CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS PCI DSS v4.0 Compliance Assessment Execution

20 Credits

AWS PCI DSS v4.0 Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS PCI DSS v4.0. The assessment covers 100 mapped controls using 222 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

A1.1.2: Controls are implemented such that each customer only has permission to access its own cardholder data and CDE: Backup Vault Recovery Point Manual Deletion is Disabled, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, No Public EBS Snapshots, ECS Containers Read-Only Access Check, EFS Access Point Root Directory Enforcement, EFS Access Point User Identity Enforcement Check, EMR Block Public Access Enabled, No Public Accessible Lambda Functions, No Public Neptune Cluster Snapshots, No Public RDS Instances, No Public RDS Snapshots, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, MFA Delete is Enabled for S3 Buckets, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, No Public SSM documents (customer owned)
A1.1.3: Controls are implemented such that each customer can only access resources allocated to them: Websocket and HTTP API routes should specify an authorization type, CloudFront Distribution Uses an ACM certificate, CloudFront Distribution is Protected by AWS WAF, CodeBuild GitHub or Bitbucket Use OAuth, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, EKS Control Plane Public Access is Restricted, EKS Control Plane Public Access Disabled, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, Network Firewall Policy Default Action for Fragmented Packets Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public RDS Instances, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, SageMaker Notebook Instance in VPC, EC2 Instance Compliant SSM Association Status, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), No Unused Network Access Control Lists (NACLs), VPC Route Tables Restrict Public Access to IGW, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), WAF Classic Regional Rule Group Not Empty Check
A1.2.1: Audit log capability is enabled for each customer's environment that is consistent: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, S3 Bucket for CloudTrail has Access Logging Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, CloudWatch Log Group Encryption Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, No Public S3 Buckets, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities: Security Contact Information Configured for the AWS Account
A3.3.1: Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure: API Gateway Stages have AWS X-Ray Tracing Enabled, CloudFormation Stack Notification Check, Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
A3.4.1: User accounts and access privileges to inscope system components are reviewed at least once every six months to ensure user accounts and access privileges remain appropriate based on job function, and that all access is authorized: Backup Vault Recovery Point Manual Deletion is Disabled, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, No Public EBS Snapshots, ECS Containers Read-Only Access Check, EFS Access Point Root Directory Enforcement, EFS Access Point User Identity Enforcement Check, EMR Block Public Access Enabled, No Empty IAM Groups, No Unused IAM User Credentials (90 Days), No Public Accessible Lambda Functions, No Public Neptune Cluster Snapshots, No Public RDS Instances, No Public RDS Snapshots, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, MFA Delete is Enabled for S3 Buckets, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, No Unused Secrets (90 days), No Public SSM documents (customer owned)
A3.5.1: A methodology is implemented for the prompt identification of attack patterns and undesirable behavior across systems: API Gateway Stages have AWS X-Ray Tracing Enabled, CloudFormation Stack Notification Check, Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
1.2.5: All services, protocols, and ports allowed are identified, approved, and have a defined business need: CloudFront Traffic to Origin Encrypted Check, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Distribution does not Use Deprecated SSL protocols, CloudFront SNI Enabled Check, CloudFront Security Policy Check, Application Load Balancer HTTP to HTTPS Redirect Enabled, Elastic Load Balancers Secure Listeners Only, EMR Kerberos Authentication Configured, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, S3 Bucket Encryption in Transit is Enforced, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
1.2.8: Configuration files for NSCs are secured from unauthorized access and are kept consistent with active network configurations: Websocket and HTTP API routes should specify an authorization type, CloudFront Distribution Uses an ACM certificate, CloudFront Distribution is Protected by AWS WAF, CodeBuild GitHub or Bitbucket Use OAuth, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, EKS Control Plane Public Access is Restricted, EKS Control Plane Public Access Disabled, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, Ensure a log metric filter and alarm exist for changes to network gateways., Network Firewall Policy Default Action for Fragmented Packets Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public RDS Instances, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, SageMaker Notebook Instance in VPC, EC2 Instance Compliant SSM Association Status, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), No Unused Network Access Control Lists (NACLs), VPC Route Tables Restrict Public Access to IGW, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), WAF Classic Regional Rule Group Not Empty Check
