Add cis_v120 benchmark #535

madhushreeray30 · 2023-01-13T14:03:25Z

No description provided.

khushboo9024 · 2023-01-16T16:57:13Z

cis_v120/section_1.sp

+  tags = merge(local.cis_v120_1_common_tags, {
+    cis_item_id = "1.15"
+    cis_level   = "1"
+    cis_type    = "not scored"


Suggested change

cis_type = "not scored"

cis_type = "not_scored"

Please change this in all applicable places.

khushboo9024 · 2023-01-16T16:57:42Z

cis_v120/section_4.sp

+  tags = merge(local.cis_v120_4_common_tags, {
+    cis_item_id = "4.4"
+    cis_level   = "2"
+    cis_type    = "scored"


Suggested change

cis_type = "scored"

cis_type = "not_scored"

khushboo9024 · 2023-01-16T17:01:23Z

cis_v120/section_3.sp

+  title         = "3.4 Ensure a log metric filter and alarm exist for IAM policy changes"
+  description   = "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies."
+  sql           = query.log_metric_filter_iam_policy.sql
+  documentation = file("./cis_v120/docs/cis_v120_3_3.md")


Suggested change

documentation = file("./cis_v120/docs/cis_v120_3_3.md")

documentation = file("./cis_v120/docs/cis_v120_3_4.md")

khushboo9024 · 2023-01-16T17:05:54Z

cis_v120/section_3.sp

+  title         = "3.14 Ensure a log metric filter and alarm exist for VPC changes"
+  description   = "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs."
+  sql           = query.log_metric_filter_vpc.sql
+  documentation = file("./cis_v120/docs/cis_v120_3_13.md")


Suggested change

documentation = file("./cis_v120/docs/cis_v120_3_13.md")

documentation = file("./cis_v120/docs/cis_v120_3_14.md")

khushboo9024 · 2023-01-16T17:22:39Z

cis_v120/section_1.sp

+control "cis_v120_1_17" {
+  title         = "1.17 Maintain current contact details"
+  description   = "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system."
+  sql           = query.manual_control.sql


We can try to build a query using the aws_account_contact table.

khushboo9024 · 2023-01-16T17:29:05Z

cis_v120/docs/cis_v120_1_11.md

+
+  - Passwords can be stolen or compromised sometimes without your knowledge. This can happen via a system compromise, software vulnerability, or internal threat.
+  - Certain corporate and government web filters or proxy servers have the ability to intercept and record traffic even if it's encrypted.
+  - Many people use the same password for many systems such as work, email, and personal.
+  - Compromised end user workstations might have a keystroke logger.


Suggested change

- Passwords can be stolen or compromised sometimes without your knowledge. This can happen via a system compromise, software vulnerability, or internal threat.

- Certain corporate and government web filters or proxy servers have the ability to intercept and record traffic even if it's encrypted.

- Many people use the same password for many systems such as work, email, and personal.

- Compromised end user workstations might have a keystroke logger.

- Passwords can be stolen or compromised sometimes without your knowledge. This can happen via a system compromise, software vulnerability, or internal threat.

- Certain corporate and government web filters or proxy servers have the ability to intercept and record traffic even if it's encrypted.

- Many people use the same password for many systems such as work, email, and personal.

- Compromised end user workstations might have a keystroke logger.

khushboo9024 · 2023-01-16T17:32:34Z

cis_v120/docs/cis_v120_1_12.md

+  - Click on `Make Inactive` - (Temporarily disable Key - may be needed again).
+  - Click `Delete` - (Deleted keys cannot be recovered).


Suggested change

- Click on `Make Inactive` - (Temporarily disable Key - may be needed again).

- Click `Delete` - (Deleted keys cannot be recovered).

- Click on `Make Inactive` - (Temporarily disable Key - may be needed again).

- Click `Delete` - (Deleted keys cannot be recovered).

khushboo9024 · 2023-01-17T11:11:01Z

cis_v120/section_2.sp

+control "cis_v120_2_1" {
+  title         = "2.1 Ensure CloudTrail is enabled in all regions"
+  description   = "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation)."
+  sql           = query.cloudtrail_multi_region_read_write_enabled.sql


Suggested change

sql = query.cloudtrail_multi_region_read_write_enabled.sql

query = query.cloudtrail_multi_region_read_write_enabled

Please make changes to all places wherever applicable.

misraved

Please take a look at the review comments 👍. Thanks!!!

misraved · 2023-01-19T11:16:31Z

cis_v120/docs/cis_v120_2_1.md

+- Click `Add new trail`.
+- Enter a trail name in the `Trail name` box.
+- Set the `Apply trail to all regions` option to `Yes`.
+- Specify an S3 bucket name in the `S3 bucket` box.
+- Click `Create`.


Suggested change

- Click `Add new trail`.

- Enter a trail name in the `Trail name` box.

- Set the `Apply trail to all regions` option to `Yes`.

- Specify an S3 bucket name in the `S3 bucket` box.

- Click `Create`.

- Click `Add new trail`.

- Enter a trail name in the `Trail name` box.

- Set the `Apply trail to all regions` option to `Yes`.

- Specify an S3 bucket name in the `S3 bucket` box.

- Click `Create`.

