Add/Update AWS Audit Manager > GxP 21 CFR Part 11. Closes #598 #600

madhushreeray30 · 2023-04-03T13:38:01Z

Checklist

Issue(s) linked

Benchmark	Control(s)
gxp_21_cfr_part_11_11_10 Controls for closed systems	db_instance_backup_enabled
	dynamodb_in_backup_plan
	dynamodb_pitr_enabled
	ebs_in_backup_plan
	ebs_optimized_instance
	efs_in_backup_plan
	elasticache_redis_cluster_automatic_backup_check
	rds_in_backup_plan
	redshift_backup_enabled
	s3_bucket_replication_enabled
	s3_bucket_versioning_enabled
gxp_21_cfr_part_11_11_10_a	aurora_resources_protected_by_backup_plan
	backup_plan_min_frequency_and_min_retention_check
	backup_recovery_point_encrypted
	backup_recovery_point_manual_deletion_disabled
	backup_recovery_point_minimum_retention_check
	cloudtrail_security_trail_enabled
	dynamodb_resources_protected_by_backup_plan
	ebs_resources_protected_by_backup_plan
	ec2_resources_protected_by_backup_plan
	ec2_volume_inuse_check
	efs_resources_protected_by_backup_plan
	elb_deletion_protection_enabled
	fsx_resources_protected_by_backup_plan
	rds_resources_protected_by_backup_plan
gxp_21_cfr_part_11_11_10_c	cloud_trail_enabled
	cloud_trail_log_file_validation_enabled
	db_instance_backup_enabled
	dynamodb_in_backup_plan
	dynamodb_pitr_enabled
	ebs_in_backup_plan
	ebs_optimized_instance
	ecr_private_lifecycle_policy_configured
	efs_in_backup_plan
	elasticache_redis_cluster_automatic_backup_check
	rds_in_backup_plan
	redshift_backup_enabled
	s3_bucket_replication_enabled
	s3_lifecycle_policy_check
	s3_version_lifecycle_policy_check
gxp_21_cfr_part_11_11_10_d	dynamodb_table_encrypted_kms
	ec2_ebs_encryption_by_default
	efs_encrypted_check
	elasticsearch_encrypted_at_rest
	elasticsearch_node_to_node_encryption_check
	encrypted_volumes
	iam_role_managed_policy_check
	restricted_incoming_traffic
	s3_account_level_public_access_blocks
	s3_bucket_level_public_access_prohibited
	s3_bucket_policy_grantee_check
	ssm_document_not_public
	subnet_auto_assign_public_ip_disableds3_account_level_public_access_blocks_periodic
gxp_21_cfr_part_11_11_10_e	db_instance_backup_enabled
	dynamodb_in_backup_plan
	dynamodb_pitr_enabled
	ebs_in_backup_plan
	ebs_optimized_instance
	efs_in_backup_plan
	elasticache_redis_cluster_automatic_backup_check
	opensearch_audit_logging_enabled
	opensearch_logs_to_cloudwatch
	rds_in_backup_plan
	redshift_audit_logging_enabled
	redshift_backup_enabled
	s3_bucket_replication_enabled
	s3_bucket_versioning_enabled
gxp_21_cfr_part_11_11_10_g	efs_encrypted_check
	restricted_incoming_traffic
	s3_account_level_public_access_blocks
	s3_account_level_public_access_blocks_periodic
	s3_bucket_level_public_access_prohibited
	s3_bucket_policy_grantee_check
	ssm_document_not_public
gxp_21_cfr_part_11_11_10_k	autoscaling_launch_config_public_ip_disabled
	restricted_incoming_traffic
	s3_account_level_public_access_blocks
	ssm_document_not_public
gxp_21_cfr_part_11_11_200_a	access_keys_rotated
	iam_password_policy
	iam_root_access_key_check
	iam_user_mfa_enabled
	mfa_enabled_for_iam_console_access
	root_account_hardware_mfa_enabled
	root_account_mfa_enabled
gxp_21_cfr_part_11_11_30 Controls for open systems	api_gw_ssl_enabledelbv2_acm_certificate_required
	backup_recovery_point_encrypted
	cloudfront_no_deprecated_ssl_protocols
	cloudfront_traffic_to_origin_encrypted
	codebuild_project_artifact_encryption
	codebuild_project_s3_logs_encrypted
	efs_encrypted_check
	kinesis_stream_encrypted
	opensearch_encrypted_at_rest
	opensearch_https_required
	opensearch_node_to_node_encryption_check

