CyberStrikeus/CyberStrike

cis-aws-foundations-2-1-1

Ensure centralized root access in AWS Organizations

cis-aws-foundations-2-1-2

Ensure authorization guardrails for all AWS Organization accounts

cis-aws-foundations-2-1-3

Ensure Organizations management account is not used for workloads

cis-aws-foundations-2-1-4

Ensure Organizational Units are structured by environment and sensitivity

cis-aws-foundations-2-1-5

Ensure delegated admin manages AWS Organizations policies

cis-aws-foundations-2-1-6

Ensure delegated admins manage AWS Organizations-integrated services

cis-aws-foundations-2-10

Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

cis-aws-foundations-2-11

Ensure credentials unused for 45 days or more are disabled

cis-aws-foundations-2-12

Ensure access keys are rotated every 90 days or less

cis-aws-foundations-2-13

Ensure IAM users receive permissions only through groups

cis-aws-foundations-2-14

Ensure IAM policies that allow full "*:*" administrative privileges are not attached

cis-aws-foundations-2-15

Ensure a support role has been created to manage incidents with AWS Support

cis-aws-foundations-2-16

Ensure IAM instance roles are used for AWS resource access from instances

cis-aws-foundations-2-17

Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed

cis-aws-foundations-2-18

Ensure that IAM External Access Analyzer is enabled for all regions

cis-aws-foundations-2-19

Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

cis-aws-foundations-2-2

Maintain current AWS account contact details

cis-aws-foundations-2-20

Ensure access to AWSCloudShellFullAccess is restricted

cis-aws-foundations-2-21

Ensure AWS resource policies do not allow unrestricted access using "Principal": "*"

cis-aws-foundations-2-3

Ensure security contact information is registered

cis-aws-foundations-2-4

Ensure no 'root' user account access key exists

cis-aws-foundations-2-5

Ensure MFA is enabled for the 'root' user account

cis-aws-foundations-2-6

Ensure hardware MFA is enabled for the 'root' user account

cis-aws-foundations-2-7

Eliminate use of the 'root' user for administrative and daily tasks

cis-aws-foundations-2-8

Ensure IAM password policy requires minimum length of 14 or greater

cis-aws-foundations-2-9

Ensure IAM password policy prevents password reuse

cis-aws-foundations-3-1-1

Ensure S3 Bucket Policy is set to deny HTTP requests

cis-aws-foundations-3-1-2

Ensure MFA Delete is enabled on S3 buckets

cis-aws-foundations-3-1-3

Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary

cis-aws-foundations-3-1-4

Ensure that S3 is configured with 'Block Public Access' enabled

cis-aws-foundations-3-2-1

Ensure that encryption-at-rest is enabled for RDS instances

cis-aws-foundations-3-2-2

Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances

cis-aws-foundations-3-2-3

Ensure that RDS instances are not publicly accessible

cis-aws-foundations-3-2-4

Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS

cis-aws-foundations-3-3-1

Ensure that encryption is enabled for EFS file systems

cis-aws-foundations-4-1

Ensure CloudTrail is enabled in all regions

cis-aws-foundations-4-10

Ensure all AWS-managed web front-end services have access logging enabled

cis-aws-foundations-4-2

Ensure CloudTrail log file validation is enabled

cis-aws-foundations-4-3

Ensure AWS Config is enabled in all regions

cis-aws-foundations-4-4

Ensure that server access logging is enabled on the CloudTrail S3 bucket