cis-benchmark-aws

name	cis-benchmark-aws
enabled	true
description	Use when performing cis benchmark aws — cIS Benchmark assessment for AWS covering identity and access management, logging, monitoring, networking, and storage controls. Based on CIS AWS Foundations Benchmark v3.0. Use for security baseline validation or hardening projects.
required_connections	[{"prefix":"aws","label":"AWS"}]
config_fields	[{"key":"account_id","label":"AWS Account ID","required":true,"placeholder":"e.g., 123456789012"},{"key":"account_alias","label":"Account Alias / Name","required":true,"placeholder":"e.g., prod-main"},{"key":"regions","label":"Regions in Scope","required":false,"placeholder":"e.g., us-east-1, eu-west-1"}]
features	["SECURITY","COMPLIANCE","AWS"]

CIS Benchmark for AWS Skill

Run CIS AWS Foundations Benchmark v3.0 assessment for account {{ account_alias }} ({{ account_id }}).

Workflow

Step 1 — Assessment Scope

1. Account: {{ account_id }} ({{ account_alias }})
2. Regions: {{ regions | "all active regions" }}
3. Benchmark version: CIS AWS Foundations Benchmark v3.0
4. Assessment date: [auto-populated]

Step 2 — Section 1: Identity and Access Management

1. IAM
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 1.1  — Maintain current contact details
[ ] 1.2  — Ensure security contact information is registered
[ ] 1.3  — Ensure security questions are registered (root account)
[ ] 1.4  — No root account access key exists
[ ] 1.5  — MFA enabled on root account
[ ] 1.6  — Hardware MFA on root account
[ ] 1.7  — Eliminate root usage for daily tasks
[ ] 1.8  — Minimum password length ≥14 characters
[ ] 1.9  — Password reuse prevention (≥24 passwords)
[ ] 1.10 — MFA enabled for all IAM users with console access
[ ] 1.11 — No access keys created during initial user setup
[ ] 1.12 — Credentials unused for ≥45 days are disabled
[ ] 1.13 — Only one active access key per IAM user
[ ] 1.14 — Access keys rotated every ≤90 days
[ ] 1.15 — No IAM user has inline policies
[ ] 1.16 — No full "*:*" admin privileges in IAM policies
[ ] 1.17 — IAM users are members of groups (not standalone)
[ ] 1.18 — IAM instance roles used for EC2 (not access keys)
[ ] 1.19 — Expired SSL/TLS certificates removed from IAM
[ ] 1.20 — IAM Access Analyzer enabled in all regions

Step 3 — Section 2: Logging

2. LOGGING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 2.1  — CloudTrail enabled in all regions
[ ] 2.2  — CloudTrail log file validation enabled
[ ] 2.3  — CloudTrail S3 bucket not publicly accessible
[ ] 2.4  — CloudTrail integrated with CloudWatch Logs
[ ] 2.5  — AWS Config enabled in all regions
[ ] 2.6  — S3 bucket logging enabled on CloudTrail bucket
[ ] 2.7  — CloudTrail logs encrypted with KMS CMK
[ ] 2.8  — KMS key rotation enabled for CloudTrail encryption
[ ] 2.9  — VPC flow logging enabled in all VPCs
[ ] 2.10 — Object-level logging for read events on S3 (CloudTrail)
[ ] 2.11 — Object-level logging for write events on S3 (CloudTrail)

Step 4 — Section 3: Monitoring

3. MONITORING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 3.1  — Alarm for unauthorized API calls
[ ] 3.2  — Alarm for console sign-in without MFA
[ ] 3.3  — Alarm for root account usage
[ ] 3.4  — Alarm for IAM policy changes
[ ] 3.5  — Alarm for CloudTrail config changes
[ ] 3.6  — Alarm for console auth failures
[ ] 3.7  — Alarm for disabling/deleting CMKs
[ ] 3.8  — Alarm for S3 bucket policy changes
[ ] 3.9  — Alarm for AWS Config changes
[ ] 3.10 — Alarm for security group changes
[ ] 3.11 — Alarm for NACL changes
[ ] 3.12 — Alarm for network gateway changes
[ ] 3.13 — Alarm for route table changes
[ ] 3.14 — Alarm for VPC changes

Step 5 — Section 4: Networking

4. NETWORKING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 4.1  — No security groups allow ingress 0.0.0.0/0 to port 22
[ ] 4.2  — No security groups allow ingress 0.0.0.0/0 to port 3389
[ ] 4.3  — Default security group restricts all traffic
[ ] 4.4  — VPC peering least-access routing

Step 6 — Section 5: Storage

5. STORAGE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 5.1  — EBS volume encryption enabled by default
[ ] 5.2  — S3 bucket-level public access blocked (Block Public Access)
[ ] 5.3  — S3 buckets use SSE or KMS encryption
[ ] 5.4  — RDS instances have encryption at rest enabled

Step 7 — Scoring & Report

CIS Section	Controls Passed	Controls Failed	Score
1. IAM	X/20	Y	Z%
2. Logging	X/11	Y	Z%
3. Monitoring	X/14	Y	Z%
4. Networking	X/4	Y	Z%
5. Storage	X/4	Y	Z%
Overall	X/53	Y	Z%

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

Produce a CIS Benchmark report with:

1. Assessment header (account, regions, benchmark version, date)
2. Per-section checklists with PASS/FAIL and evidence per control
3. Score summary table with per-section and overall percentage
4. Critical findings (Level 1 failures) with remediation steps
5. Remediation runbook with AWS CLI commands for each failed control