Removed Controls

Benchmark	Control(s)
gxp_21_cfr_part_11_11_10_a	ebs_volume_unused
gxp_21_cfr_part_11_11_10_a	elb_application_lb_deletion_protection_enabled
gxp_21_cfr_part_11_11_10_c	redshift_cluster_kms_enabled
gxp_21_cfr_part_11_11_10_d	s3_public_access_block_account
gxp_21_cfr_part_11_11_10_d	s3_public_access_block_bucket
gxp_21_cfr_part_11_11_10_d	vpc_security_group_restrict_ingress_common_ports_all
gxp_21_cfr_part_11_11_10_d	vpc_subnet_auto_assign_public_ip_disabled
gxp_21_cfr_part_11_11_10_e	redshift_cluster_kms_enabled
gxp_21_cfr_part_11_11_10_g	efs_file_system_encrypt_data_at_rest
gxp_21_cfr_part_11_11_10_g	s3_public_access_block_account
gxp_21_cfr_part_11_11_10_g	s3_public_access_block_bucket
gxp_21_cfr_part_11_11_10_g	vpc_security_group_restrict_ingress_common_ports_all
gxp_21_cfr_part_11_11_10_k	vpc_security_group_restrict_ingress_common_ports_all
gxp_21_cfr_part_11_11_200 Electronic signature components and controls	iam_account_password_policy_strong
gxp_21_cfr_part_11_11_200	iam_root_user_hardware_mfa_enabled
gxp_21_cfr_part_11_11_200	iam_root_user_mfa_enabled
gxp_21_cfr_part_11_11_200	iam_root_user_no_access_keys
gxp_21_cfr_part_11_11_200	iam_user_access_key_age_90
gxp_21_cfr_part_11_11_200	iam_user_console_access_mfa_enabled
gxp_21_cfr_part_11_11_200	iam_user_mfa_enabled
gxp_21_cfr_part_11_11_30 Controls for open systems	apigateway_rest_api_stage_use_ssl_certificate
gxp_21_cfr_part_11_11_30	efs_file_system_encrypt_data_at_rest
gxp_21_cfr_part_11_11_30	elb_application_network_lb_use_ssl_certificate
gxp_21_cfr_part_11_11_30	rds_db_instance_encryption_at_rest_enabled

…mpliance into gxp-21-cfr-part-11

cbruno10

@madhushreeray30 I left some comments, can you please have a look? Thanks!

gxp_21_cfr_part_11/gxp_21_cfr_part_11.sp

cbruno10 · 2023-04-04T12:44:09Z

gxp_21_cfr_part_11/11_200.sp

@@ -1,8 +1,18 @@
 benchmark "gxp_21_cfr_part_11_11_200" {
  title       = "11.200 Electronic signature components and controls"
+  description = "TO DO"


What is this supposed to be?

@cbruno10 as discussed with @khushboo9024 she will update this as it is not present in the Audit Manager console.

Do we have any description we can use? Will the Hub page look blank/empty (assming we don't have a separate doc for this one)?

rajlearner17 · 2023-04-05T11:11:55Z

gxp_21_cfr_part_11/11_10.sp

@@ -1,14 +1,25 @@
 benchmark "gxp_21_cfr_part_11_11_10" {
-  title       = "11.10 Controls for closed systems"
-  description = "Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine. Such procedures and controls shall include the following benchmarks."
+  title       = "11.10"


@madhushreeray30 we are missing with Title

misraved

Please take a look at the review comments. Thanks!!

misraved · 2023-04-07T09:30:41Z

conformance_pack/codebuild.sp

@@ -93,11 +93,24 @@ control "codebuild_project_environment_privileged_mode_disabled" {

 control "codebuild_project_artifact_encryption_enabled" {
  title       = "CodeBuild project artifact encryption should be enabled"
-  description = "This control checks if an AWS CodeBuild project has encryption enabled for all of its artifacts. The rule is non compliant if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations."
+  description = "This control checks if an CodeBuild project has encryption enabled for all of its artifacts. The rule is non compliant if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations."


