* access_key_X_active\n* access_key_X_last_rotated\n* access_key_X_last_used_date\n\n\n* Ensure all active keys have been rotated within #{AWS_KEY_AGE} days\n\n* Ensure all active keys have been used since last rotation\n\n* Keys not in-use since last rotation should be disabled/deleted\n\n'Via CLI\n\n'aws iam generate-credential-report\naws iam get-credential-report --query 'Content' --output text | base64 -d\"\n  tag \"fix\": \"Perform the following to rotate access keys:\n\n* Login to the AWS Management Console:\n* Click Services\n* Click IAM\n* Click on Users\n* Click on Security Credentials\n\n* As an Administrator\n\n* Click on Make Inactive for keys that have not been rotated in #{AWS_KEY_AGE} Days\n\n* As an IAM User\n\n* Click on Make Inactive or Delete for keys which have not been rotated or used\nin the last #{AWS_KEY_AGE} days\n\n\n* Click on Create Access Key\n* Update programmatic call with new Access Key credentials\n\n'Via CLI\n\n'aws iam update-access-key\naws iam create-access-key\naws iam delete-access-key\"\n\n  aws_iam_access_keys.where(active: true).entries.each do |key|\n    describe key.username do\n      context key do\n        its('created_days_ago') { should cmp <= AWS_KEY_AGE }\n        its('ever_used') { should be true }\n      end\n    end\n  end\n\n  describe \"Control skipped because no active iam access keys were found\" do\n    skip \"This control is skipped since the aws_iam_access_keys resource returned an empty active access key list\"\n  end if aws_iam_access_keys.where(active: true).entries.empty?\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-1.4.rb"},"results":[{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with active == true one entry created_days_ago should cmp <= 90","run_time":0.000182,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with active == true one entry ever_used should equal true","run_time":0.000108,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"failed","code_desc":"test-fixture-maker IAM Access Keys with active == true one entry created_days_ago should cmp <= 90","run_time":0.0002,"start_time":"2018-11-18T20:21:42-05:00","message":"\nexpected it to be <= 90\n     got: 313\n\n(compared using `cmp` matcher)\n"},{"status":"passed","code_desc":"test-fixture-maker IAM Access Keys with active == true one entry ever_used should equal true","run_time":9.9e-05,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-2.3","title":"Ensure the S3 bucket CloudTrail logs to is not publicly accessible","desc":"CloudTrail logs a record of every API call made in your AWS account.\nThese logs file are stored in an S3 bucket. It is recommended that the bucket\npolicy or access control list (ACL) applied to the S3 bucket that CloudTrail\nlogs to prevents public access to the CloudTrail logs.","descriptions":[{"label":"default","data":"CloudTrail logs a record of every API call made in your AWS account.\nThese logs file are stored in an S3 bucket. It is recommended that the bucket\npolicy or access control list (ACL) applied to the S3 bucket that CloudTrail\nlogs to prevents public access to the CloudTrail logs."}],"impact":0.3,"refs":[],"tags":{"rationale":"Allowing public access to CloudTrail log content may aid an\nadversary in identifying weaknesses in the affected account's use or\nconfiguration.","cis_impact":"","cis_rid":"2.3","cis_level":1,"csc_control":"","nist":["AU-9","Rev_4"],"cce_id":"CCE-78915-6","check":"Perform the following to determine if any public access is\ngranted to an S3 bucket via an ACL or S3 bucket policy:\n\n'Via the Management Console\n\n* Go to the Amazon CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/home\n[https://console.aws.amazon.com/cloudtrail/home]\n* In the API activity history pane on the left, click Trails\n* In the Trails pane, note the bucket names in the S3 bucket column\n* Go to Amazon S3 console at https://console.aws.amazon.com/s3/home\n[https://console.aws.amazon.com/s3/home]\n* For each bucket noted in step 3, right-click on the bucket and click\nProperties\n* In the Properties pane, click the Permissions tab.\n* The tab shows a list of grants, one row per grant, in the bucket ACL. Each\nrow identifies the grantee and the permissions granted.\n* Ensure no rows exists that have the Grantee set to Everyone or the Grantee\nset to Any Authenticated User.\n* If the Edit bucket policy button is present, click it to review the bucket\npolicy.\n* Ensure the policy does not contain a Statement having an Effect set to Allow\nand a Principal set to *.\n\n'Via CLI:\n\n* Get the name of the S3 bucket that CloudTrail is logging to:\n\n'aws cloudtrail describe-trails --query 'trailList[*].S3BucketName'\n\n* Ensure the AllUsers principal is not granted privileges to that _<bucket>_:\n\n'aws s3api get-bucket-acl --bucket <s3_bucket_for_cloudtrail> --query\n'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'\n\n* Ensure the AuthenticatedUsersprincipal is not granted privileges to that\n_<bucket>_:\n\n'aws s3api get-bucket-acl --bucket <s3_bucket_for_cloudtrail> --query\n'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated\nUsers`]'\n\n* Get the S3 Bucket Policy\n\n'aws s3api get-bucket-policy --bucket <s3_bucket_for_cloudtrail>\n* Ensure the policy does not contain a Statement having an Effect set to Allow\nand a Principal set to *.","fix":"Perform the following to remove any public access that has been\ngranted to the bucket via an ACL or S3 bucket policy:\n\n* Go to Amazon S3 console at https://console.aws.amazon.com/s3/home\n[https://console.aws.amazon.com/s3/home]\n* Right-click on the bucket and click Properties\n* In the Properties pane, click the Permissions tab.\n* The tab shows a list of grants, one row per grant, in the bucket ACL. Each\nrow identifies the grantee and the permissions granted.\n* Select the row that grants permission to Everyone or Any Authenticated User\n* Uncheck all the permissions granted to Everyone or Any Authenticated User\n(click x to delete the row).\n* Click Save to save the ACL.\n* If the Edit bucket policy button is present, click it.