1.3.1: Inbound traffic to the CDE is restricted as follows: To only traffic that is necessary, All other traffic is specifically denied: Websocket and HTTP API routes should specify an authorization type, API Gateway Stage Protected by AWS WAF, CloudFront Distribution Uses an ACM certificate, CloudFront Distribution is Protected by AWS WAF, CodeBuild GitHub or Bitbucket Use OAuth, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, EC2 Instances in a VPC (No Classic EC2), EKS Control Plane Public Access is Restricted, EKS Control Plane Public Access Disabled, ElastiCache Subnet Group Check, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, Network Firewall Policy Default Action for Fragmented Packets Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public RDS Instances, Redshift Clusters Use Enhanced VPC Routing, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, SageMaker Notebook Instance in VPC, EC2 Instance Compliant SSM Association Status, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), No Unused Network Access Control Lists (NACLs), VPC Route Tables Restrict Public Access to IGW, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), Backup VPN Connection Configured, WAF Classic Regional Rule Group Not Empty Check
1.3.2: Outbound traffic from the CDE is restricted as follows: To only traffic that is necessary, All other traffic is specifically denied: Websocket and HTTP API routes should specify an authorization type, API Gateway Stage Protected by AWS WAF, CloudFront Distribution Uses an ACM certificate, CloudFront Distribution is Protected by AWS WAF, CodeBuild GitHub or Bitbucket Use OAuth, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, EC2 Instances in a VPC (No Classic EC2), EKS Control Plane Public Access is Restricted, EKS Control Plane Public Access Disabled, ElastiCache Subnet Group Check, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, Network Firewall Policy Default Action for Fragmented Packets Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public RDS Instances, Redshift Clusters Use Enhanced VPC Routing, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, SageMaker Notebook Instance in VPC, EC2 Instance Compliant SSM Association Status, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), No Unused Network Access Control Lists (NACLs), VPC Route Tables Restrict Public Access to IGW, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), Backup VPN Connection Configured, WAF Classic Regional Rule Group Not Empty Check
1.4.1: NSCs are implemented between trusted and untrusted networks: Websocket and HTTP API routes should specify an authorization type, API Gateway Stage Protected by AWS WAF, EC2 Instances in a VPC (No Classic EC2), ElastiCache Subnet Group Check, Redshift Clusters Use Enhanced VPC Routing, SageMaker Notebook Instance in VPC, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), VPC Route Tables Restrict Public Access to IGW, Backup VPN Connection Configured
1.4.2: Inbound traffic from untrusted networks to trusted networks is restricted: Websocket and HTTP API routes should specify an authorization type, API Gateway Stage Protected by AWS WAF, CloudFront Distribution Uses an ACM certificate, CloudFront Distribution is Protected by AWS WAF, CodeBuild GitHub or Bitbucket Use OAuth, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, EKS Control Plane Public Access is Restricted, EKS Control Plane Public Access Disabled, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, Network Firewall Policy Default Action for Fragmented Packets Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public RDS Instances, Redshift Clusters Use Enhanced VPC Routing, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, SageMaker Notebook Instance in VPC, EC2 Instance Compliant SSM Association Status, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), No Unused Network Access Control Lists (NACLs), VPC Route Tables Restrict Public Access to IGW, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), Backup VPN Connection Configured, WAF Classic Regional Rule Group Not Empty Check
1.4.3 Anti-spoofing measures are implemented to detect and block forged source IP addresses from entering the trusted network: Network Firewall Policy Default Action for Fragmented Packets Check, Network Firewall Policy Default Stateless Action Check, No Unused Network Firewall Policy Rule Groups
