Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-4-3El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-aws-foundations-4.3 |
| description | Ensure AWS Config is enabled in all regions |
| category | cis-logging |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","logging","config","configuration-management","compliance"] |
| cis_id | 4.3 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-4.1"] |
| prerequisites | [] |
| severity_boost | {} |
AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration items (AWS resources), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended that AWS Config be enabled in all regions. In environments using AWS Control Tower or Landing Zone Accelerator (LZA), AWS Config may be centrally managed and automatically enabled across regions.
The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking, and compliance auditing.
Enabling AWS Config in all regions provides comprehensive visibility into resource configurations, enhancing security and compliance monitoring. However, this may incur additional costs and require proper configuration management.
Note: In environments using AWS Control Tower or Landing Zone Accelerator (LZA), AWS Config configuration may be managed centrally. Verify that AWS Config is enabled and recording through the centralized governance solution.
aws configservice describe-configuration-recorders
recordingGroup object which includes "allSupported": true. Additionally, ensure that at least one recorder has "includeGlobalResourceTypes": true.Note: There is one more parameter, "ResourceTypes," in the recordingGroup object. We don't need to check it, as whenever we set "allSupported" to true, AWS enforces the resource types to be empty ("ResourceTypes": []).
Sample output:
{
"ConfigurationRecorders": [
{
"recordingGroup": {
"allSupported": true,
"resourceTypes": [],
"includeGlobalResourceTypes": true
},
"roleARN": "arn:aws:iam::<AWS_Account_ID>:role/service-role/<config-role-name>",
"name": "default"
}
]
}
aws configservice describe-configuration-recorder-status
name key matching the recorders that were evaluated in step 2. Ensure that they include "recording": true and "lastStatus": "SUCCESS".All regions have AWS Config enabled with allSupported set to true, at least one recorder has includeGlobalResourceTypes set to true, and all recorders show recording: true with lastStatus: SUCCESS.
Services.Config.Note: In AWS Control Tower or Landing Zone Accelerator (LZA) environments, AWS Config setup and recording may be deployed and managed automatically. Configuration changes should be performed through the centralized governance framework rather than directly in individual accounts.
aws configservice put-configuration-recorder --configuration-recorder name=<config-recorder-name>,roleARN=arn:aws:iam::<account-id>:role/<iam-role> --recording-group allSupported=true,includeGlobalResourceTypes=true
{
"name": "<delivery-channel-name>",
"s3BucketName": "<bucket-name>",
"snsTopicARN": "arn:aws:sns:<region>:<account-id>:<sns-topic>",
"configSnapshotDeliveryProperties": {
"deliveryFrequency": "Twelve_Hours"
}
}
aws configservice put-delivery-channel --delivery-channel file://<delivery-channel-file>.json
aws configservice start-configuration-recorder --configuration-recorder-name <config-recorder-name>
By default, AWS Config is not enabled in any region. No configuration changes or resource relationships are tracked until a Config Recorder and Delivery Channel are set up, leaving organizations without historical records for security analysis, compliance auditing, or incident investigations.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 1.1 Establish and Maintain Detailed Enterprise Asset Inventory - Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data. | x | x | x |
| v7 | 1.4 Maintain Detailed Asset Inventory - Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or process information. | x | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| TA0003, TA0007, TA0008, TA0009, TA0042 | M1047 |
Level 2 | Automated