\n* Remove any Statement having an Effect set to Allow and a Principal set to *."},"code":"control \"cis-aws-foundations-2.3\" do\n  title \"Ensure the S3 bucket CloudTrail logs to is not publicly accessible\"\n  desc  \"CloudTrail logs a record of every API call made in your AWS account.\nThese logs file are stored in an S3 bucket. It is recommended that the bucket\npolicy or access control list (ACL) applied to the S3 bucket that CloudTrail\nlogs to prevents public access to the CloudTrail logs.\"\n  impact 0.3\n  tag \"rationale\": \"Allowing public access to CloudTrail log content may aid an\nadversary in identifying weaknesses in the affected account's use or\nconfiguration.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"2.3\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"AU-9\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78915-6\"\n  tag \"check\": \"Perform the following to determine if any public access is\ngranted to an S3 bucket via an ACL or S3 bucket policy:\n\n'Via the Management Console\n\n* Go to the Amazon CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/home\n[https://console.aws.amazon.com/cloudtrail/home]\n* In the API activity history pane on the left, click Trails\n* In the Trails pane, note the bucket names in the S3 bucket column\n* Go to Amazon S3 console at https://console.aws.amazon.com/s3/home\n[https://console.aws.amazon.com/s3/home]\n* For each bucket noted in step 3, right-click on the bucket and click\nProperties\n* In the Properties pane, click the Permissions tab.\n* The tab shows a list of grants, one row per grant, in the bucket ACL. Each\nrow identifies the grantee and the permissions granted.\n* Ensure no rows exists that have the Grantee set to Everyone or the Grantee\nset to Any Authenticated User.\n* If the Edit bucket policy button is present, click it to review the bucket\npolicy.\n* Ensure the policy does not contain a Statement having an Effect set to Allow\nand a Principal set to *.\n\n'Via CLI:\n\n* Get the name of the S3 bucket that CloudTrail is logging to:\n\n'aws cloudtrail describe-trails --query 'trailList[*].S3BucketName'\n\n* Ensure the AllUsers principal is not granted privileges to that _<bucket>_:\n\n'aws s3api get-bucket-acl --bucket <s3_bucket_for_cloudtrail> --query\n'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'\n\n* Ensure the AuthenticatedUsersprincipal is not granted privileges to that\n_<bucket>_:\n\n'aws s3api get-bucket-acl --bucket <s3_bucket_for_cloudtrail> --query\n'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated\nUsers`]'\n\n* Get the S3 Bucket Policy\n\n'aws s3api get-bucket-policy --bucket <s3_bucket_for_cloudtrail>\n* Ensure the policy does not contain a Statement having an Effect set to Allow\nand a Principal set to *.\"\n  tag \"fix\": \"Perform the following to remove any public access that has been\ngranted to the bucket via an ACL or S3 bucket policy:\n\n* Go to Amazon S3 console at https://console.aws.amazon.com/s3/home\n[https://console.aws.amazon.com/s3/home]\n* Right-click on the bucket and click Properties\n* In the Properties pane, click the Permissions tab.\n* The tab shows a list of grants, one row per grant, in the bucket ACL. Each\nrow identifies the grantee and the permissions granted.\n* Select the row that grants permission to Everyone or Any Authenticated User\n* Uncheck all the permissions granted to Everyone or Any Authenticated User\n(click x to delete the row).\n* Click Save to save the ACL.\n* If the Edit bucket policy button is present, click it.\n* Remove any Statement having an Effect set to Allow and a Principal set to *.\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  aws_cloudtrail_trails.trail_arns.each do |trail|\n    bucket_name = aws_cloudtrail_trail(trail).s3_bucket_name\n    describe \"Bucket not inspected because it is defined as an exception\" do\n      skip \"Bucket: #{bucket_name} not insepcted because it is defined in EXCEPTION_BUCKET_LIST.\"\n    end if EXCEPTION_BUCKET_LIST.include?(bucket_name)\n\n    next if EXCEPTION_BUCKET_LIST.include?(bucket_name)\n    describe aws_s3_bucket(bucket_name) do\n      it { should_not be_public }\n    end\n  end\n\n  # Use this after skeletal aws_cloudtrail_trails is enhanced to expose s3_bucket_name\n  # aws_cloudtrail_trails.s3_bucket_name.uniq.each do |bucket|\n  #   describe aws_s3_bucket( bucket ) do\n  #     it{ should_not be_public }\n  #   end\n  # end\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-2.3.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000105,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"S3 Bucket cis-cloudtrail-bucket-20181119002105722600000004 should not be public","run_time":0.133398,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-3.2","title":"Ensure a log metric filter and alarm exist for Management Console\nsign-in without MFA","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for console logins that are not protected by multi-factor\nauthentication (MFA).","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for console logins that are not protected by multi-factor\nauthentication (MFA)."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring for single-factor console logins will increase\nvisibility into accounts that are not protected by MFA.","cis_impact":"","cis_rid":"3.2","cis_level":1,"csc_control":[["5.5"],"6.0"],"nist":["AU-2","Rev_4"],"cce_id":"CCE-79187-1","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = 'ConsoleLogin') &'><sns_topic_arn> _\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for AWS Management Console sign-in without MFA and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<no_mfa_console_signin_metric>_ --metric-transformations\nmetricName=_<no_mfa_console_signin_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = 'ConsoleLogin') &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name\n_<em><no_mfa_console_signin__alarm></em> --metric-name\n_<no_mfa_console_signin_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.2\" do\n  title \"Ensure a log metric filter and alarm exist for Management Console\nsign-in without MFA\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for console logins that are not protected by multi-factor\nauthentication (MFA).