1. Assessment Phase

  • CIS AWS Foundations (v5.0) Compliance Assessment Execution
20 Credits

CIS AWS Foundations (v5.0) Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to CIS AWS Foundations (v5.0). The assessment covers 62 mapped controls using 64 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

  • 1.2 Ensure security contact information is registered: Security Contact Information Configured for the AWS Account
  • 1.3 Ensure no 'root' user account access key exists: No Access Keys for Root Account
  • 1.4 Ensure MFA is enabled for the 'root' user account: MFA for Root Account is Enabled
  • 1.5 Ensure hardware MFA is enabled for the 'root' user account: Hardware MFA for Root Account is Enabled
  • 1.6 Eliminate use of the 'root' user for administrative and daily tasks: Root Account Not Used
  • 1.7 Ensure IAM password policy requires minimum length of 14 or greater: IAM Password Policy Requires Minimum Length of 14 Characters
  • 1.8 Ensure IAM password policy prevents password reuse: IAM Password Policy Configured to Prevent Password Reuse (24 or Greater)
  • 1.9 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password: MFA for Users with Console Access
  • 1.10 Do not create access keys during initial setup for IAM users with a console password: Do Not Create Access Keys During Initial Setup for IAM Users with Console Password
  • 1.11 Ensure credentials unused for 45 days or more are disabled: No Unused IAM User Credentials (90 Days)
  • 1.12 Ensure there is only one active access key for any single IAM user: No IAM Users with Two Active Access Keys
  • 1.13 Ensure access keys are rotated every 90 days or less: IAM Access Keys Are Rotated every 90 Days
  • 1.14 Ensure IAM Users Receive Permissions Only Through Groups: IAM Policies Attached to Roles or Groups Only, IAM Users in Groups
  • 1.15 Ensure IAM policies that allow full :: No IAM Principals with Full Administrator Permissions ":"
  • 1.16 Ensure a support role has been created to manage incidents with AWS Support: IAM Support Role is Created
  • 1.17 Ensure IAM instance roles are used for AWS resource access from instances: IAM Instance Profile is Attached to EC2 Instance
  • 1.18 Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed: No Expired SSL/TLS Certificates Are Stored in AWS IAM
  • 1.19 Ensure that IAM External Access Analyzer is enabled for all regions: IAM Access Analyzer is Enabled
  • 1.20 Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments: AWS SSO is Enabled
  • 1.21 Ensure access to AWSCloudShellFullAccess is restricted: Access to AWSCloudShellFullAccess Is Restricted
  • 2.1.1 Ensure S3 Bucket Policy is set to deny HTTP requests: S3 Bucket Encryption in Transit is Enforced
  • 2.1.2 Ensure MFA Delete is enabled on S3 buckets: MFA Delete is Enabled for S3 Buckets
  • 2.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary: Amazon S3 Buckets Are Protected by Macie
  • 2.1.4 Ensure that S3 is configured with 'Block Public Access' enabled: No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level)
  • 2.2.1 Ensure that encryption-at-rest is enabled for RDS Instances: RDS Storage Encryption is Enabled
  • 2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances: RDS Auto Minor Version Upgrade Enabled
  • 2.2.3 Ensure that RDS instances are not publicly accessible: No Public RDS Instances
  • 2.2.4 Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS: RDS Multi Availability Zones Configured
  • 2.3.1 Ensure that encryption is enabled for EFS file systems: EFS Encryption At-Rest Enabled
  • 3.1 Ensure CloudTrail is enabled in all regions: Ensure CloudTrail is Enabled for this Region
  • 3.2 Ensure CloudTrail log file validation is enabled: Ensure that CloudTrail Log File Validation is Enabled
  • 3.3 Ensure AWS Config is enabled in all regions: Ensure that AWS Config is Enabled
  • 3.4 Ensure that server access logging is enabled on the CloudTrail S3 bucket: S3 Bucket for CloudTrail has Access Logging Enabled
  • 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs: Ensure that CloudTrail logs are encrypted using KMS
  • 3.6 Ensure rotation for customer-created symmetric CMKs is enabled: Ensure that KMS Key Rotation is Enabled
  • 3.7 Ensure VPC flow logging is enabled in all VPCs: VPC Flow Logs Enabled
  • 3.8 Ensure that Object-level logging for write events is enabled for S3 buckets: S3 Object-Level Logging with CloudTrail is Enabled for Write Events
  • 3.9 Ensure that Object-level logging for read events is enabled for S3 buckets: S3 Object-Level Logging with CloudTrail is Enabled for Read Events
  • 4.1 Ensure unauthorized API calls are monitored: Ensure a log metric filter and alarm exist for unauthorized API calls.
  • 4.2 Ensure management console sign-in without MFA is monitored: Ensure a log metric filter and alarm exist for Management Console sign-in without MFA.
  • 4.3 Ensure usage of the 'root' account is monitoredd: Ensure a log metric filter and alarm exist for usage of root account.
  • 4.4 Ensure IAM policy changes are monitored: Ensure a log metric filter and alarm exist for IAM policy changes.
  • 4.5 Ensure CloudTrail configuration changes are monitored: Ensure a log metric filter and alarm exist for CloudTrail configuration changes.
  • 4.6 Ensure AWS Management Console authentication failures are monitored: Ensure a log metric filter and alarm exist for AWS Management Console authentication failures.
  • 4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitored: Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs.
  • 4.8 Ensure S3 bucket policy changes are monitored: Ensure a log metric filter and alarm exist for S3 bucket policy changes.
  • 4.9 Ensure AWS Config configuration changes are monitored: Ensure a log metric filter and alarm exist for AWS Config configuration changes.
  • 4.10 Ensure security group changes are monitored: Ensure a log metric filter and alarm exist for security group changes.
  • 4.11 Ensure Network Access Control List (NACL) changes are monitored: Ensure a log metric filter and alarm exist for changes to Network Access Control Lists.
  • 4.12 Ensure changes to network gateways are monitored: Ensure a log metric filter and alarm exist for changes to network gateways.
  • 4.13 Ensure route table changes are monitored: Ensure a log metric filter and alarm exist for route table changes.
  • 4.14 Ensure VPC changes are monitored: Ensure a log metric filter and alarm exist for VPC changes.
  • 4.15 Ensure AWS Organizations changes are monitored: Ensure a log metric filter and alarm exist for changes to AWS Organizations.
  • 4.16 Ensure AWS Security Hub is enabled: AWS Security Hub is Enabled
  • 5.1.1 Ensure EBS Volume Encryption is Enabled in all Regions: EC2 Default Encryption is Enabled
  • 5.1.2 Ensure CIFS access is restricted to trusted networks to prevent unauthorized access: No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to CIFS Ports (TCP 445)
  • 5.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports: No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0)
  • 5.3 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports: No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389)
  • 5.4 Ensure no security groups allow ingress from ::/0 to remote server administration ports: No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389)
  • 5.5 Ensure the default security group of every VPC restricts all traffic: Default Security Group No Rules
  • 5.6 Ensure routing tables for VPC peering are "least access": VPC Peering Routing Tables Are "Least Access"
  • 5.7 Ensure that the EC2 Metadata Service only allows IMDSv2: EC2 Instance Metadata Service v2 Enforced

The report includes actionable findings and remediation guidance for supported checks.