cis_v140_3_5

[ecktom]

Again the CIS benchmark is not explicit enough. At says that AWS Config needs to be enabled in every region and:

Evaluate the output to ensure that there's at least one recorder for which recordingGroup object includes "allSupported": true AND "includeGlobalResourceTypes": true

The AWS docs says:

allSupported=true – AWS Config records configuration changes for every supported type of regional resource. When AWS Config adds support for a new type of regional resource, it automatically starts recording resources of that type.

includeGlobalResourceTypes=true – AWS Config includes supported types of global resources with the resources that it records. When AWS Config adds support for a new type of global resource, it automatically starts recording resources of that type.

While I understand that we need includeGlobalResourceTypes just once, from a security point of view I think allSupported should be included in every region.
cis_v140_3_5 does currently fail for us as looking for allSupported=true + includeGlobalResourceTypes=true in the main region and allSupported=true +includeGlobalResourceTypes=false in every other region which does not match the at least one term from the benchmark

[rajlearner17]

@ecktom thanks for your continuous input, we have already this backlog to work out, we have started looking into it.

[rajlearner17]

Marking this closed reported here to track