\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring for single-factor console logins will increase\nvisibility into accounts that are not protected by MFA.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.2\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"5.5\"], \"6.0\"]\n  tag \"nist\": [\"AU-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79187-1\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ ($.eventName = 'ConsoleLogin') &'><sns_topic_arn> _\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for AWS Management Console sign-in without MFA and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<no_mfa_console_signin_metric>_ --metric-transformations\nmetricName=_<no_mfa_console_signin_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ ($.eventName = 'ConsoleLogin') &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name\n_<em><no_mfa_console_signin__alarm></em> --metric-name\n_<no_mfa_console_signin_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.2.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000172,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":8.4e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":8.2e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":0.000115,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":7.1e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":9.9e-05,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-1.5","title":"Ensure IAM password policy requires at least one uppercase letter","desc":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one uppercase letter.","descriptions":[{"label":"default","data":"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one uppercase letter."}],"impact":0.3,"refs":[],"tags":{"rationale":"Setting a password complexity policy increases account\nresiliency against brute force login attempts.","cis_impact":"","cis_rid":"1.5","cis_level":1,"csc_control":"","nist":["IA-5(1)","Rev_4"],"cce_id":"CCE-78903-2","check":"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Requires at least one uppercase letter' is checked under 'Password\nPolicy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireUppercaseCharacters':\ntrue","fix":"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Requires at least one uppercase letter'\n* Click 'Apply password policy'\n\n'Via CLI\n\n' aws iam update-account-password-policy --require-uppercase-characters\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command."},"code":"control \"cis-aws-foundations-1.5\" do\n  title \"Ensure IAM password policy requires at least one uppercase letter\"\n  desc  \"Password policies are, in part, used to enforce password complexity\nrequirements. IAM password policies can be used to ensure password are\ncomprised of different character sets. It is recommended that the password\npolicy require at least one uppercase letter.\"\n  impact 0.3\n  tag \"rationale\": \"Setting a password complexity policy increases account\nresiliency against brute force login attempts.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.5\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-5(1)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78903-2\"\n  tag \"check\": \"Perform the following to ensure the password policy is\nconfigured as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Ensure 'Requires at least one uppercase letter' is checked under 'Password\nPolicy'\n\n'Via CLI\n\n'aws iam get-account-password-policy\n\nEnsure the output of the above command includes 'RequireUppercaseCharacters':\ntrue\"\n  tag \"fix\": \"Perform the following to set the password policy as prescribed:\n\n'Via AWS Console\n\n* Login to AWS Console (with appropriate permissions to View Identity Access\nManagement Account Settings)\n* Go to IAM Service on the AWS Console\n* Click on Account Settings on the Left Pane\n* Check 'Requires at least one uppercase letter'\n* Click 'Apply password policy'\n\n'Via CLI\n\n' aws iam update-account-password-policy --require-uppercase-characters\n\n'Note: All commands starting with 'aws iam update-account-password-policy' can\nbe combined into a single command.\"\n\n  describe aws_iam_password_policy do\n    its('require_uppercase_characters?') { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.5.rb"},"results":[{"status":"passed","code_desc":"IAM Password-Policy require_uppercase_characters? should equal true","run_time":0.000134,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-2.2","title":"Ensure CloudTrail log file validation is enabled","desc":"CloudTrail log file validation creates a digitally signed digest file\ncontaining a hash of each log that CloudTrail writes to S3. These digest files\ncan be used to determine whether a log file was changed, deleted, or unchanged\nafter CloudTrail delivered the log. It is recommended that file validation be\nenabled on all CloudTrails.","descriptions":[{"label":"default","data":"CloudTrail log file validation creates a digitally signed digest file\ncontaining a hash of each log that CloudTrail writes to S3. These digest files\ncan be used to determine whether a log file was changed, deleted, or unchanged\nafter CloudTrail delivered the log. It is recommended that file validation be\nenabled on all CloudTrails."