Suggested change

description = "This control checks if an CodeBuild project has encryption enabled for all of its artifacts. The rule is non compliant if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations."

description = "This control checks if a CodeBuild project has encryption enabled for all of its artifacts. The rule is non compliant if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations."

misraved · 2023-04-07T09:31:30Z

conformance_pack/opensearch.sp

+
+control "opensearch_domain_node_to_node_encryption_enabled" {
+  title       = "OpenSearch domains node-to-node encryption should be enabled"
+  description = "This control check if Amazon OpenSearch Service nodes are encrypted end to end. The rule is non compliant if the node-to-node encryption is not enabled on the domain."


Suggested change

description = "This control check if Amazon OpenSearch Service nodes are encrypted end to end. The rule is non compliant if the node-to-node encryption is not enabled on the domain."

description = "This control checks if Amazon OpenSearch Service nodes are encrypted end to end. The rule is non-compliant if the node-to-node encryption is not enabled on the domain."

misraved · 2023-04-07T09:32:27Z

conformance_pack/s3.sp

+    pci_dss_v321       = "true"
+    gxp_21_cfr_part_11 = "true"
+    soc_2              = "true"


Please sort the tags.

conformance_pack/s3.sp

misraved · 2023-04-07T09:35:00Z

conformance_pack/s3.sp

+        else 'ok'
+      end as status,
+      case
+        when policy_std is null then title || ' policy not publicly accessable.'


Suggested change

when policy_std is null then title || ' policy not publicly accessable.'

when policy_std is null then title || ' policy not publicly accessible.'

misraved · 2023-04-07T09:35:24Z

conformance_pack/s3.sp

+      end as status,
+      case
+        when policy_std is null then title || ' policy not publicly accessable.'
+        when s ->> 'Effect' = 'Allow' and (s -> 'Principal' -> 'AWS' = '["*"]' or s ->> 'Principal' = '*') then title || ' policy publicly accessable.'


Suggested change

when s ->> 'Effect' = 'Allow' and (s -> 'Principal' -> 'AWS' = '["*"]' or s ->> 'Principal' = '*') then title || ' policy publicly accessable.'

when s ->> 'Effect' = 'Allow' and (s -> 'Principal' -> 'AWS' = '["*"]' or s ->> 'Principal' = '*') then title || ' policy publicly accessible.'

misraved · 2023-04-07T09:35:34Z

conformance_pack/s3.sp

+      case
+        when policy_std is null then title || ' policy not publicly accessable.'
+        when s ->> 'Effect' = 'Allow' and (s -> 'Principal' -> 'AWS' = '["*"]' or s ->> 'Principal' = '*') then title || ' policy publicly accessable.'
+        else title || ' policy not publicly accessable.'


Suggested change

else title || ' policy not publicly accessable.'

else title || ' policy not publicly accessible.'

misraved · 2023-04-07T09:36:09Z

conformance_pack/vpc.sp

@@ -299,6 +298,16 @@ control "vpc_network_acl_unused" {
  })
 }

+control "vpc_security_group_allows_ingress_authorized_ports" {
+  title       = "VPC Security groups should only allow unrestricted incoming traffic for authorized ports"
+  description = "This control checks whether the vpc security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443."


Suggested change

description = "This control checks whether the vpc security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443."

description = "This control checks whether the VPC security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443."

madhushreeray30 added 3 commits April 3, 2023 17:46

add initial design to benchmark.gxp_21_cfr_part_11

6d3cee0

Merge branch 'main' of https://github.com/turbot/steampipe-mod-aws-co…

8c6053a

…mpliance into gxp-21-cfr-part-11

update controls

8c3e0ae

madhushreeray30 self-assigned this Apr 3, 2023

madhushreeray30 linked an issue Apr 3, 2023 that may be closed by this pull request

