Add Operational Best Practices for FFIEC. Closes #418

README.md

@@ -1,6 +1,6 @@
 # AWS Compliance Scanning Tool
 
-475+ checks covering industry defined security best practices across all AWS regions. Includes full support for multiple best practice benchmarks including PCI DSS, AWS Foundational Security, FedRAMP, HIPAA, NIST 800-53, NIST CSF, Reserve Bank of India, Audit Manager Control Tower **and the latest (v1.4.0) CIS benchmarks**.
+475+ checks covering industry defined security best practices across all AWS regions. Includes full support for multiple best practice benchmarks including PCI DSS, AWS Foundational Security, FedRAMP, FFIEC, HIPAA, NIST 800-53, NIST CSF, Reserve Bank of India, Audit Manager Control Tower **and the latest (v1.4.0) CIS benchmarks**.
 
 Run checks in a dashboard:
 ![image](https://raw.githubusercontent.com/turbot/steampipe-mod-aws-compliance/main/docs/aws_cis_v140_dashboard.png)
@@ -14,10 +14,12 @@ Includes support for:
 * [Audit Manager Control Tower](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.control_tower)
 * [FedRAMP Low Revision 4](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.fedramp_low_rev_4)
 * [FedRAMP Moderate Revision 4](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.fedramp_moderate_rev_4)
+* [Federal Financial
+Institutions Examination Council (FFIEC)](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.ffiec) 🚀 New!
 * [HIPAA](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.hipaa)
 * [General Data Protection Regulation (GDPR)](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.gdpr)
 * [NIST 800-53 Revision 4](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_800_53_rev_4)
-* [NIST 800-53 Revision 5](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_800_53_rev_5) 🚀 New!
+* [NIST 800-53 Revision 5](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_800_53_rev_5)
 * [NIST Cybersecurity Framework (CSF)](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.nist_csf)
 * [PCI DSS v3.2.1](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.pci_v321)
 * [AWS Foundational Security Best Practices](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.foundational_security)

conformance_pack/acm.sp

@@ -12,6 +12,7 @@ control "acm_certificate_expires_30_days" {
   tags = merge(local.conformance_pack_acm_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
@@ -20,4 +21,4 @@ control "acm_certificate_expires_30_days" {
     rbi_cyber_security     = "true"
     soc_2                  = "true"
   })
-}
+}

conformance_pack/apigateway.sp

@@ -28,6 +28,7 @@ control "apigateway_stage_logging_enabled" {
   tags = merge(local.conformance_pack_apigateway_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -44,6 +45,7 @@ control "apigateway_rest_api_stage_use_ssl_certificate" {
 
   tags = merge(local.conformance_pack_apigateway_common_tags, {
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
@@ -57,7 +59,8 @@ control "apigateway_stage_use_waf_web_acl" {
   tags = merge(local.conformance_pack_apigateway_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
-}
+}

conformance_pack/autoscaling.sp

@@ -12,6 +12,7 @@ control "autoscaling_group_with_lb_use_health_check" {
   tags = merge(local.conformance_pack_autoscaling_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -27,7 +28,8 @@ control "autoscaling_launch_config_public_ip_disabled" {
   tags = merge(local.conformance_pack_autoscaling_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     nist_800_53_rev_5      = "true"
     rbi_cyber_security     = "true"
   })
-}
+}

conformance_pack/backup.sp

@@ -5,11 +5,12 @@ locals {
 }
 
 control "backup_recovery_point_manual_deletion_disabled" {
-  title       = "Backup recovery point manual deletion should be disabled"
+  title       = "Backup recovery points manual deletion should be disabled"
   description = "Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points. The rule is non complaint if the Backup Vault does not have resource-based policies or has policies without a suitable 'Deny' statement."
   sql         = query.backup_recovery_point_manual_deletion_disabled.sql
 
   tags = merge(local.conformance_pack_backup_common_tags, {
+    ffiec    = "true"
     hipaa    = "true"
     nist_csf = "true"
     soc_2    = "true"
@@ -24,20 +25,32 @@ control "backup_plan_min_retention_35_days" {
   tags = merge(local.conformance_pack_backup_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_csf               = "true"
     soc_2                  = "true"
   })
 }
 