}],"impact":0.7,"refs":[],"tags":{"rationale":"Enabling log file validation will provide additional\nintegrity checking of CloudTrail logs.","cis_impact":"","cis_rid":"2.2","cis_level":2,"csc_control":[["6.3"],"6.0"],"nist":["AU-4","Rev_4"],"cce_id":"CCE-78914-9","check":"Perform the following on each trail to determine if log file\nvalidation is enabled:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n\n* Click on Trails on the left navigation pane\n\n* You will be presented with a list of trails across all regions\n\n\n* Ensure at least one Trail has All specified in the Region column\n* Click on a trail via the link in the _Name_ column\n* Under the S3 section, ensure Enable log file validation is set to Yes\n\n'Via CLI\n\n'aws cloudtrail describe-trails\n\n'Ensure LogFileValidationEnabled is set to true for each trail.","fix":"Perform the following to enable log file validation on a given\ntrail:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* Click on Trails on the left navigation pane\n* Click on target trail\n* Within the S3 section click on the edit icon (pencil)\n* Click Advanced\n* Click on the Yes radio button in section Enable log file validation\n* Click Save\n\n'Via CLI\n\n'aws cloudtrail update-trail --name _<trail_name>_ --enable-log-file-validation\n\n\n'Note that periodic validation of logs using these digests can be performed by\nrunning the following command:\n\n'aws cloudtrail validate-logs --trail-arn _<trail_arn>_ --start-time\n_<start_time>_ --end-time _<end_time>_"},"code":"control \"cis-aws-foundations-2.2\" do\n  title \"Ensure CloudTrail log file validation is enabled\"\n  desc  \"CloudTrail log file validation creates a digitally signed digest file\ncontaining a hash of each log that CloudTrail writes to S3. These digest files\ncan be used to determine whether a log file was changed, deleted, or unchanged\nafter CloudTrail delivered the log. It is recommended that file validation be\nenabled on all CloudTrails.\"\n  impact 0.7\n  tag \"rationale\": \"Enabling log file validation will provide additional\nintegrity checking of CloudTrail logs.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"2.2\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": [[\"6.3\"], \"6.0\"]\n  tag \"nist\": [\"AU-4\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78914-9\"\n  tag \"check\": \"Perform the following on each trail to determine if log file\nvalidation is enabled:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n\n* Click on Trails on the left navigation pane\n\n* You will be presented with a list of trails across all regions\n\n\n* Ensure at least one Trail has All specified in the Region column\n* Click on a trail via the link in the _Name_ column\n* Under the S3 section, ensure Enable log file validation is set to Yes\n\n'Via CLI\n\n'aws cloudtrail describe-trails\n\n'Ensure LogFileValidationEnabled is set to true for each trail.\"\n  tag \"fix\": \"Perform the following to enable log file validation on a given\ntrail:\n\n'Via the management Console\n\n* Sign in to the AWS Management Console and open the IAM console at\nhttps://console.aws.amazon.com/cloudtrail\n[https://console.aws.amazon.com/cloudtrail]\n* Click on Trails on the left navigation pane\n* Click on target trail\n* Within the S3 section click on the edit icon (pencil)\n* Click Advanced\n* Click on the Yes radio button in section Enable log file validation\n* Click Save\n\n'Via CLI\n\n'aws cloudtrail update-trail --name _<trail_name>_ --enable-log-file-validation\n\n\n'Note that periodic validation of logs using these digests can be performed by\nrunning the following command:\n\n'aws cloudtrail validate-logs --trail-arn _<trail_arn>_ --start-time\n_<start_time>_ --end-time _<end_time>_\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  aws_cloudtrail_trails.trail_arns.each do |trail|\n    describe aws_cloudtrail_trail(trail) do\n      it { should be_log_file_validation_enabled }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-2.2.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000112,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"CloudTrail arn:aws:cloudtrail:us-east-1:484747447281:trail/cis-trail-01 should be log file validation enabled","run_time":0.000116,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-3.3","title":"Ensure a log metric filter and alarm exist for usage of 'root' account","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for root login attempts.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for root login attempts."}],"impact":0.3,"refs":[],"tags":{"rationale":"Monitoring for root account logins will provide visibility\ninto the use of a fully privileged account and an opportunity to reduce the use\nof it.","cis_impact":"","cis_rid":"3.3","cis_level":1,"csc_control":[["4.6","5.1","5.5"],"6.0"],"nist":["AU-6(5)","AC-6(9)","AU-2","Rev_4"],"cce_id":"CCE-79188-9","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ $.userIdentity.type = \\'Root\\' &&\n$.userIdentity.invokedBy NOT EXISTS &'><sns_topic_arn> _\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for 'Root' account usage and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<root_usage_metric>_ --metric-transformations\nmetricName=_<root_usage_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ $.userIdentity.type = 'Root' && $.userIdentity.invokedBy\nNOT EXISTS &'><sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<root_usage__<em>__alarm></em>\n--metric-name _<root_usage_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.3\" do\n  title \"Ensure a log metric filter and alarm exist for usage of 'root' account\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for root login attempts.\"\n  impact 0.3\n  tag \"rationale\": \"Monitoring for root account logins will provide visibility\ninto the use of a fully privileged account and an opportunity to reduce the use\nof it.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.3\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"4.6\", \"5.1\",\"5.5\"], \"6.0\"]\n  tag \"nist\": [\"AU-6(5)\", \"AC-6(9)\", \"AU-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79188-9\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{ $.userIdentity.type = \\\\'Root\\\\' &&\n$.userIdentity.invokedBy NOT EXISTS &'><sns_topic_arn> _\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for 'Root' account usage and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<root_usage_metric>_ --metric-transformations\nmetricName=_<root_usage_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{ $.userIdentity.type = 'Root' && $.userIdentity.invokedBy\nNOT EXISTS &'><sns_topic_arn> --protocol _<protocol_for_sns>_\n--notification-endpoint _<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<root_usage__<em>__alarm></em>\n--metric-name _<root_usage_metric>_ --statistic Sum --period 300 --threshold 1\n--comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1\n--namespace 'CISBenchmark' --alarm-actions <sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.3.