Tables of control metadata

This section contains tables that show the metadata for controls. Each control has a unique API identifier for each Region in which AWS Control Tower is available. Each control also has a global identifier. When you are working with the control APIs, you can provide the identifier for the Region in which you are making the API call, or the global identifier. We recommend that you provide the global identifier in most cases.

Last updated August 30, 2024.

AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by home Region
AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 2.2	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED`

AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED	CIS AWS Benchmark 1.4 2.1.1 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED`

AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED	CIS AWS Benchmark 1.4 3.6 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED`

AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED`

AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED`

AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED`

AWS-GR_AUDIT_BUCKET_RETENTION_POLICY

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUDIT_BUCKET_RETENTION_POLICY	NIST 800-53 Rev 5 SI-12	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY`

AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED`

AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19) PCI DSS version 3.2.1 10.5.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED`

AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED	CIS AWS Benchmark 1.4 3.4 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 AU-7(1) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-4(5) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED`

AWS-GR_CLOUDTRAIL_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CLOUDTRAIL_ENABLED	CIS AWS Benchmark 1.4 3.1 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-14(1) NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SA-8(22) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CLOUDTRAIL_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CLOUDTRAIL_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CLOUDTRAIL_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CLOUDTRAIL_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CLOUDTRAIL_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CLOUDTRAIL_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CLOUDTRAIL_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CLOUDTRAIL_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CLOUDTRAIL_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CLOUDTRAIL_ENABLED`

AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED	NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-7(1) NIST 800-53 Rev 5 SI-7(3) NIST 800-53 Rev 5 SI-7(7) PCI DSS version 3.2.1 10.5.5 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.2	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED`

AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED	CIS AWS Benchmark 1.4 3.2 NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED`

AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY`

AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED`

AWS-GR_CONFIG_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CONFIG_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CONFIG_CHANGE_PROHIBITED`

AWS-GR_CONFIG_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CONFIG_ENABLED	CIS AWS Benchmark 1.4 3.5 NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-6(1) NIST 800-53 Rev 5 CM-8 NIST 800-53 Rev 5 CM-8(2) PCI DSS version 3.2.1 11.5	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CONFIG_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CONFIG_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CONFIG_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CONFIG_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CONFIG_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CONFIG_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CONFIG_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CONFIG_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CONFIG_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CONFIG_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CONFIG_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CONFIG_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CONFIG_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CONFIG_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CONFIG_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CONFIG_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CONFIG_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CONFIG_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CONFIG_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CONFIG_ENABLED`

AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED`

AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19) PCI DSS version 3.2.1 10.5.2	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED`

AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED`

AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED`

AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED`

AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-14(1) NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SA-8(22) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS`

AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-14(1) NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SA-8(22) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS`

AWS-GR_DISALLOW_CROSS_REGION_NETWORKING

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_DISALLOW_CROSS_REGION_NETWORKING	None	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING`

AWS-GR_DISALLOW_VPC_INTERNET_ACCESS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_DISALLOW_VPC_INTERNET_ACCESS	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS`

AWS-GR_DISALLOW_VPN_CONNECTIONS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_DISALLOW_VPN_CONNECTIONS	None	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_DISALLOW_VPN_CONNECTIONS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_DISALLOW_VPN_CONNECTIONS`

AWS-GR_DMS_REPLICATION_NOT_PUBLIC

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_DMS_REPLICATION_NOT_PUBLIC	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC`

AWS-GR_EBS_OPTIMIZED_INSTANCE

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_EBS_OPTIMIZED_INSTANCE	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_EBS_OPTIMIZED_INSTANCE` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_EBS_OPTIMIZED_INSTANCE`

AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK`

AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP`

AWS-GR_EC2_VOLUME_INUSE_CHECK

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_EC2_VOLUME_INUSE_CHECK	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.4	Optimize costs	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_EC2_VOLUME_INUSE_CHECK`

AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS`

AWS-GR_ELASTICSEARCH_IN_VPC_ONLY

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_ELASTICSEARCH_IN_VPC_ONLY	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY`

AWS-GR_EMR_MASTER_NO_PUBLIC_IP

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_EMR_MASTER_NO_PUBLIC_IP	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP`