 control "backup_recovery_point_encryption_enabled" {
-  title       = "Backup recovery point should be encrypted"
+  title       = "Backup recovery points should be encrypted"
   description = "Ensure if a recovery point is encrypted. The rule is non complaint if the recovery point is not encrypted."
   sql         = query.backup_recovery_point_encryption_enabled.sql
 
   tags = merge(local.conformance_pack_backup_common_tags, {
+    ffiec    = "true"
     hipaa    = "true"
     nist_csf = "true"
     soc_2    = "true"
   })
-}
+}
+
+control "backup_recovery_point_min_retention_35_days" {
+  title       = "Backup recovery points should not expire before retention period"
+  description = "Ensure a recovery point expires no earlier than after the specified period. The rule is non-compliant if the recovery point has a retention point less than 35 days."
+  sql         = query.backup_recovery_point_min_retention_35_days.sql
+
+  tags = merge(local.conformance_pack_backup_common_tags, {
+    ffiec = "true"
+  })
+}

conformance_pack/cloudtrail.sp

@@ -12,6 +12,7 @@ control "cloudtrail_trail_integrated_with_logs" {
   tags = merge(local.conformance_pack_cloudtrail_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
@@ -30,6 +31,7 @@ control "cloudtrail_s3_data_events_enabled" {
   tags = merge(local.conformance_pack_cloudtrail_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     gdpr                   = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
@@ -65,6 +67,7 @@ control "cloudtrail_multi_region_trail_enabled" {
   tags = merge(local.conformance_pack_cloudtrail_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -98,6 +101,7 @@ control "cloudtrail_trail_enabled" {
   tags = merge(local.conformance_pack_cloudtrail_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"

conformance_pack/cloudwatch.sp

@@ -12,6 +12,7 @@ control "cloudwatch_alarm_action_enabled" {
   tags = merge(local.conformance_pack_cloudwatch_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -46,6 +47,7 @@ control "cloudwatch_log_group_retention_period_365" {
   tags = merge(local.conformance_pack_cloudwatch_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -139,8 +141,8 @@ control "log_metric_filter_network_acl" {
   sql         = query.log_metric_filter_network_acl.sql
 
   tags = merge(local.conformance_pack_cloudwatch_common_tags, {
-     gdpr     = "true"
-     nist_csf = "true"
+    gdpr     = "true"
+    nist_csf = "true"
   })
 }
 

conformance_pack/codebuild.sp

@@ -12,6 +12,7 @@ control "codebuild_project_plaintext_env_variables_no_sensitive_aws_values" {
   tags = merge(local.conformance_pack_codebuild_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_csf               = "true"
@@ -27,6 +28,7 @@ control "codebuild_project_source_repo_oauth_configured" {
   tags = merge(local.conformance_pack_codebuild_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_csf               = "true"

conformance_pack/dms.sp

@@ -12,10 +12,11 @@ control "dms_replication_instance_not_publicly_accessible" {
   tags = merge(local.conformance_pack_dms_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
     nist_csf               = "true"
     rbi_cyber_security     = "true"
   })
-}
+}

conformance_pack/dynamodb.sp

@@ -12,6 +12,7 @@ control "dynamodb_table_auto_scaling_enabled" {
   tags = merge(local.conformance_pack_dynamodb_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -27,6 +28,7 @@ control "dynamodb_table_point_in_time_recovery_enabled" {
   tags = merge(local.conformance_pack_dynamodb_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -56,6 +58,7 @@ control "dynamodb_table_in_backup_plan" {
   sql         = query.dynamodb_table_in_backup_plan.sql
 
   tags = merge(local.conformance_pack_dynamodb_common_tags, {
+    ffiec              = "true"
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
     nist_800_53_rev_5  = "true"

conformance_pack/ebs.sp

@@ -12,6 +12,7 @@ control "ebs_snapshot_not_publicly_restorable" {
   tags = merge(local.conformance_pack_ebs_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -42,8 +43,9 @@ control "ebs_attached_volume_encryption_enabled" {
   tags = merge(local.conformance_pack_ebs_common_tags, {
     audit_manager_control_tower = "true"
     fedramp_moderate_rev_4      = "true"
-    hipaa                       = "true"
+    ffiec                       = "true"
     gdpr                        = "true"
+    hipaa                       = "true"
     nist_800_53_rev_4           = "true"
     nist_800_53_rev_5           = "true"
     nist_csf                    = "true"
@@ -57,6 +59,7 @@ control "ebs_volume_in_backup_plan" {
   sql         = query.ebs_volume_in_backup_plan.sql
 
