Overview
This report evaluates AWS configurations against the automated controls mapped to CIS AWS Compute Services (v1.0.0). The assessment covers 31 mapped controls using 30 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.
Mapped controls
- 10.1 Ensure you are using VPC Endpoints for source code access: VPC Configured to Use VPC Endpoints (PrivateLink)
- 2.1.2 Ensure Images (AMI's) are encrypted: Private AMI is Encrypted
- 2.1.4 Ensure Images (AMI) are not older than 90 days: Ensure Images (AMI) Are Not Older Than 90 Days
- 2.1.5 Ensure Images are not Publicly Available: No AMIs with Public Permissions
- 2.2.1 Ensure EBS volume encryption is enabled: EC2 Default Encryption is Enabled
- 2.2.2 Ensure public access to EBS Snapshots is disabled: EBS Snapshots Should Not Be Publicly Restorable
- 2.2.3 Ensure EBS volume snapshots are encrypted: EC2 Instance Volumes are Encrypted
- 2.2.4 Ensure unused EBS volumes are removed: EBS Volume In Use
- 2.3 Ensure Tag Policies are enabled: Ensure Tag Policies are enabled
- 2.4 Ensure an Organizational EC2 Tag Policy has been created: Ensure Tag Policies are enabled
- 2.6 Ensure detailed monitoring is enable for production EC2 Instances: EC2 Detailed Monitoring Enabled
- 2.7 Ensure Default EC2 Security groups are not being used: Default Security Group No Rules
- 2.8 Ensure the Use of IMDSv2 is Enforced on All Existing Instances: EC2 Instance Metadata Service v2 Enforced
- 2.9 Ensure use of AWS Systems Manager to manage EC2 instances: EC2 Instances Managed by Systems Manager (SSM)
- 2.10 Ensure unused ENIs are removed: Ensure Unused ENIs Are Removed
- 2.11 Ensure instances stopped for over 90 days are removed: No EC2 Instances Stopped for More Than 30 Days
- 2.12 Ensure EBS volumes attached to an EC2 instance is marked for deletion upon instance termination: Attached EBS Volume Delete on Termination Enabled
- 2.13 Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data: EC2 instances user data should not have secrets
- 2.14 Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches: Auto Scaling Group Propagates Tags to EC2 Instances
- 3.3 Disable SSH and RDP ports for Lightsail instances when not needed: Disable SSH and RDP ports for Lightsail instances when not needed
- 3.4 Ensure SSH is restricted to only IP address that should have this access: Ensure SSH is restricted to only IP address that should have this access
- 3.5 Ensure RDP is restricted to only IP address that should have this access: Ensure RDP is restricted to only IP address that should have this access
- 3.6 Disable IPv6 Networking if not in use within your organization: Disable IPv6 Networking if not in use within your organization
- 4.1 Ensure AWS Config is enabled for Lambda and serverless: Ensure that AWS Config is Enabled
- 4.6 Ensure Lambda functions are not exposed to everyone: No Public Accessible Lambda Functions
- 4.8 Ensure that Code Signing is enabled for Lambda functions: Lambda Code Signing is Enabled.
- 4.11 Ensure that the runtime environment versions used for your Lambda functions do not have end of support dates: Lambda Functions do not use Obsolete Runtimes.
- 6.1 Ensure Managed Platform updates is configured: Elastic Beanstalk Auto Updates Enabled
- 6.2 Ensure Persistent logs is setup and configured to S3: Elastic Beanstalk Streaming Logs to CloudWatch Enabled
- 6.3 Ensure access logs are enabled: Load Balancer Access Logging is Enabled.
- 6.4 Ensure that HTTPS is enabled on load balancer: Elastic Load Balancers Secure Listeners Only
The report includes actionable findings and remediation guidance for supported checks.