Add/Update AWS Audit Manager > GxP 21 CFR Part 11 #598

Closed

madhushreeray30 changed the title ~~Add/Update AWS Audit Manager > GxP 21 CFR Part 11 Closes #598~~ Add/Update AWS Audit Manager > GxP 21 CFR Part 11 Closes #598 [WIP] Apr 3, 2023

madhushreeray30 added 5 commits April 3, 2023 20:33

Update gxp_eu_annex_11 all benchmarks as per Audit Manager

d4a2b5b

addition of control

9d94d4b

add control

3883aea

syntax update

e65957a

add tags to controls

5834b05

madhushreeray30 changed the title ~~Add/Update AWS Audit Manager > GxP 21 CFR Part 11 Closes #598 [WIP]~~ Add/Update AWS Audit Manager > GxP 21 CFR Part 11 Closes #598 Apr 4, 2023

madhushreeray30 marked this pull request as ready for review April 4, 2023 11:55

madhushreeray30 added 2 commits April 4, 2023 17:28

update syntax

ac40cff

update syntax

bdf0cab

madhushreeray30 requested a review from khushboo9024 April 4, 2023 12:03

madhushreeray30 changed the title ~~Add/Update AWS Audit Manager > GxP 21 CFR Part 11 Closes #598~~ Add/Update AWS Audit Manager > GxP 21 CFR Part 11. Closes #598 Apr 4, 2023

cbruno10 requested changes Apr 4, 2023

View reviewed changes

madhushreeray30 added 2 commits April 4, 2023 18:48

update order of benchmarks

7b4b1eb

resolve merge conflicts

4a0514f

rajlearner17 reviewed Apr 5, 2023

View reviewed changes

khushboo9024 mentioned this pull request Apr 5, 2023

Add/Update AWS Audit Manager > GxP EU Annex 11. Closes #597 #601

Closed

1 task

khushboo9024 added 6 commits April 5, 2023 18:35

remove duplicate controls

bf78ee1

update title

5821272

update structure

c616bec

update

9a2f746

update

befa7a7

update

9c7e58c

misraved reviewed Apr 7, 2023

View reviewed changes

review commnets

1c759e1

misraved approved these changes Apr 7, 2023

View reviewed changes

misraved merged commit 932b9e5 into release/v0.61 Apr 7, 2023

misraved deleted the gxp-21-cfr-part-11 branch April 7, 2023 11:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add/Update AWS Audit Manager > GxP 21 CFR Part 11. Closes #598 #600

Add/Update AWS Audit Manager > GxP 21 CFR Part 11. Closes #598 #600

madhushreeray30 commented Apr 3, 2023 •

edited by khushboo9024

Loading

cbruno10 left a comment

cbruno10 Apr 4, 2023

madhushreeray30 Apr 4, 2023

cbruno10 Apr 4, 2023

rajlearner17 Apr 5, 2023

misraved left a comment

misraved Apr 7, 2023

misraved Apr 7, 2023

misraved Apr 7, 2023

misraved Apr 7, 2023

misraved Apr 7, 2023

misraved Apr 7, 2023

misraved Apr 7, 2023

	description = "This control checks if an CodeBuild project has encryption enabled for all of its artifacts. The rule is non compliant if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations."
	description = "This control checks if a CodeBuild project has encryption enabled for all of its artifacts. The rule is non compliant if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations."

	description = "This control check if Amazon OpenSearch Service nodes are encrypted end to end. The rule is non compliant if the node-to-node encryption is not enabled on the domain."
	description = "This control checks if Amazon OpenSearch Service nodes are encrypted end to end. The rule is non-compliant if the node-to-node encryption is not enabled on the domain."

	when policy_std is null then title \|\| ' policy not publicly accessable.'
	when policy_std is null then title \|\| ' policy not publicly accessible.'

	when s ->> 'Effect' = 'Allow' and (s -> 'Principal' -> 'AWS' = '[""]' or s ->> 'Principal' = '') then title \|\| ' policy publicly accessable.'
	when s ->> 'Effect' = 'Allow' and (s -> 'Principal' -> 'AWS' = '[""]' or s ->> 'Principal' = '') then title \|\| ' policy publicly accessible.'

	else title \|\| ' policy not publicly accessable.'
	else title \|\| ' policy not publicly accessible.'

	description = "This control checks whether the vpc security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443."
	description = "This control checks whether the VPC security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443."

Add/Update AWS Audit Manager > GxP 21 CFR Part 11. Closes #598 #600

Add/Update AWS Audit Manager > GxP 21 CFR Part 11. Closes #598 #600

Conversation

madhushreeray30 commented Apr 3, 2023 • edited by khushboo9024 Loading

Checklist

cbruno10 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

misraved left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

madhushreeray30 commented Apr 3, 2023 •

edited by khushboo9024

Loading