Please update all such instances across the documents 👍 .

misraved · 2023-01-19T11:18:20Z

cis_v120/docs/cis_v120_2_4.md

+- Create/Select an `IAM Role` and `Policy Name`.
+- Click `Allow` to continue.


Please update the indentation.

misraved · 2023-01-19T11:18:37Z

cis_v120/docs/cis_v120_2_6.md

+- Click on `Enabled` checkbox.
+- Select Target Bucket from list.
+- Enter a Target Prefix.


Suggested change

- Click on `Enabled` checkbox.

- Select Target Bucket from list.

- Enter a Target Prefix.

- Click on `Enabled` checkbox.

- Select Target Bucket from list.

- Enter a Target Prefix.

misraved · 2023-01-19T11:18:56Z

cis_v120/docs/cis_v120_2_7.md

+- Note: Ensure the CMK is located in the same region as the S3 bucket
+- Note: You will need to apply a KMS Key policy on the selected CMK in order for


Please update the indentation

misraved · 2023-01-19T11:35:07Z

query/vpc/vpc_security_group_restrict_ingress_rdp_all.sql

+  end as status,
+  case
+    when ingress_rdp_rules.group_id is null then sg.group_id || ' ingress restricted for RDP from 0.0.0.0/0.'
+    else  sg.group_id || ' contains ' || ingress_rdp_rules.num_rdp_rules || ' ingress rule(s) allowing RDP from 0.0.0.0/0.'


Suggested change

else sg.group_id || ' contains ' || ingress_rdp_rules.num_rdp_rules || ' ingress rule(s) allowing RDP from 0.0.0.0/0.'

else sg.group_id || ' contains ' || ingress_rdp_rules.num_rdp_rules || ' ingress rule(s) allowing RDP from 0.0.0.0/0.'

madhushreeray30 added 10 commits January 13, 2023 19:23

Add cis v120 common tags

c308b12

Add cis_v120 section 1

e58f6d1

Add cis_v120 section 1 docs

e75efcc

Add cis_v120 section 2

6ba5cf0

Add cis_v120 section 2 docs

05255a2

Add cis_v120 section 3

3eeb758

Add cis_v120 section 3 docs

fdb729f

Add cis_v120 section 4

3b30470

Add cis_v120 section 4 docs

2a26007

Add new query for cis_v120

09f156f

madhushreeray30 requested a review from rajlearner17 January 13, 2023 14:08

madhushreeray30 self-assigned this Jan 13, 2023

madhushreeray30 linked an issue Jan 13, 2023 that may be closed by this pull request

Evaluate & Add CIS Amazon Web Services Foundation Benchmark v1.2.0 #533

Closed

rajlearner17 requested a review from khushboo9024 January 13, 2023 14:22

madhushreeray30 added 2 commits January 13, 2023 20:15

Update service name

27dadb5

Update docs

2d43140

khushboo9024 reviewed Jan 16, 2023

View reviewed changes

khushboo9024 reviewed Jan 17, 2023

View reviewed changes

madhushreeray30 and others added 2 commits January 18, 2023 12:37

Update changes as per review comments

03e658d

update readme.md file

9c42825

khushboo9024 requested a review from misraved January 19, 2023 06:52

khushboo9024 approved these changes Jan 19, 2023

View reviewed changes

misraved reviewed Jan 19, 2023

View reviewed changes

Update indentation

99bf793

misraved approved these changes Jan 19, 2023

View reviewed changes

misraved changed the title ~~Add cis_v120 (downgrade)~~ Add cis_v120 benchmark Jan 19, 2023

misraved merged commit 9a220f5 into release/v0.55 Jan 19, 2023

misraved deleted the add-cis-v120 branch January 19, 2023 12:54

misraved mentioned this pull request Feb 2, 2023

Evaluate & Add CIS Amazon Web Services Foundation Benchmark v1.2.0 #533

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add cis_v120 benchmark #535

Add cis_v120 benchmark #535

madhushreeray30 commented Jan 13, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 16, 2023

khushboo9024 Jan 17, 2023

misraved left a comment

misraved Jan 19, 2023

misraved Jan 19, 2023

misraved Jan 19, 2023

misraved Jan 19, 2023

misraved Jan 19, 2023

misraved Jan 19, 2023

	documentation = file("./cis_v120/docs/cis_v120_3_3.md")
	documentation = file("./cis_v120/docs/cis_v120_3_4.md")

		- Click on `Make Inactive` - (Temporarily disable Key - may be needed again).
		- Click `Delete` - (Deleted keys cannot be recovered).

	sql = query.cloudtrail_multi_region_read_write_enabled.sql
	query = query.cloudtrail_multi_region_read_write_enabled

		- Create/Select an `IAM Role` and `Policy Name`.
		- Click `Allow` to continue.

		- Note: Ensure the CMK is located in the same region as the S3 bucket
		- Note: You will need to apply a KMS Key policy on the selected CMK in order for

	else sg.group_id \|\| ' contains ' \|\| ingress_rdp_rules.num_rdp_rules \|\| ' ingress rule(s) allowing RDP from 0.0.0.0/0.'
	else sg.group_id \|\| ' contains ' \|\| ingress_rdp_rules.num_rdp_rules \|\| ' ingress rule(s) allowing RDP from 0.0.0.0/0.'

Add cis_v120 benchmark #535

Add cis_v120 benchmark #535

Conversation

madhushreeray30 commented Jan 13, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

misraved left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment