cis-aws-euc-2-7

name	cis-aws-euc-2.7
description	Ensure access is limited to trusted devices
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","trusted-devices","certificate-authentication","device-trust"]
cis_id	2.7
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.6","cis-aws-euc-2.8"]
prerequisites	[]
severity_boost	{}

Ensure access is limited to trusted devices (Manual)

Profile Applicability

• Level 2

Description

WorkSpaces access should be restricted to trusted devices with valid certificates.

Rationale

WorkSpaces is accessible from any supported device that is connected to the internet. When you enable access to trusted devices, Amazon WorkSpaces uses certificate-based authentication to determine whether a device is trusted.

Impact

For each directory, you can import up to two root certificates and Amazon WorkSpaces will present them both to the client.

Note: Certificates for trusted devices only applies to the Amazon WorkSpaces OS clients. This feature does not apply to the Amazon WorkSpaces Web Access client, or any third-party clients.

Audit Procedure

Using AWS Console

Perform the following steps to confirm that Allow Trusted Devices is set:

1. Log in to the WorkSpaces console at https://console.aws.amazon.com/workspaces/
2. In the left pane, click Directories
3. Select the directory id link
4. Scroll to the Access Control Options section
5. Confirm that the correct Allow settings are in place
6. Confirm that certificates have been imported
7. Confirm that the correct device types have been enabled

If everything is not configured as above refer to the remediation below.

Remediation

Using AWS Console

Perform the following steps to set the restriction Allow Trusted Devices:

Create the Certificates

Note: It requires root certificates generated by an internal Certificate Authority (CA) and client certificates that chain up to a root certificate.

Requirements:

• Certificates must be Base64-encoded certificate files in CRT, CERT, or PEM format
• Certificates must include a Common Name
• The maximum length of certificate chain supported is 4
• Use a strong encryption algorithm. Minimum ECDSA-2 with RSA, SHA256 with ECDSA. Other options SHA381 with ECDSA, or SHA512 with ECDSA
• Make sure "key usage: Digital signature" is present on the public key
• For macOS, if the device certificate is in the system keychain, authorize the WorkSpaces client application to access those certificates

Deploy Client Certificates to the Trusted Devices

• Client certificates must be installed on the trusted devices for your users