Add Operational Best Practices for NIST 800-53 rev 5 Closes #398

README.md

@@ -17,6 +17,7 @@ Includes support for:
 * [HIPAA](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.hipaa)
 * [General Data Protection Regulation (GDPR)](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.gdpr) 🚀 New!
 * [NIST 800-53 Revision 4](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_800_53_rev_4)
+* [NIST 800-53 Revision 5](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_800_53_rev_5)
 * [NIST Cybersecurity Framework (CSF)](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_csf)
 * [PCI DSS v3.2.1](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.pci_v321)
 * [AWS Foundational Security Best Practices](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.foundational_security)

conformance_pack/acm.sp

@@ -15,6 +15,7 @@ control "acm_certificate_expires_30_days" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"

conformance_pack/apigateway.sp

@@ -14,6 +14,7 @@ control "apigateway_stage_cache_encryption_at_rest_enabled" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -29,6 +30,7 @@ control "apigateway_stage_logging_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -42,6 +44,7 @@ control "apigateway_rest_api_stage_use_ssl_certificate" {
 
   tags = merge(local.conformance_pack_apigateway_common_tags, {
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
 }
@@ -54,6 +57,7 @@ control "apigateway_stage_use_waf_web_acl" {
   tags = merge(local.conformance_pack_apigateway_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
 }

conformance_pack/autoscaling.sp

@@ -14,6 +14,7 @@ control "autoscaling_group_with_lb_use_health_check" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
   })
 }
@@ -26,6 +27,7 @@ control "autoscaling_launch_config_public_ip_disabled" {
   tags = merge(local.conformance_pack_autoscaling_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
 }

conformance_pack/cloudtrail.sp

@@ -15,6 +15,7 @@ control "cloudtrail_trail_integrated_with_logs" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -32,6 +33,7 @@ control "cloudtrail_s3_data_events_enabled" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -49,6 +51,7 @@ control "cloudtrail_trail_logs_encrypted_with_kms_cmk" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -64,6 +67,7 @@ control "cloudtrail_multi_region_trail_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -81,6 +85,7 @@ control "cloudtrail_trail_validation_enabled" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     soc_2                  = "true"
   })
 }
@@ -95,6 +100,7 @@ control "cloudtrail_trail_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"

conformance_pack/cloudwatch.sp

@@ -14,6 +14,7 @@ control "cloudwatch_alarm_action_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     soc_2                  = "true"
   })
@@ -30,6 +31,7 @@ control "log_group_encryption_at_rest_enabled" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -46,6 +48,7 @@ control "cloudwatch_log_group_retention_period_365" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
   })

conformance_pack/dms.sp

@@ -14,6 +14,7 @@ control "dms_replication_instance_not_publicly_accessible" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })

conformance_pack/dynamodb.sp

@@ -14,6 +14,7 @@ control "dynamodb_table_auto_scaling_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
   })
 }
@@ -28,6 +29,7 @@ control "dynamodb_table_point_in_time_recovery_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -43,6 +45,7 @@ control "dynamodb_table_encrypted_with_kms_cmk" {
     gdpr               = "true"
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
+    nist_800_53_rev_5  = "true"
     rbi_cyber_security = "true"
   })
 }
@@ -55,6 +58,7 @@ control "dynamodb_table_in_backup_plan" {
   tags = merge(local.conformance_pack_dynamodb_common_tags, {
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
+    nist_800_53_rev_5  = "true"
     nist_csf           = "true"
     rbi_cyber_security = "true"
     soc_2              = "true"

conformance_pack/ebs.sp

@@ -14,6 +14,7 @@ control "ebs_snapshot_not_publicly_restorable" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -26,7 +27,9 @@ control "ebs_volume_encryption_at_rest_enabled" {
 
   tags = merge(local.conformance_pack_ebs_common_tags, {
     fedramp_moderate_rev_4 = "true"
+    gdpr                   = "true"
     hipaa                  = "true"
+    nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
 }
@@ -42,6 +45,7 @@ control "ebs_attached_volume_encryption_enabled" {
     hipaa                       = "true"
     gdpr                        = "true"
     nist_800_53_rev_4           = "true"
+    nist_800_53_rev_5           = "true"
     nist_csf                    = "true"
     rbi_cyber_security          = "true"
   })
@@ -55,6 +59,7 @@ control "ebs_volume_in_backup_plan" {
   tags = merge(local.conformance_pack_ebs_common_tags, {
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
+    nist_800_53_rev_5  = "true"
     nist_csf           = "true"
     rbi_cyber_security = "true"
     soc_2              = "true"
@@ -97,5 +102,6 @@ control "ebs_volume_unsued" {
   tags = merge(local.conformance_pack_ebs_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
   })
 }

conformance_pack/ec2.sp

@@ -10,7 +10,8 @@ control "ec2_ebs_default_encryption_enabled" {
   sql         = query.ec2_ebs_default_encryption_enabled.sql
 
   tags = merge(local.conformance_pack_ec2_common_tags, {
-    hipaa = "true"
+    hipaa             = "true"
+    nist_800_53_rev_5 = "true"
   })
 }
 