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000115,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":8.0e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":7.4e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":0.000107,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":9.5e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":9.0e-05,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-2.6","title":"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket","desc":"S3 Bucket Access Logging generates a log that contains access records\nfor each request made to your S3 bucket. An access log record contains details\nabout the request, such as the request type, the resources specified in the\nrequest worked, and the time and date the request was processed. It is\nrecommended that bucket access logging be enabled on the CloudTrail S3 bucket.","descriptions":[{"label":"default","data":"S3 Bucket Access Logging generates a log that contains access records\nfor each request made to your S3 bucket. An access log record contains details\nabout the request, such as the request type, the resources specified in the\nrequest worked, and the time and date the request was processed. It is\nrecommended that bucket access logging be enabled on the CloudTrail S3 bucket."}],"impact":0.3,"refs":[],"tags":{"rationale":"By enabling S3 bucket logging on target S3 buckets, it is\npossible to capture all events which may affect objects within an target\nbuckets. Configuring logs to be placed in a separate bucket allows access to\nlog information which can be useful in security and incident response\nworkflows.","cis_impact":"","cis_rid":"2.6","cis_level":1,"csc_control":[["14.6"],"6.0"],"nist":["AU-2","Rev_4"],"cce_id":"CCE-78918-0","check":"Perform the following ensure the CloudTrail S3 bucket has\naccess logging is enabled:\n\n'Via the management Console\n\n* Go to the Amazon CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/home\n[https://console.aws.amazon.com/cloudtrail/home]\n* In the API activity history pane on the left, click Trails\n* In the Trails pane, note the bucket names in the S3 bucket column\n* Sign in to the AWS Management Console and open the S3 console at\nhttps://console.aws.amazon.com/s3 [https://console.aws.amazon.com/s3].\n* Under All Buckets click on a target S3 bucket\n* Click on Properties in the top right of the console\n* Under Bucket:_<bucket_name>_ click on Logging\n* Ensure Enabled is checked.\n\n'Via CLI\n\n'aws s3api get-bucket-logging --bucket <s3_bucket_for_cloudtrail>","fix":"Perform the following to enable S3 bucket logging:\n\n'Via the Management Console\n\n* Sign in to the AWS Management Console and open the S3 console at\nhttps://console.aws.amazon.com/s3 [https://console.aws.amazon.com/s3].\n* Under All Buckets click on the target S3 bucket\n* Click on Properties in the top right of the console\n* Under Bucket:<s3_bucket_for_cloudtrail> click on Logging\n\n* Configure bucket logging\n\n* Click on Enabled checkbox\n* Select Target Bucket from list\n* Enter a Target Prefix\n* Click Save"},"code":"control \"cis-aws-foundations-2.6\" do\n  title \"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket\"\n  desc  \"S3 Bucket Access Logging generates a log that contains access records\nfor each request made to your S3 bucket. An access log record contains details\nabout the request, such as the request type, the resources specified in the\nrequest worked, and the time and date the request was processed. It is\nrecommended that bucket access logging be enabled on the CloudTrail S3 bucket.\"\n  impact 0.3\n  tag \"rationale\": \"By enabling S3 bucket logging on target S3 buckets, it is\npossible to capture all events which may affect objects within an target\nbuckets. Configuring logs to be placed in a separate bucket allows access to\nlog information which can be useful in security and incident response\nworkflows.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"2.6\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"14.6\"], \"6.0\"]\n  tag \"nist\": [\"AU-2\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-78918-0\"\n  tag \"check\": \"Perform the following ensure the CloudTrail S3 bucket has\naccess logging is enabled:\n\n'Via the management Console\n\n* Go to the Amazon CloudTrail console at\nhttps://console.aws.amazon.com/cloudtrail/home\n[https://console.aws.amazon.com/cloudtrail/home]\n* In the API activity history pane on the left, click Trails\n* In the Trails pane, note the bucket names in the S3 bucket column\n* Sign in to the AWS Management Console and open the S3 console at\nhttps://console.aws.amazon.com/s3 [https://console.aws.amazon.com/s3].\n* Under All Buckets click on a target S3 bucket\n* Click on Properties in the top right of the console\n* Under Bucket:_<bucket_name>_ click on Logging\n* Ensure Enabled is checked.\n\n'Via CLI\n\n'aws s3api get-bucket-logging --bucket <s3_bucket_for_cloudtrail>\"\n  tag \"fix\": \"Perform the following to enable S3 bucket logging:\n\n'Via the Management Console\n\n* Sign in to the AWS Management Console and open the S3 console at\nhttps://console.aws.amazon.com/s3 [https://console.aws.amazon.com/s3].\n* Under All Buckets click on the target S3 bucket\n* Click on Properties in the top right of the console\n* Under Bucket:<s3_bucket_for_cloudtrail> click on Logging\n\n* Configure bucket logging\n\n* Click on Enabled checkbox\n* Select Target Bucket from list\n* Enter a Target Prefix\n* Click Save\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  aws_cloudtrail_trails.trail_arns.each do |trail|\n    bucket_name = aws_cloudtrail_trail(trail).s3_bucket_name\n    describe \"Bucket not inspected because it is defined as an exception\" do\n      skip \"Bucket: #{bucket_name} not insepcted because it is defined in EXCEPTION_BUCKET_LIST.