cis-aws-database-8-2

name	cis-aws-database-8.2
description	Ensure Network Security is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","keyspaces","cassandra","network-security","vpc"]
cis_id	8.2
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-8.1","cis-aws-database-8.3","cis-aws-database-8.4"]
prerequisites	[]
severity_boost	{}

8.2 Ensure Network Security is Enabled (Manual)

Description

In order to access Amazon Keyspaces the user is required to set specific networking parameters and security measurements without these extra steps they will not be able to access it. Users are required to create or select a virtual private cloud (VPC) and define their inbound and outbound rules accordingly.

Rationale

Proper network security configuration ensures that only authorized users have access to the database, limiting the risk of attacks through network isolation and access controls.

Impact

Only authorized users have access to the database which limits and controls any risk of an attack. This ensures better performance of the system to a private network and better security.

Audit Procedure

Using AWS Console

1. Create or Select a Virtual Private Cloud (VPC):
   • Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
   • Create a new VPC or select an existing VPC where you want to deploy your Amazon Keyspaces resources.
2. Configure Subnets:
   • In the VPC console, navigate to Subnets in the left-side menu.
   • Create or select the subnets within your VPC where you want to deploy your Amazon Keyspaces resources.
   • Ensure you have private subnets to isolate your Keyspaces resources from the public internet.
3. Define Security Groups:
   • In the VPC console, navigate to Security Groups in the left-side menu.
   • Create a new security group or select an existing one for your Amazon Keyspaces resources.
   • Configure inbound and outbound rules in the security group to control traffic access.
     • Allow inbound access only from trusted sources, such as specific IP ranges or security groups, on the necessary ports used by Amazon Keyspaces.
     • Define outbound rules based on your requirements, allowing outbound traffic to necessary destinations or ports.
   • Associate the security group with your Amazon Keyspaces resources.
4. Configure Network Access Control Lists (ACLs):
   • In the VPC console, navigate to Network ACLs in the left-side menu.
   • Create or select the network ACLs associated with the subnets used by your Amazon Keyspaces resources.
   • Configure inbound and outbound rules in the network ACLs to control traffic access.
     • Define rules based on your security requirements, allowing only necessary protocols, ports, and IP ranges.