cis-aws-database-5-2

name	cis-aws-database-5.2
description	Ensure Network Security is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","elasticache","redis","vpc","security-groups","network-security"]
cis_id	5.2
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-5.1","cis-aws-database-5.5"]
prerequisites	[]
severity_boost	{}

5.2 Ensure Network Security is Enabled

Description

Implementing network security for Amazon ElastiCache involves configuring your Virtual Private Cloud (VPC), security groups, and network access controls to control access to your ElastiCache clusters.

Rationale

This helps ensure that the data is safe and protected from any threats and or misconfigurations within the network. This helps to keep a potential hacker getting into the system and compromising the data.

Impact

N/A

Audit Procedure

Using AWS Console

1. Create or Select a VPC

   • Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
   • Create a new VPC or select an existing VPC where you want to deploy your ElastiCache cluster.

2. Create Subnets

   • In the VPC console, navigate to Subnets in the left-side menu.
   • Create or select the desired subnets within your VPC where you want to deploy your ElastiCache cluster.

3. Configure Security Groups

   • In the VPC console, navigate to Security Groups in the left-side menu.
   • Create a new security group or select an existing one to configure the security settings for your ElastiCache cluster.
   • Define inbound and outbound rules to control the traffic flow to and from your ElastiCache cluster.
     • Allow inbound traffic from trusted sources (e.g., specific IP ranges or security groups) on the necessary ports used by your ElastiCache cluster.
     • Define outbound rules based on your requirements, such as allowing outbound traffic to specific destinations or ports.
   • Associate the security group with the ElastiCache cluster when creating or modifying it.

4. Set up Network Access Control Lists (ACLs)

   • In the VPC console, navigate to Network ACLs in the left-side menu.
   • Create or select the appropriate network ACL associated with the subnets used by your ElastiCache cluster.
   • Configure inbound and outbound rules in the network ACL to allow or deny traffic to and from your ElastiCache cluster.
     • Define rules based on your security requirements, allowing only necessary protocols, ports, and IP ranges.
   • Associate the network ACL with the subnets used by your ElastiCache cluster.

5. Configure Route Tables

   • In the VPC console, navigate to in the left-side menu.