\"\n    end if EXCEPTION_BUCKET_LIST.include?(bucket_name)\n\n    next if EXCEPTION_BUCKET_LIST.include?(bucket_name)\n    describe aws_s3_bucket(bucket_name) do\n      it { should have_access_logging_enabled }\n    end\n  end\n\n  # Use this after skeletal aws_cloudtrail_trails is enhanced to expose s3_bucket_name\n  # aws_cloudtrail_trails.s3_bucket_name.uniq.each do |bucket|\n  #   describe aws_s3_bucket( bucket ) do\n  #     it{ should be_logging_enabled }\n  #   end\n  # end\nend\n","source_location":{"line":3,"ref":"./controls/cis-aws-foundations-2.6.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":9.8e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"S3 Bucket cis-cloudtrail-bucket-20181119002105722600000004 should have access logging enabled","run_time":0.02045,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-1.1","title":"Avoid the use of the 'root' account","desc":"The 'root' account has unrestricted access to all resources in the AWS\naccount. It is highly recommended that the use of this account be avoided.","descriptions":[{"label":"default","data":"The 'root' account has unrestricted access to all resources in the AWS\naccount. It is highly recommended that the use of this account be avoided."}],"impact":0.3,"refs":[],"tags":{"rationale":"The 'root' account is the most privileged AWS account.\nMinimizing the use of this account and adopting the principle of least\nprivilege for access management will reduce the risk of accidental changes and\nunintended disclosure of highly privileged credentials.","cis_impact":"","cis_rid":"1.1","cis_level":1,"csc_control":[["5.1"],"6.0"],"nist":["AC-6 (9)","Rev_4"],"cce_id":"","check":"Implement the Ensure a log metric filter and alarm exist for\nusage of 'root' account recommendation in the Monitoring section of this\nbenchmark to receive notifications of root account usage. Additionally,\nexecuting the following commands will provide ad-hoc means for determining the\nlast time the root account was used:\n'aws iam generate-credential-report\n'aws iam get-credential-report --query 'Content' --output text | base64 -d |\ncut -d, -f1,5,11,16 | grep -B1 '<root_account>'\n'Note: there are a few conditions under which the use of the root account is\nrequired, such as requesting a penetration test or creating a CloudFront\nprivate key.","fix":"Follow the remediation instructions of the Ensure IAM policies\nare attached only to groups or roles recommendation"},"code":"control \"cis-aws-foundations-1.1\" do\n  title \"Avoid the use of the 'root' account\"\n  desc  \"The 'root' account has unrestricted access to all resources in the AWS\naccount. It is highly recommended that the use of this account be avoided.\"\n  impact 0.3\n  tag \"rationale\": \"The 'root' account is the most privileged AWS account.\nMinimizing the use of this account and adopting the principle of least\nprivilege for access management will reduce the risk of accidental changes and\nunintended disclosure of highly privileged credentials.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.1\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": [[\"5.1\"], \"6.0\"]\n  tag \"nist\": [\"AC-6 (9)\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n\n  tag \"check\": \"Implement the Ensure a log metric filter and alarm exist for\nusage of 'root' account recommendation in the Monitoring section of this\nbenchmark to receive notifications of root account usage. Additionally,\nexecuting the following commands will provide ad-hoc means for determining the\nlast time the root account was used:\n'aws iam generate-credential-report\n'aws iam get-credential-report --query 'Content' --output text | base64 -d |\ncut -d, -f1,5,11,16 | grep -B1 '<root_account>'\n'Note: there are a few conditions under which the use of the root account is\nrequired, such as requesting a penetration test or creating a CloudFront\nprivate key.\"\n  tag \"fix\": \"Follow the remediation instructions of the Ensure IAM policies\nare attached only to groups or roles recommendation\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = '{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }'\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist}\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty }\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.1.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000166,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":8.4e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":7.8e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":0.000124,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":0.000115,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":0.000133,"start_time":"2018-11-18T20:21:42-05:00"}]},{"id":"cis-aws-foundations-1.19","title":"Maintain current contact details","desc":"Ensure contact email and telephone details for AWS accounts are\ncurrent and map to more than one individual in your organisation.\n\n'An AWS account supports a number of contact details, and AWS will use these to\ncontact the account owner if activity judged to be in breach of Acceptable Use\nPolicy or indicative of likely security compromise is observed by the AWS Abuse\nteam. Contact details should not be for a single individual, as circumstances\nmay arise where that individual is unavailable. Email contact details should\npoint to a mail alias which forwards email to multiple individuals within the\norganisation; where feasible, phone contact details should point to a PABX hunt\ngroup or other call-forwarding system.","descriptions":[{"label":"default","data":"Ensure contact email and telephone details for AWS accounts are\ncurrent and map to more than one individual in your organisation.\n\n'An AWS account supports a number of contact details, and AWS will use these to\ncontact the account owner if activity judged to be in breach of Acceptable Use\nPolicy or indicative of likely security compromise is observed by the AWS Abuse\nteam. Contact details should not be for a single individual, as circumstances\nmay arise where that individual is unavailable. Email contact details should\npoint to a mail alias which forwards email to multiple individuals within the\norganisation; where feasible, phone contact details should point to a PABX hunt\ngroup or other call-forwarding system."