CyberStrikeus/CyberStrike - Page 178

cis-aws-foundations-2-17

Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed

cis-aws-foundations-2-18

Ensure that IAM External Access Analyzer is enabled for all regions

cis-aws-foundations-2-19

Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

cis-aws-foundations-2-2

Maintain current AWS account contact details

cis-aws-foundations-2-20

Ensure access to AWSCloudShellFullAccess is restricted

cis-aws-foundations-2-21

Ensure AWS resource policies do not allow unrestricted access using "Principal": "*"

cis-aws-foundations-2-3

Ensure security contact information is registered

cis-aws-foundations-2-4

Ensure no 'root' user account access key exists

cis-aws-foundations-2-5

Ensure MFA is enabled for the 'root' user account

cis-aws-foundations-2-6

Ensure hardware MFA is enabled for the 'root' user account

cis-aws-foundations-2-7

Eliminate use of the 'root' user for administrative and daily tasks

cis-aws-foundations-2-8

Ensure IAM password policy requires minimum length of 14 or greater

cis-aws-foundations-2-9

Ensure IAM password policy prevents password reuse

cis-aws-foundations-3-1-1

Ensure S3 Bucket Policy is set to deny HTTP requests

cis-aws-foundations-3-1-2

Ensure MFA Delete is enabled on S3 buckets

cis-aws-foundations-3-1-3

Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary

cis-aws-foundations-3-1-4

Ensure that S3 is configured with 'Block Public Access' enabled

cis-aws-foundations-3-2-1

Ensure that encryption-at-rest is enabled for RDS instances

cis-aws-foundations-3-2-2

Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances

cis-aws-foundations-3-2-3

Ensure that RDS instances are not publicly accessible

cis-aws-foundations-3-2-4

Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS

cis-aws-foundations-3-3-1

Ensure that encryption is enabled for EFS file systems

cis-aws-foundations-4-1

Ensure CloudTrail is enabled in all regions

cis-aws-foundations-4-10

Ensure all AWS-managed web front-end services have access logging enabled

cis-aws-foundations-4-2

Ensure CloudTrail log file validation is enabled

cis-aws-foundations-4-3

Ensure AWS Config is enabled in all regions

cis-aws-foundations-4-4

Ensure that server access logging is enabled on the CloudTrail S3 bucket

cis-aws-foundations-4-5

Ensure CloudTrail logs are encrypted at rest using KMS CMKs

cis-aws-foundations-4-6

Ensure rotation for customer-created symmetric CMKs is enabled

cis-aws-foundations-4-7

Ensure VPC flow logging is enabled in all VPCs

cis-aws-foundations-4-8

Ensure that object-level logging for write events is enabled for S3 buckets

cis-aws-foundations-4-9

Ensure that object-level logging for read events is enabled for S3 buckets

cis-aws-foundations-5-1

Ensure unauthorized API calls are monitored

cis-aws-foundations-5-10

Ensure security group changes are monitored

cis-aws-foundations-5-11

Ensure Network Access Control List (NACL) changes are monitored

cis-aws-foundations-5-12

Ensure changes to network gateways are monitored

cis-aws-foundations-5-13

Ensure route table changes are monitored

cis-aws-foundations-5-14

Ensure VPC changes are monitored

cis-aws-foundations-5-15

Ensure AWS Organizations changes are monitored

cis-aws-foundations-5-16

Ensure AWS Security Hub is enabled