1.4.4: System components that store cardholder data are not directly accessible from untrusted networks: Websocket and HTTP API routes should specify an authorization type, API Gateway Stage Protected by AWS WAF, EC2 Instances in a VPC (No Classic EC2), ElastiCache Subnet Group Check, Redshift Clusters Use Enhanced VPC Routing, SageMaker Notebook Instance in VPC, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), VPC Route Tables Restrict Public Access to IGW, Backup VPN Connection Configured
1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties: EC2 Launch Templates Do Not Assign Public IPs, ECS Task Definition PID Mode Check
1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks: Websocket and HTTP API routes should specify an authorization type, CloudFront Distribution Uses an ACM certificate, CloudFront Distribution is Protected by AWS WAF, CodeBuild GitHub or Bitbucket Use OAuth, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, EKS Control Plane Public Access is Restricted, EKS Control Plane Public Access Disabled, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, Network Firewall Policy Default Action for Fragmented Packets Check, No Unused Network Firewall Policy Rule Groups, Network Firewall Stateless Rule Group Not Empty, No Public RDS Instances, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, SageMaker Notebook Instance in VPC, EC2 Instance Compliant SSM Association Status, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), No Unused Network Access Control Lists (NACLs), VPC Route Tables Restrict Public Access to IGW, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress), WAF Classic Regional Rule Group Not Empty Check
10.2.1.1: Audit logs capture all individual user access to cardholder data: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CloudWatch Alarm Action is Configured, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, EC2 Detailed Monitoring Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Security Hub is Enabled, AWS Step Functions State Machine Logging Enabled Check, SNS Topic Message Delivery Notification Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.1.2: Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.1.3: Audit logs capture all access to audit logs: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.1.4: Audit logs capture all invalid logical access attempts: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.1.5: Audit logs capture all changes to identification and authentication credentials including, but not limited: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.1.6: Records of all changes to audit log activity status are captured: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.1.7: Audit logs capture all creation and deletion of system-level objects: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.2.2: Sufficient data to be able to identify successful and failed attempts and who, what, when, where, and how for each event listed in requirement 10.2.2 are captured: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.3.1: Read access to audit logs files is limited to those with a job-related need: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, AWS Step Functions State Machine Logging Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.3.2: Audit log files are protected to prevent modifications by individuals: Backup Vault Recovery Point Manual Deletion is Disabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Bucket for CloudTrail has Access Logging Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, No Public EBS Snapshots, ECS Containers Read-Only Access Check, EFS Access Point Root Directory Enforcement, EFS Access Point User Identity Enforcement Check, EMR Block Public Access Enabled, No Public Accessible Lambda Functions, CloudWatch Log Group Encryption Enabled, No Public Neptune Cluster Snapshots, No Public RDS Instances, No Public RDS Snapshots, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, MFA Delete is Enabled for S3 Buckets, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, No Public SSM documents (customer owned)
10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Bucket for CloudTrail has Access Logging Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, DynamoDB Tables Covered by AWS Backup, DynamoDB Table Point-in-time Recovery Enabled, EBS Volume In Use, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, ElastiCache (Redis) Snapshot Retention Period 7 days or More, FSx File Systems Covered by AWS Backup, CloudWatch Log Group Encryption Enabled, Neptune Backup Retention Period Set to 7 Days or More, RDS Cross-Region Automated Backup is Enabled, RDS and Aurora Covered by AWS Backup, Redshift Automatic Snapshots Enabled, No Public S3 Buckets
10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts: CloudFront S3 Origin Access Control Check, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Bucket for CloudTrail has Access Logging Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Group Encryption Enabled, S3 Bucket Object Lock is Enabled, S3 Bucket Versioning Enabled, No Public S3 Buckets
10.4.1: Potentially suspicious or anomalous activities are quickly identified to minimize impact: API Gateway Stages have AWS X-Ray Tracing Enabled, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