}],"impact":0.3,"refs":[],"tags":{"rationale":"If an AWS account is observed to be behaving in a\nprohibited or suspicious manner, AWS will attempt to contact the account owner\nby email and phone using the contact details listed. If this is unsuccessful\nand the account behaviour needs urgent mitigation, proactive measures may be\ntaken, including throttling of traffic between the account exhibiting\nsuspicious behaviour and the AWS API endpoints and the Internet. This will\nresult in impaired service to and from the account in question, so it is in\nboth the customers' and AWS' best interests that prompt contact can be\nestablished. This is best achieved by setting AWS account contact details to\npoint to resources which have multiple individuals as recipients, such as email\naliases and PABX hunt groups.","cis_impact":"","cis_rid":"1.19","cis_level":1,"csc_control":"","nist":["IA-4","Rev_4"],"cce_id":"","check":"This activity can only be performed via the AWS Console, with a\nuser who has permission to read and write Billing information\n(aws-portal:*Billing ).\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/.\n* On the navigation bar, choose your account name, and then choose My Account.\n\n* On the Account Settings page, review and verify the current details.\n* Under Contact Information, review and verify the current details.","fix":"This activity can only be performed via the AWS Console, with a\nuser who has permission to read and write Billing information\n(aws-portal:*Billing ).\n\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/.\n* On the navigation bar, choose your account name, and then choose My Account.\n\n* On the Account Settings page, next to Account Settings, choose Edit.\n* Next to the field that you need to update, choose Edit.\n* After you have entered your changes, choose Save changes.\n* After you have made your changes, choose Done.\n* To edit your contact information, under Contact Information, choose Edit.\n* For the fields that you want to change, type your updated information, and\nthen choose Update."},"code":"control \"cis-aws-foundations-1.19\" do\n  title \"Maintain current contact details\"\n  desc  \"Ensure contact email and telephone details for AWS accounts are\ncurrent and map to more than one individual in your organisation.\n\n'An AWS account supports a number of contact details, and AWS will use these to\ncontact the account owner if activity judged to be in breach of Acceptable Use\nPolicy or indicative of likely security compromise is observed by the AWS Abuse\nteam. Contact details should not be for a single individual, as circumstances\nmay arise where that individual is unavailable. Email contact details should\npoint to a mail alias which forwards email to multiple individuals within the\norganisation; where feasible, phone contact details should point to a PABX hunt\ngroup or other call-forwarding system.\"\n  impact 0.3\n  tag \"rationale\": \"If an AWS account is observed to be behaving in a\nprohibited or suspicious manner, AWS will attempt to contact the account owner\nby email and phone using the contact details listed. If this is unsuccessful\nand the account behaviour needs urgent mitigation, proactive measures may be\ntaken, including throttling of traffic between the account exhibiting\nsuspicious behaviour and the AWS API endpoints and the Internet. This will\nresult in impaired service to and from the account in question, so it is in\nboth the customers' and AWS' best interests that prompt contact can be\nestablished. This is best achieved by setting AWS account contact details to\npoint to resources which have multiple individuals as recipients, such as email\naliases and PABX hunt groups.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"1.19\"\n  tag \"cis_level\": 1\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"IA-4\", \"Rev_4\"]\n  tag \"cce_id\": \"\"\n  tag \"check\": \"This activity can only be performed via the AWS Console, with a\nuser who has permission to read and write Billing information\n(aws-portal:*Billing ).\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/.\n* On the navigation bar, choose your account name, and then choose My Account.\n\n* On the Account Settings page, review and verify the current details.\n* Under Contact Information, review and verify the current details.\"\n  tag \"fix\": \"This activity can only be performed via the AWS Console, with a\nuser who has permission to read and write Billing information\n(aws-portal:*Billing ).\n\n\n* Sign in to the AWS Management Console and open the Billing and Cost\nManagement console at https://console.aws.amazon.com/billing/home#/.\n* On the navigation bar, choose your account name, and then choose My Account.\n\n* On the Account Settings page, next to Account Settings, choose Edit.\n* Next to the field that you need to update, choose Edit.\n* After you have entered your changes, choose Save changes.\n* After you have made your changes, choose Done.\n* To edit your contact information, under Contact Information, choose Edit.\n* For the fields that you want to change, type your updated information, and\nthen choose Update.\"\n\n  describe \"Control has to be tested manually\" do\n    skip \"This control must be manually reviewed\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-1.19.rb"},"results":[{"status":"skipped","code_desc":"Control has to be tested manually","run_time":9.0e-06,"start_time":"2018-11-18T20:21:42-05:00","resource":"","skip_message":"This control must be manually reviewed"}]},{"id":"cis-aws-foundations-3.7","title":"Ensure a log metric filter and alarm exist for disabling or scheduled\ndeletion of customer created CMKs","desc":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for customer created CMKs which have changed state to disabled or\nscheduled deletion.","descriptions":[{"label":"default","data":"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for customer created CMKs which have changed state to disabled or\nscheduled deletion."