AWS-GR_ENCRYPTED_VOLUMES

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_ENCRYPTED_VOLUMES	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_ENCRYPTED_VOLUMES` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_ENCRYPTED_VOLUMES` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_ENCRYPTED_VOLUMES` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_ENCRYPTED_VOLUMES` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_ENCRYPTED_VOLUMES` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_ENCRYPTED_VOLUMES` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_ENCRYPTED_VOLUMES` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_ENCRYPTED_VOLUMES` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_ENCRYPTED_VOLUMES` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_ENCRYPTED_VOLUMES` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_ENCRYPTED_VOLUMES` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_ENCRYPTED_VOLUMES` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_ENCRYPTED_VOLUMES`

AWS-GR_IAM_ROLE_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_IAM_ROLE_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED`

AWS-GR_IAM_USER_MFA_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_IAM_USER_MFA_ENABLED	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 IA-2(1) NIST 800-53 Rev 5 IA-2(2) NIST 800-53 Rev 5 IA-2(6) NIST 800-53 Rev 5 IA-2(8) PCI DSS version 3.2.1 8.3.1 PCI DSS version 3.2.1 8.3.2 PCI DSS version 3.2.1 8.6	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_IAM_USER_MFA_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_IAM_USER_MFA_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_IAM_USER_MFA_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_IAM_USER_MFA_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_IAM_USER_MFA_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_IAM_USER_MFA_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_IAM_USER_MFA_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_IAM_USER_MFA_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_IAM_USER_MFA_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_IAM_USER_MFA_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_IAM_USER_MFA_ENABLED`

AWS-GR_LAMBDA_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_LAMBDA_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED`

AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED`

AWS-GR_LOG_GROUP_POLICY

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_LOG_GROUP_POLICY	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_LOG_GROUP_POLICY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_LOG_GROUP_POLICY` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_LOG_GROUP_POLICY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_LOG_GROUP_POLICY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_LOG_GROUP_POLICY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_LOG_GROUP_POLICY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_LOG_GROUP_POLICY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_LOG_GROUP_POLICY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_LOG_GROUP_POLICY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_LOG_GROUP_POLICY` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_LOG_GROUP_POLICY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_LOG_GROUP_POLICY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_LOG_GROUP_POLICY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_LOG_GROUP_POLICY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_LOG_GROUP_POLICY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_LOG_GROUP_POLICY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_LOG_GROUP_POLICY` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_LOG_GROUP_POLICY` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_LOG_GROUP_POLICY` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_LOG_GROUP_POLICY`

AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS	CIS AWS Benchmark 1.4 1.10 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 IA-2(1) NIST 800-53 Rev 5 IA-2(2) NIST 800-53 Rev 5 IA-2(6) NIST 800-53 Rev 5 IA-2(8) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 8.3.1 PCI DSS version 3.2.1 8.3.2 PCI DSS version 3.2.1 8.6	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS`

AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW`

AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK`

AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED`

AWS-GR_RDS_STORAGE_ENCRYPTED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RDS_STORAGE_ENCRYPTED	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RDS_STORAGE_ENCRYPTED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RDS_STORAGE_ENCRYPTED`

AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK`

AWS-GR_REGION_DENY

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_REGION_DENY	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 7.2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_REGION_DENY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_REGION_DENY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_REGION_DENY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_REGION_DENY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_REGION_DENY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_REGION_DENY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_REGION_DENY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_REGION_DENY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_REGION_DENY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_REGION_DENY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_REGION_DENY` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_REGION_DENY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_REGION_DENY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_REGION_DENY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_REGION_DENY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_REGION_DENY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_REGION_DENY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_REGION_DENY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_REGION_DENY` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_REGION_DENY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_REGION_DENY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_REGION_DENY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_REGION_DENY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_REGION_DENY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_REGION_DENY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_REGION_DENY` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_REGION_DENY` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_REGION_DENY` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_REGION_DENY`

AWS-GR_RESTRICTED_COMMON_PORTS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RESTRICTED_COMMON_PORTS	CIS AWS Benchmark 1.4 5.2 NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RESTRICTED_COMMON_PORTS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RESTRICTED_COMMON_PORTS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RESTRICTED_COMMON_PORTS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RESTRICTED_COMMON_PORTS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RESTRICTED_COMMON_PORTS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RESTRICTED_COMMON_PORTS`