10.4.1.1: Automated mechanisms are used to perform audit log reviews: API Gateway Stages have AWS X-Ray Tracing Enabled, Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, Ensure that AWS Config is Enabled, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
10.4.2: Logs of all other system components (those not specified in Requirement 10.4.2) are reviewed periodically: API Gateway Stages have AWS X-Ray Tracing Enabled, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
10.4.3: Exceptions and anomalies identified during the review process are addressed: CloudWatch Alarm Action is Configured
10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, S3 Bucket for CloudTrail has Access Logging Enabled, Ensure CloudTrail is Enabled for this Region, CloudWatch Log Groups Retention Policy Configured, DocumentDB Backup Retention Period Over 7 Days, DynamoDB Table Point-in-time Recovery Enabled, EBS Volumes Covered by AWS Backup, ECR Lifecycle Policies Enabled, Amazon Elasticsearch Domain Application/Performance Logging Enabled, Elasticsearch Audit Logging is Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check
10.6.3: Time synchronization settings and data are protected: API Gateway Stages have AWS X-Ray Tracing Enabled, API Gateway Stage Logging is Enabled, AWS AppSync API Logging Configuration Check, CloudFront Distribution has Access Logging Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure CloudTrail is Enabled for this Region, CloudWatch Alarm Action is Configured, CodeBuild Project Logging Enabled Check, DMS Replication Task Logging Enabled, EC2 Detailed Monitoring Enabled, ECS Containers Read-Only Access Check, ECS Task Definition Log Configuration Check, EKS Control Plane Logging Enabled, Elastic Beanstalk Streaming Logs to CloudWatch Enabled, Load Balancer Access Logging is Enabled., Classic Load Balancer Desync Mode Configuration Check, API Gateway V2 Stage Access Logging is Enabled, IAM Users in Groups, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., Neptune Audit logging Enabled, Network Firewall Logging Enabled Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS Logging Enabled, RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled, RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled, Redshift Clusters Audit Logging Enabled, Route53 Public Zones Logging Enabled, S3 Bucket Access Logging Enabled, Cross-Account S3 permissions In Bucket Policies Are Restricted, AWS Security Hub is Enabled, AWS Step Functions State Machine Logging Enabled Check, SNS Topic Message Delivery Notification Enabled Check, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
10.7.1: Additional requirement for service providers only: Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure: API Gateway Stages have AWS X-Ray Tracing Enabled, CloudFormation Stack Notification Check, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
10.7.2: Failures in critical security control systems are promptly identified and addressed: API Gateway Stages have AWS X-Ray Tracing Enabled, CloudFormation Stack Notification Check, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Ensure a log metric filter and alarm exist for S3 bucket policy changes., Ensure a log metric filter and alarm exist for CloudTrail configuration changes., Ensure a log metric filter and alarm exist for AWS Config configuration changes., Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for IAM policy changes., Ensure a log metric filter and alarm exist for changes to Network Access Control Lists., Ensure a log metric filter and alarm exist for changes to network gateways., Ensure a log metric filter and alarm exist for usage of root account., Ensure a log metric filter and alarm exist for route table changes., Ensure a log metric filter and alarm exist for security group changes., Ensure a log metric filter and alarm exist for unauthorized API calls., Ensure a log metric filter and alarm exist for VPC changes., AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
11.3.1: Internal vulnerability scans are performed: Image Scan on Push is Enabled, EC2 Instances Compliant with SSM Patching Requirements
11.3.1.1: All other applicable vulnerabilities (those not ranked as high-risk vulnerabilities or critical vulnerabilities according to the entity's vulnerability risk rankings): Amazon GuardDuty is Enabled, EC2 Instances Compliant with SSM Patching Requirements, VPC Flow Logs Enabled, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
11.3.1.2: Application-layer penetration tests include application components that support or impact the security of cardholder data: Image Scan on Push is Enabled, Amazon GuardDuty is Enabled, AWS Security Hub is Enabled
11.3.1.3: 3 Internal vulnerability scans are performed after any significant change: Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure that CloudTrail Logs are forwarded to CloudWatch, No Internet-Facing EC2 Instances, Image Scan on Push is Enabled, Amazon GuardDuty is Enabled, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No Public Accessible Lambda Functions, No Public S3 Buckets, AWS Security Hub is Enabled, EC2 Instances Compliant with SSM Patching Requirements, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