@@ -38,6 +39,7 @@ control "ec2_instance_in_vpc" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -53,6 +55,7 @@ control "ec2_instance_not_publicly_accessible" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -69,6 +72,7 @@ control "ec2_stopped_instance_30_days" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
   })
 }
 
@@ -83,6 +87,7 @@ control "ec2_instance_ebs_optimized" {
     fedramp_moderate_rev_4      = "true"
     hipaa                       = "true"
     nist_csf                    = "true"
+    nist_800_53_rev_5           = "true"
     soc_2                       = "true"
   })
 }
@@ -96,6 +101,7 @@ control "ec2_instance_uses_imdsv2" {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
   })
 }
 
@@ -112,3 +118,13 @@ control "ec2_instance_protected_by_backup_plan" {
     soc_2                  = "true"
   })
 }
+
+control "ec2_instance_iam_profile_attached" {
+  title       = "EC2 instances should have IAM profile attached"
+  description = "Ensure if an Amazon Elastic Compute Cloud (Amazon EC2) instance has an Identity and Access Management (IAM) profile attached to it. This rule is non compliant if no IAM profile is attached to the Amazon EC2 instance."
+  sql         = query.ec2_instance_iam_profile_attached.sql
+
+  tags = merge(local.conformance_pack_ec2_common_tags, {
+    nist_800_53_rev_5 = "true"
+  })
+}

conformance_pack/ecs.sp

@@ -12,5 +12,6 @@ control "ecs_task_definition_user_for_host_mode_check" {
   tags = merge(local.conformance_pack_ecs_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
   })
 }

conformance_pack/efs.sp

@@ -13,6 +13,7 @@ control "efs_file_system_encrypt_data_at_rest" {
     gdpr               = "true"
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
+    nist_800_53_rev_5  = "true"
     nist_csf           = "true"
     rbi_cyber_security = "true"
   })
@@ -26,6 +27,7 @@ control "efs_file_system_in_backup_plan" {
   tags = merge(local.conformance_pack_efs_common_tags, {
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
+    nist_800_53_rev_5  = "true"
     nist_csf           = "true"
     rbi_cyber_security = "true"
     soc_2              = "true"

conformance_pack/elasticache.sp

@@ -14,6 +14,7 @@ control "elasticache_redis_cluster_automatic_backup_retention_15_days" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"

conformance_pack/elasticbeanstalk.sp

@@ -12,5 +12,6 @@ control "elastic_beanstalk_enhanced_health_reporting_enabled" {
   tags = merge(local.conformance_pack_elasticbeanstalk_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
   })
 }

conformance_pack/elb.sp

@@ -15,6 +15,7 @@ control "elb_application_classic_lb_logging_enabled" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
     soc_2                  = "true"
@@ -31,6 +32,7 @@ control "elb_application_lb_deletion_protection_enabled" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_csf               = "true"
+    nist_800_53_rev_5      = "true"
   })
 }
 
@@ -45,6 +47,7 @@ control "elb_application_lb_redirect_http_request_to_https" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -59,6 +62,7 @@ control "elb_application_lb_waf_enabled" {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -75,6 +79,7 @@ control "elb_classic_lb_use_ssl_certificate" {
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
@@ -102,6 +107,7 @@ control "elb_classic_lb_use_tls_https_listeners" {
   tags = merge(local.conformance_pack_elb_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
     hipaa                  = "true"
     gdpr                   = "true"
     nist_800_53_rev_4      = "true"
@@ -117,6 +123,7 @@ control "elb_classic_lb_cross_zone_load_balancing_enabled" {
   tags = merge(local.conformance_pack_elb_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
     nist_800_53_rev_4      = "true"
     nist_csf               = "true"
   })
@@ -129,6 +136,7 @@ control "elb_application_network_lb_use_ssl_certificate" {
 
   tags = merge(local.conformance_pack_elb_common_tags, {
     fedramp_moderate_rev_4 = "true"
+    nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
 }

conformance_pack/emr.sp

@@ -26,6 +26,7 @@ control "emr_cluster_master_nodes_no_public_ip" {
     fedramp_moderate_rev_4 = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
+    nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })