cis-aws-euc-2-12

name	cis-aws-euc-2.12
description	Restrict WorkSpaces Bundle options to organization approved versions
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","bundle-management","compliance"]
cis_id	2.12
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Restrict WorkSpaces Bundle options to organization approved versions (Manual)

Description

Limit the existing WorkSpaces bundles that can be utilized and provisioned within your AWS account.

Rationale

Limiting the type of AWS WorkSpaces bundle that can be utilized can address internal security and compliance requirements.

Impact

None

Audit Procedure

Using AWS Console

Perform the following to ensure available workspace bundles are set.

1. Login to the WorkSpaces dashboard at https://console.aws.amazon.com/workspaces/
2. In the left pane click WorkSpaces to access the instances listing page.
3. Check the bundle type value for each Amazon WorkSpaces instance available in the current AWS region, listed in Bundle column, e.g.
4. If the value listed in the Bundle column is not the same for all listed resources, the WorkSpaces instances were launched using the approved bundle type.
5. Change the AWS region from the navigation bar and repeat step no. 4 for all other regions.

If the value listed in the Bundle column is not the same for all listed resources, the WorkSpaces instances were not launched using the approved bundle type, refer to the remediation procedure below.

Using AWS CLI

1. Run describe-workspaces command available within the selected region:

aws workspaces describe-workspaces \
    --region us-east-1 \
    --output table \
    --query 'Workspaces[*].WorkspaceId'

2. The command output should return a table with the requested WorkSpaces IDs:

+-------------------+
|DescribeWorkspaces|
+-------------------+
|  ws-bbbdddeee     |
|  ws-aaabbbccc     |
|  ws-ccceeefff     |
+-------------------+

3. Run describe-workspaces command again using the name of the WorkSpaces instance as identifier and custom query filters get the ID of the bundle used by the selected instance:

aws workspaces describe-workspaces \
    --region us-east-1 \
    --workspace-ids ws-bbbdddeee \
    --query 'Workspaces[*].BundleId'

4. The command output should return the requested WorkSpaces bundle ID:

[ "wsb-ccc333fff" ]

5. Run describe-workspace-bundles command to describe the type of the bundle utilized by the selected AWS WorkSpaces instance:

aws workspaces describe-workspace-bundles \
    --region us-east-1 \
    --bundle-ids wsb-ccc333fff \
    --query