11.5.1: Intrusion-detection and/or intrusionprevention techniques are used to detect and/or prevent intrusions into the network: Amazon GuardDuty is Enabled
11.5.1.1: Additional requirement for service providers only: Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels: Amazon GuardDuty is Enabled, AWS Security Hub is Enabled, VPC Flow Logs Enabled, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
11.5.2: A change-detection mechanism (for example, file integrity monitoring tools) is deployed: CloudFormation Stack Notification Check, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, Ensure that AWS Config is Enabled, No Internet-Facing EC2 Instances, Amazon GuardDuty is Enabled, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", MFA for Users with Console Access, No Public Accessible Lambda Functions, Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for usage of root account., S3 Event Notifications Enabled Check, No Public S3 Buckets, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
11.6.1: A change- and tamper-detection mechanism is deployed: CloudFormation Stack Notification Check, Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, Amazon GuardDuty is Enabled, Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for usage of root account., S3 Event Notifications Enabled Check, AWS Security Hub is Enabled, SNS Topic Message Delivery Notification Enabled Check
12.10.5: The security incident response plan includes monitoring and responding to alerts from security monitoring systems: CloudFormation Stack Notification Check, Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, Ensure a log metric filter and alarm exist for AWS Management Console authentication failures., Ensure a log metric filter and alarm exist for Management Console sign-in without MFA., Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs., Ensure a log metric filter and alarm exist for usage of root account., S3 Event Notifications Enabled Check, SNS Topic Message Delivery Notification Enabled Check
2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons: CloudFront Traffic to Origin Encrypted Check, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Distribution does not Use Deprecated SSL protocols, CloudFront SNI Enabled Check, CloudFront Security Policy Check, Application Load Balancer HTTP to HTTPS Redirect Enabled, Elastic Load Balancers Secure Listeners Only, EMR Kerberos Authentication Configured, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, S3 Bucket Encryption in Transit is Enforced, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
2.2.7: All non-console administrative access is encrypted using strong cryptography: CloudFront Traffic to Origin Encrypted Check, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Distribution does not Use Deprecated SSL protocols, ElastiCache (Redis) Encryption In-Transit is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Load Balancers Use SSL Certificates, Elastic Load Balancers Secure Listeners Only, EMR Kerberos Authentication Configured, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, S3 Bucket Encryption in Transit is Enforced
3.2.1: Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, CloudWatch Log Groups Retention Policy Configured, DocumentDB Backup Retention Period Over 7 Days, DynamoDB Table Point-in-time Recovery Enabled, EBS Volumes Covered by AWS Backup, ECR Lifecycle Policies Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check
3.3.1.1: The full contents of any track are not stored upon completion of the authorization process: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, CloudWatch Log Groups Retention Policy Configured, DocumentDB Backup Retention Period Over 7 Days, DynamoDB Table Point-in-time Recovery Enabled, EBS Volumes Covered by AWS Backup, ECR Lifecycle Policies Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check
3.3.1.3 The personal identification number (PIN) and the PIN block are not stored upon completion of the authorization process: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, CloudWatch Log Groups Retention Policy Configured, DocumentDB Backup Retention Period Over 7 Days, DynamoDB Table Point-in-time Recovery Enabled, EBS Volumes Covered by AWS Backup, ECR Lifecycle Policies Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check
3.3.2: SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, CloudWatch Log Groups Retention Policy Configured, DocumentDB Backup Retention Period Over 7 Days, DynamoDB Table Point-in-time Recovery Enabled, EBS Volumes Covered by AWS Backup, ECR Lifecycle Policies Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check
3.3.3: Additional requirement for issuers and companies that support issuing services and store sensitive authentication: Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, CloudWatch Log Groups Retention Policy Configured, DocumentDB Backup Retention Period Over 7 Days, DynamoDB Table Point-in-time Recovery Enabled, EBS Volumes Covered by AWS Backup, ECR Lifecycle Policies Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Version Lifecycle Policy Check