   tags = merge(local.conformance_pack_ebs_common_tags, {
+    ffiec              = "true"
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
     nist_800_53_rev_5  = "true"
@@ -75,6 +78,7 @@ control "ebs_attached_volume_delete_on_termination_enabled" {
     audit_manager_control_tower = "true"
     fedramp_low_rev_4           = "true"
     fedramp_moderate_rev_4      = "true"
+    ffiec                       = "true"
     nist_800_53_rev_4           = "true"
     nist_csf                    = "true"
   })
@@ -88,6 +92,7 @@ control "ebs_volume_protected_by_backup_plan" {
   tags = merge(local.conformance_pack_ebs_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_csf               = "true"
     soc_2                  = "true"
@@ -102,6 +107,7 @@ control "ebs_volume_unused" {
   tags = merge(local.conformance_pack_ebs_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     nist_800_53_rev_5      = "true"
   })
 }

conformance_pack/ec2.sp

@@ -10,6 +10,7 @@ control "ec2_ebs_default_encryption_enabled" {
   sql         = query.ec2_ebs_default_encryption_enabled.sql
 
   tags = merge(local.conformance_pack_ec2_common_tags, {
+    ffiec             = "true"
     hipaa             = "true"
     nist_800_53_rev_5 = "true"
   })
@@ -37,6 +38,7 @@ control "ec2_instance_in_vpc" {
   tags = merge(local.conformance_pack_ec2_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -53,6 +55,7 @@ control "ec2_instance_not_publicly_accessible" {
   tags = merge(local.conformance_pack_ec2_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -70,6 +73,7 @@ control "ec2_stopped_instance_30_days" {
   tags = merge(local.conformance_pack_ec2_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"
@@ -113,6 +117,7 @@ control "ec2_instance_protected_by_backup_plan" {
   tags = merge(local.conformance_pack_ec2_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_csf               = "true"
     soc_2                  = "true"
@@ -125,6 +130,7 @@ control "ec2_instance_iam_profile_attached" {
   sql         = query.ec2_instance_iam_profile_attached.sql
 
   tags = merge(local.conformance_pack_ec2_common_tags, {
+    ffiec             = "true"
     nist_800_53_rev_5 = "true"
   })
 }

conformance_pack/ecs.sp

@@ -12,6 +12,7 @@ control "ecs_task_definition_user_for_host_mode_check" {
   tags = merge(local.conformance_pack_ecs_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     nist_800_53_rev_5      = "true"
   })
 }

conformance_pack/efs.sp

@@ -10,6 +10,7 @@ control "efs_file_system_encrypt_data_at_rest" {
   sql         = query.efs_file_system_encrypt_data_at_rest.sql
 
   tags = merge(local.conformance_pack_efs_common_tags, {
+    ffiec              = "true"
     gdpr               = "true"
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
@@ -25,6 +26,7 @@ control "efs_file_system_in_backup_plan" {
   sql         = query.efs_file_system_automatic_backups_enabled.sql
 
   tags = merge(local.conformance_pack_efs_common_tags, {
+    ffiec              = "true"
     hipaa              = "true"
     nist_800_53_rev_4  = "true"
     nist_800_53_rev_5  = "true"
@@ -46,4 +48,4 @@ control "efs_file_system_protected_by_backup_plan" {
     nist_csf               = "true"
     soc_2                  = "true"
   })
-}
+}

conformance_pack/elasticache.sp

@@ -12,6 +12,7 @@ control "elasticache_redis_cluster_automatic_backup_retention_15_days" {
   tags = merge(local.conformance_pack_elasticache_common_tags, {
     fedramp_low_rev_4      = "true"
     fedramp_moderate_rev_4 = "true"
+    ffiec                  = "true"
     hipaa                  = "true"
     nist_800_53_rev_4      = "true"
     nist_800_53_rev_5      = "true"