cis-aws-database-7-2

name	cis-aws-database-7.2
description	Ensure VPC Security is Configured
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","documentdb","vpc","security-groups","subnets"]
cis_id	7.2
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-7.1","cis-aws-database-7.3","cis-aws-database-7.5"]
prerequisites	[]
severity_boost	{}

7.2 Ensure VPC Security is Configured (Manual)

Description

Creating a VPC, configuring subnets, and creating security groups help isolate your DocumentDB instances within your virtual network and control inbound and outbound traffic.

Rationale

Setting up a Virtual Private Cloud (VPC) protects the private network that has been established from any external networks from interfering. It allows internal networks to communicate with one another with the network that has been established.

Impact

Builds a strong connection between internal networks, has a strong connection with the internet, and it secures your data from getting into the hands of an unauthorized party.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon VPC Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/vpc/.

3. Create a VPC (Virtual Private Cloud)

   • Click on the Create VPC button to create a new VPC.
   • Provide the necessary details, such as VPC name, CIDR block, and additional configuration options.
   • Click on Create to create the VPC.

4. Configure VPC Subnets

   • Once the VPC is created, navigate to the Subnets section in the VPC console.
   • Click on the Create subnet button to create a new subnet.
   • Provide the necessary details, such as subnet name, VPC selection, and subnet CIDR block.
   • Repeat this step to create multiple subnets within your VPC, if required.

5. Create Security Groups

   • Navigate to the Security Groups section in the VPC console.
   • Click the Create security group button to create a new security group.
   • Provide a name and description for the security group.
   • Configure inbound and outbound rules to allow the necessary traffic to and from the DocumentDB instances.
   • Repeat this step to create additional security groups if needed.

6. Launch Amazon DocumentDB Cluster in VPC

   • Navigate to the service using the "Find Services" search bar or by directly accessing the console at .