3.5.1.1: Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated keymanagement processes and procedures: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.5.1.3: If disk-level or partition-level encryption is used (rather than file-, column-, or field-level database encryption) to render PAN unreadable: Imported and ACM-issued certificates should be renewed within 30 days of expiration, Backup Vault Recovery Point Manual Deletion is Disabled, CloudFront Distribution Uses an ACM certificate, Ensure that a Multi-Region CloudTrail Trail is Configured, Database Migration Service Instance Not Public, Amazon DocumentDB Cluster Snapshot Public Access Check, No Public EBS Snapshots, ECS Containers Read-Only Access Check, EFS Access Point Root Directory Enforcement, EFS Access Point User Identity Enforcement Check, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Block Public Access Enabled, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion, No Public Accessible Lambda Functions, No Public Neptune Cluster Snapshots, No Public RDS Instances, No Public RDS Snapshots, No Public Redshift Clusters, S3 Access Points Allow VPC Access Only, MFA Delete is Enabled for S3 Buckets, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, No Public SSM documents (customer owned)
3.6.1.2: Secret and private keys used to protect stored account data: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.6.1.3: Access to cleartext cryptographic key components is restricted to the fewest number of custodians necessary: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.6.1.4: Cryptographic keys are stored in the fewest possible locations: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.7.1: Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.7.2: Key-management policies and procedures are implemented to include secure distribution of cryptographic keys used to protect stored account data: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.7.4: Key management policies and procedures are implemented for cryptographic key changes for keys that have reached the end of their cryptoperiod, as defined by the associated application vendor or key owner: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, Ensure that KMS Key Rotation is Enabled, KMS Keys Not Pending Deletion
3.7.5: Key management policies procedures are implemented to include the retirement, replacement, or destruction of keys used to protect stored account data: Imported and ACM-issued certificates should be renewed within 30 days of expiration, Ensure that KMS Key Rotation is Enabled
3.7.6 Where manual cleartext cryptographic keymanagement operations are performed by personnel, key-management policies and procedures are implemented, including managing these operations using split knowledge and dual control: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
3.7.7 Key management policies and procedures are implemented to include the prevention of unauthorized substitution of cryptographic keys: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Distribution Uses an ACM certificate, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion
4.2.1: Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission: CloudFront Traffic to Origin Encrypted Check, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Distribution does not Use Deprecated SSL protocols, ElastiCache (Redis) Encryption In-Transit is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Load Balancers Use SSL Certificates, Elastic Load Balancers Secure Listeners Only, EMR Kerberos Authentication Configured, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, S3 Bucket Encryption in Transit is Enforced
4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained: Imported and ACM-issued certificates should be renewed within 30 days of expiration, CloudFront Traffic to Origin Encrypted Check, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Distribution does not Use Deprecated SSL protocols, CloudFront Distribution Uses an ACM certificate, ElastiCache (Redis) Encryption In-Transit is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Elastic Load Balancers Secure Listeners Only, Load Balancers Use SSL Certificates, EMR Kerberos Authentication Configured, Elasticsearch Node-to-Node Encryption is Enabled, No IAM Principals with access to blocked actions on KMS, KMS Keys Not Pending Deletion, Elasticsearch Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, S3 Bucket Encryption in Transit is Enforced
6.3.3: All system components are protected from known vulnerabilities by installing applicable security patches/updates: ECS Fargate Services Latest Platform Version Check, Elastic Beanstalk Auto Updates Enabled, ElastiCache Auto Minor Version Upgrade Check, Lambda Functions do not use Obsolete Runtimes., Amazon Elasticsearch Software Updates are Available, RDS Auto Minor Version Upgrade Enabled, Redshift Version Auto-Update Enabled, EC2 Instances Compliant with SSM Patching Requirements
6.4.1: For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks: API Gateway Stage Protected by AWS WAF, CloudFront Distribution is Protected by AWS WAF, Application Load Balancers Protected by AWS WAF, WAF Classic Regional Rule Group Not Empty Check, No Empty WAF Web ACLs