AWS-GR_RESTRICTED_SSH

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RESTRICTED_SSH	CIS AWS Benchmark 1.4 5.2 NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RESTRICTED_SSH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RESTRICTED_SSH` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RESTRICTED_SSH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RESTRICTED_SSH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RESTRICTED_SSH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RESTRICTED_SSH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RESTRICTED_SSH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RESTRICTED_SSH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RESTRICTED_SSH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RESTRICTED_SSH` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RESTRICTED_SSH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RESTRICTED_SSH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RESTRICTED_SSH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RESTRICTED_SSH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RESTRICTED_SSH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RESTRICTED_SSH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICTED_SSH` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RESTRICTED_SSH` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RESTRICTED_SSH` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RESTRICTED_SSH`

AWS-GR_RESTRICT_ROOT_USER

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RESTRICT_ROOT_USER	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.1.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RESTRICT_ROOT_USER` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RESTRICT_ROOT_USER` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RESTRICT_ROOT_USER` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RESTRICT_ROOT_USER` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RESTRICT_ROOT_USER` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RESTRICT_ROOT_USER` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RESTRICT_ROOT_USER` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RESTRICT_ROOT_USER` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RESTRICT_ROOT_USER` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RESTRICT_ROOT_USER` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICT_ROOT_USER` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RESTRICT_ROOT_USER` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RESTRICT_ROOT_USER` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RESTRICT_ROOT_USER`

AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS	CIS AWS Benchmark 1.4 1.4 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.1.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS`

AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION`

AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA	CIS AWS Benchmark 1.4 2.1.3 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 2.2	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA`

AWS-GR_ROOT_ACCOUNT_MFA_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_ROOT_ACCOUNT_MFA_ENABLED	CIS AWS Benchmark 1.4 1.5 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 IA-2(1) NIST 800-53 Rev 5 IA-2(2) NIST 800-53 Rev 5 IA-2(6) NIST 800-53 Rev 5 IA-2(8) PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 8.3.1 PCI DSS version 3.2.1 8.3.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED`

AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC	CIS AWS Benchmark 1.4 2.1.5 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC`

AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED`

AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED`

AWS-GR_S3_VERSIONING_ENABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_S3_VERSIONING_ENABLED	CIS AWS Benchmark 1.4 2.1.3 NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.5.5	Optimize costs Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_S3_VERSIONING_ENABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_S3_VERSIONING_ENABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_S3_VERSIONING_ENABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_S3_VERSIONING_ENABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_S3_VERSIONING_ENABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_S3_VERSIONING_ENABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_S3_VERSIONING_ENABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_S3_VERSIONING_ENABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_S3_VERSIONING_ENABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_S3_VERSIONING_ENABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_S3_VERSIONING_ENABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_S3_VERSIONING_ENABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_S3_VERSIONING_ENABLED`

AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS`

AWS-GR_SNS_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_SNS_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_SNS_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_SNS_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_SNS_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_SNS_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_SNS_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_SNS_CHANGE_PROHIBITED`

AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(8) NIST 800-53 Rev 5 SA-8(19)	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED`

AWS-GR_SSM_DOCUMENT_NOT_PUBLIC

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_SSM_DOCUMENT_NOT_PUBLIC	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC`

AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED

Control identifier	Framework	Control objective	Control API identifiers, by Region
AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (London) `arn:aws:controltower:eu-west-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` US East (Ohio) `arn:aws:controltower:us-east-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` US West (N. California) `arn:aws:controltower:us-west-1::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED`

CT.ACM.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ACM.PR.1	None	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZELXXBEFAIZK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DIUHEHAUSSPQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XFRRFFLMUBDQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZYLCIKKLJKLN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PFBKTWXIMMIV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YSLZGQSFAAGK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PUXHXGEXNZWU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JHLOZPXDFZLZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OTJFGEEQXKHE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IYXOFXBXLMGS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UTGLXCQDISMW` Canada (Central) `arn:aws:controltower:ca-central-1::control/CKCKTGLVEKYB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EFGFCKDLGVOR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JSJTOIBKUZXR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XJPCVFFVVNLH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AJYPIRPBHBRU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CDFRPKVAAEBA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RMPGJNTOZYED` Europe (London) `arn:aws:controltower:eu-west-2::control/TMHLCRNZFYCN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DEOJHGUDMVVV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AIMLPTHSIIAM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CDPBPPYWQXFU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MJAMNXHSTERV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MHGHBXOCHYCS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CWIZNCRIHXMW` US East (Ohio) `arn:aws:controltower:us-east-2::control/SOEEZVLQQMBP` US West (N. California) `arn:aws:controltower:us-west-1::control/OGGUGDZQUZYR` US West (Oregon) `arn:aws:controltower:us-west-2::control/RLCUCIOSPRZN`