}],"impact":0.7,"refs":[],"tags":{"rationale":"Data encrypted with disabled or deleted keys will no longer\nbe accessible.","cis_impact":"","cis_rid":"3.7","cis_level":2,"csc_control":"","nist":["SI-4(5)","Rev_4"],"cce_id":"CCE-79192-1","check":"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{($.eventSource = kms.amazonaws.com) &'><sns_topic_arn> _\n\n","fix":"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for disabled or scheduled for deletion CMK's and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<disable_or_delete_cmk_metric>_ --metric-transformations\nmetricName=_<disable_or_delete_cmk_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{($.eventSource = kms.amazonaws.com) &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<disable_or_delete_cmk_alarm>_\n--metric-name _<disable_or_delete_cmk_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n"},"code":"control \"cis-aws-foundations-3.7\" do\n  title \"Ensure a log metric filter and alarm exist for disabling or scheduled\ndeletion of customer created CMKs\"\n  desc  \"Real-time monitoring of API calls can be achieved by directing\nCloudTrail Logs to CloudWatch Logs and establishing corresponding metric\nfilters and alarms. It is recommended that a metric filter and alarm be\nestablished for customer created CMKs which have changed state to disabled or\nscheduled deletion.\"\n  impact 0.7\n  tag \"rationale\": \"Data encrypted with disabled or deleted keys will no longer\nbe accessible.\"\n  tag \"cis_impact\": \"\"\n  tag \"cis_rid\": \"3.7\"\n  tag \"cis_level\": 2\n  tag \"csc_control\": \"\"\n  tag \"nist\": [\"SI-4(5)\", \"Rev_4\"]\n  tag \"cce_id\": \"CCE-79192-1\"\n  tag \"check\": \"Perform the following to determine if the account is configured\nas prescribed: 1. Identify the log group name configured for use with\nCloudTrail:\n\n\n'aws cloudtrail describe-trails\n2. Note the <cloudtrail_log_group_name> value associated with\nCloudWatchLogsLogGroupArn:\n\n\n''arn:aws:logs:eu-west-1:<aws_account_number>:log-group:<cloudtrail_log_group_name>:*'\n\n3. Get a list of all associated metric filters for this\n<cloudtrail_log_group_name>:\n\n\n'aws logs describe-metric-filters --log-group-name\n'<cloudtrail_log_group_name>'4. Ensure the output from the above command\ncontains the following:\n\n\n''filterPattern': '{($.eventSource = kms.amazonaws.com) &'><sns_topic_arn> _\n\n\"\n  tag \"fix\": \"Perform the following to setup the metric filter, alarm, SNS\ntopic, and subscription:1. Create a metric filter based on filter pattern\nprovided which checks for disabled or scheduled for deletion CMK's and the\n<cloudtrail_log_group_name> taken from audit step 2.\n\n\n'aws logs put-metric-filter --log-group-name <cloudtrail_log_group_name>\n--filter-name _<disable_or_delete_cmk_metric>_ --metric-transformations\nmetricName=_<disable_or_delete_cmk_metric>_,metricNamespace='CISBenchmark',metricValue=1\n--filter-pattern '{($.eventSource = kms.amazonaws.com) &'><sns_topic_arn>\n--protocol _<protocol_for_sns>_ --notification-endpoint\n_<sns_subscription_endpoints>_\nNOTE: you can execute this command once and then re-use the SNS subscription\nfor all monitoring alarms.\n4. Create an alarm that is associated with the CloudWatch Logs Metric Filter\ncreated in step 1 and an SNS topic created in step 2\n\n\n'aws cloudwatch put-metric-alarm --alarm-name _<disable_or_delete_cmk_alarm>_\n--metric-name _<disable_or_delete_cmk_metric>_ --statistic Sum --period 300\n--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold\n--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions\n<sns_topic_arn>\n\"\n\n  describe aws_cloudtrail_trails do\n    it { should exist }\n  end\n\n  describe.one do\n    aws_cloudtrail_trails.trail_arns.each do |trail|\n      trail_log_group_name = aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.scan( /log-group:(.+):/ ).last.first unless aws_cloudtrail_trail(trail).cloud_watch_logs_log_group_arn.nil?\n\n      pattern = \"{ ($.eventSource = kms.amazonaws.com) && (($.eventName = DisableKey) || ($.eventName = ScheduleKeyDeletion)) }\"\n\n      describe aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name) do\n        it { should exist }\n      end\n\n      metric_name = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_name\n      metric_namespace = aws_cloudwatch_log_metric_filter(pattern: pattern, log_group_name: trail_log_group_name).metric_namespace\n      unless metric_name.nil? && metric_namespace.nil?\n        describe aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace ) do\n          it { should exist }\n          its ('alarm_actions') { should_not be_empty}\n        end\n\n        aws_cloudwatch_alarm(\n          metric_name: metric_name,\n          metric_namespace: metric_namespace).alarm_actions.each do |sns|\n          describe aws_sns_topic(sns) do\n            it { should exist }\n            its('confirmed_subscription_count') { should_not be_zero }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/cis-aws-foundations-3.7.rb"},"results":[{"status":"passed","code_desc":"CloudTrail Trails should exist","run_time":0.000105,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_log_metric_filter should exist","run_time":7.8e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm should exist","run_time":7.1e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"aws_cloudwatch_alarm alarm_actions should not be empty","run_time":0.000146,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns should exist","run_time":7.5e-05,"start_time":"2018-11-18T20:21:42-05:00"},{"status":"passed","code_desc":"SNS Topic arn:aws:sns:us-east-1:484747447281:cis-metric-sns confirmed_subscription_count should not be zero","run_time":9.1e-05,"start_time":"2018-11-18T20:21:42-05:00"}]}],"status":"loaded"}],"statistics":{"duration":7.264293},"version":"3.0.46"}