6.4.2: For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks: API Gateway Stage Protected by AWS WAF, CloudFront Distribution is Protected by AWS WAF, Application Load Balancers Protected by AWS WAF, WAF Classic Regional Rule Group Not Empty Check, No Empty WAF Web ACLs
6.5.5: Live PANs are not used in pre-production environments, except where those environments are included in the CDE and protected in accordance with all applicable PCI DSS requirements: CodeDeploy Lambda Deployment Group Traffic Shift Check
6.5.6: Test data and test accounts are removed from system components before the system goes into production: CodeDeploy Lambda Deployment Group Traffic Shift Check
7.2.1: An access control model is defined and includes granting access: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, CodeBuild Project Environment Privileged Mode Check, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, ECS Task Definition Non-Root User Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, IAM Users in Groups, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted, SageMaker Notebook Instance Root Access Disabled, Default Security Group No Rules, VPC Flow Logs Enabled, No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
7.2.2: Access is assigned to users, including privileged users: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, CodeBuild Project Environment Privileged Mode Check, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, ECS Task Definition Non-Root User Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, IAM Users in Groups, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted, SageMaker Notebook Instance Root Access Disabled
7.2.3: Required privileges are approved by authorized personnel: CodeBuild Project Environment Privileged Mode Check, ECS Task Definition Non-Root User Check, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, SageMaker Notebook Instance Root Access Disabled
7.2.4: All user accounts and related access privileges, including third-party/vendor accounts, are reviewed: No Empty IAM Groups, No Unused IAM User Credentials (90 Days), No Unused Secrets (90 days)
7.2.5: All application and system accounts and related access privileges are assigned and managed: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted
7.2.5.1: All access by application and system accounts and related access privileges are reviewed: No Empty IAM Groups, No Unused IAM User Credentials (90 Days), No Unused Secrets (90 days)
7.2.6: All user access to query repositories of stored cardholder data: ECS Containers Read-Only Access Check, IAM Users in Groups, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, Cross-Account S3 permissions In Bucket Policies Are Restricted, No Public RDS Instances, No Public Redshift Clusters, No Public S3 Buckets, No Direct Internet Access for SageMaker Notebook Instance
7.3.1: An access control system(s) is in place that restricts access based on a user's need to know and covers all system components: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, IAM Users in Groups, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted, No Unused Secrets (90 days), No Security Group Rules Allowing Insecure Ports (Ingress), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to All Ports (Ingress)
7.3.2: The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, IAM Users in Groups, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted, No Unused Secrets (90 days)
7.3.3: The access control system(s) is set to “deny all” by default: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Ensure that CloudTrail Logs are forwarded to CloudWatch, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, MFA for Users with Console Access, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted, AWS Security Hub is Enabled
8.2.1: All users are assigned a unique ID before access to system components or cardholder data is allowed: EC2 Instance not launched with Key Pair, No Empty IAM Groups, No Access Keys for Root Account, IAM Users in Groups, Ensure a log metric filter and alarm exist for usage of root account.
8.2.2: Group, shared, or generic IDs, or other shared authentication credentials are only used when necessary on an exception basis, and are managed: CodeBuild Environment Variables Do No Contain Secrets, EC2 Instance not launched with Key Pair, No Empty IAM Groups, No Access Keys for Root Account, IAM Users in Groups, Ensure a log metric filter and alarm exist for usage of root account., Secrets Manager Secrets Automatic Rotation is Enabled, No Unused Secrets (90 days), Secrets Manager Secrets Are Rotated Per Schedule
8.2.4: Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed: EC2 Instance not launched with Key Pair, No Empty IAM Groups, No Access Keys for Root Account, IAM Users in Groups, Ensure a log metric filter and alarm exist for usage of root account.
8.2.5: Access for terminated users is immediately revoked: EC2 Instance not launched with Key Pair, No Empty IAM Groups, No Access Keys for Root Account, IAM Users in Groups, Ensure a log metric filter and alarm exist for usage of root account.
8.2.6: Inactive user accounts are removed or disabled within 90 days of inactivity: No Empty IAM Groups, No Unused IAM User Credentials (90 Days), No Unused Secrets (90 days)
8.2.7: Accounts used by third parties to access, support, or maintain system components via remote access are managed: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", IAM Policies Attached to Roles or Groups Only, Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted
8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session: AWS account is part of AWS Organizations, Auto Scaling Launch Configuration has IMDSv2 Enforced, Backup Vault Recovery Point Manual Deletion is Disabled, IAM Instance Profile is Attached to EC2 Instance, EC2 Instance Metadata Service v2 Enforced, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", IAM Policies Attached to Roles or Groups Only, Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted
8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components: API Gateway Stage Cache Encryption At-Rest is Enabled, Athena Workgroup Encryption at Rest Check, Backup Recovery Points are Encrypted, CloudFront Traffic to Origin Encrypted Check, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Distribution does not Use Deprecated SSL protocols, Ensure that CloudTrail logs are encrypted using KMS, AWS CodeBuild Project Artifact Encryption Check, CodeBuild Environment Variables Do No Contain Secrets, CodeBuild S3 Logs Encryption is Enabled, DAX Cluster Encyption At-Rest is Enabled, DocumentDB Encryption At-Rest Enabled, DynamoDB Encryption with KMS Enabled, EBS Volume is Encrypted, EC2 Default Encryption is Enabled, EFS Encryption At-Rest Enabled, Kubernetes Secrets are Encrypted with KMS, ElastiCache (Redis) Encryption At-Rest is Enabled , ElastiCache (Redis) Encryption In-Transit is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Load Balancers Use SSL Certificates, Elastic Load Balancers Secure Listeners Only, EMR Kerberos Authentication Configured, Elasticsearch Storage Encryption is Enabled, Elasticsearch Node-to-Node Encryption is Enabled, Kinesis Data Stream Server Side Encryption Enabled, CloudWatch Log Group Encryption Enabled, Neptune Encryption At-Rest is Enabled, Neptune Cluster Snapshot Encryption Check, Elasticsearch Enforces HTTPS for Client Access, RDS Storage Encryption is Enabled, RDS Snapshots are Encrypted At-Rest, Redshift Cluster Encryption In-Transit is Enabled, Redshift Clusters Encrypted At-Rest, S3 Bucket Encryption is Enabled, S3 Default Encryption with KMS Key Check, S3 Bucket Encryption in Transit is Enforced, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, Secrets Manager Secrets Use Custom KMS Key, SNS Topic Encryption Enabled
8.3.4: Invalid authentication attempts are limited: AWS account is part of AWS Organizations, Backup Vault Recovery Point Manual Deletion is Disabled, IAM Instance Profile is Attached to EC2 Instance, ECS Containers Read-Only Access Check, No IAM Principals with all service access or wildcard service access, No Inline IAM Policies Attached, No IAM Principals with access to blocked actions on KMS, No IAM Principals with Full Administrator Permissions ":", IAM Policies Attached to Roles or Groups Only, Neptune Cluster IAM Database Authentication Check, Amazon Elasticsearch Internal User Database Enabled, Cognito Authentication is Enabled for Kibana Access, RDS IAM Authentication Enabled, S3 Bucket ACL Prohibited, No Public S3 Buckets, Cross-Account S3 permissions In Bucket Policies Are Restricted
8.3.5: If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user: IAM Access Keys Are Rotated every 90 Days, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, No Unused Secrets (90 days)
8.3.6: 6 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.6, they meet the minimum level of complexity: IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater)
8.3.7: Individuals are not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used: IAM Access Keys Are Rotated every 90 Days, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, No Unused Secrets (90 days)
8.3.9: If passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation): IAM Access Keys Are Rotated every 90 Days, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, No Unused Secrets (90 days)
8.3.10.1 Additional requirement for service providers only: If passwords/passphrases are used as the only authentication factor for customer user access (i.e., in any single-factor authentication implementation): IAM Access Keys Are Rotated every 90 Days, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, No Unused Secrets (90 days)
8.3.11: Where authentication factors such as physical or logical security tokens, smart cards, or certificates: EC2 Instance not launched with Key Pair, No Empty IAM Groups, No Access Keys for Root Account, IAM Users in Groups, Ensure a log metric filter and alarm exist for usage of root account.
8.4.1: MFA is implemented for all non-console access into the CDE for personnel with administrative access: Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access, MFA Delete is Enabled for S3 Buckets
8.4.2 MFA is implemented for all non-console access into the CDE: Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access, MFA Delete is Enabled for S3 Buckets
8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE: Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access, MFA Delete is Enabled for S3 Buckets
8.6.3: 3 Passwords/passphrases for any application and system accounts are protected against misuse: IAM Access Keys Are Rotated every 90 Days, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, No Unused Secrets (90 days)

The report includes actionable findings and remediation guidance for supported checks.