CT.APIGATEWAY.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APIGATEWAY.PR.1	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BRXRBWLDNNXE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HQJNVXOQEKEX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ETKWXIYCRYUF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ASAMDCSLJXZV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SQJBDNVUHOVM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OWNNOAXIDVKF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZKNNHMHVZWCV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QFZCLBSXXBKM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MGCUKHLRUHGP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CBCSCTURQXDP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AOHBBOHVYOXC` Canada (Central) `arn:aws:controltower:ca-central-1::control/EUYZNAPVCUUS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XHEVQAZTSEAZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IOPQNYUJZKFP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RPLZIVLHUEVE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EKDIMRUQZBUI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SVYVSCZDWYQP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KBXFFJCCXCCZ` Europe (London) `arn:aws:controltower:eu-west-2::control/VLFAZTXPNOXB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VJLLSIZIUQRW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWEXQRIWWTYU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WSEWTPYUNKIZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CKGLZQHZKKZO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XGXELVOLINOS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/THVNUTMFZVUS` US East (Ohio) `arn:aws:controltower:us-east-2::control/XRIIZCMYLTPU` US West (N. California) `arn:aws:controltower:us-west-1::control/ASCJCHWUCXDE` US West (Oregon) `arn:aws:controltower:us-west-2::control/SKIBWKYUQAAC`

CT.APIGATEWAY.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APIGATEWAY.PR.2	NIST 800-53 Rev 5 CA-7 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YCKXUGJPJJVQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KAUPNLFAXLZW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XSDRGBMLIVBR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BMGEYEHCOBBU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SXPSZGLUEEZH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YVJSVPYRBSBH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WUVYCWRIERYH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IFWWBITJQWQO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EAPHSJQRHZUB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EGXWMKYDFRSK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CPRJZNHSLXQO` Canada (Central) `arn:aws:controltower:ca-central-1::control/RPOXLFOSAVOI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PEIQUNSHAALC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MRKDCBADGMTL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JZXXPWRFZLER` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MWDNBKQDCNCE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KDXSGIXBAPZU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WEFXKWWQELZP` Europe (London) `arn:aws:controltower:eu-west-2::control/EDQVHSOAJDDX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GUYFEHMSFWNE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BZHXNKANLSRP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IWHRGFEHFWYR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BMPTRRAHQMJC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MQDMDGQZLEEB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EHSOKSSMVFWF` US East (Ohio) `arn:aws:controltower:us-east-2::control/MQXZJKMXOREU` US West (N. California) `arn:aws:controltower:us-west-1::control/WITVQTILCFXZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/XAZHJTQBXMLM`

CT.APIGATEWAY.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APIGATEWAY.PR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ILKACTDDSJMT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NLXAPQRKPIYU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FGGPHPWIRFWB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NBLSRDRBDJXO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CDPDATWIGGUH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HEBRXKGJORFL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DNUEOQSFWTRD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ESHXZMSBZXKE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NGDIEPXBGZNX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TRNOXUPEBWOO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JSVPQLCSVWLG` Canada (Central) `arn:aws:controltower:ca-central-1::control/XXKODHBWTZTZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TAYPGUHJACMN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BRRZGXLVBEXS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MQGSDYXVDOAD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KCSNFBWRTAXT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MYDVOFUAZSBV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DDAUQMQWAFBZ` Europe (London) `arn:aws:controltower:eu-west-2::control/BBWEHVVZVYOL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QSKRUWXUNEUH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PEZSUQGJPLXV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PTRXVPJHHFKP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LJZPLSKCPFIT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EISQVHJSJDWH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FIMWSVKNFANN` US East (Ohio) `arn:aws:controltower:us-east-2::control/DZDLWPOKGTPI` US West (N. California) `arn:aws:controltower:us-west-1::control/KSZKAGOPPWPH` US West (Oregon) `arn:aws:controltower:us-west-2::control/ELALMJSUVZGW`

CT.APIGATEWAY.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APIGATEWAY.PR.4	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LODJMMSVEOMN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KNVAYHZACOEU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QSCLQQFNJQXE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MULDPLOTLRAJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FAGHQEVLPXRL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YRNSAXOGSJSY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VXYNUKKTZXGE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KHGSJQSDYFLH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WUQUVNLUXDQU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BOOKWYPOXMTQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GDMZARUABRDK` Canada (Central) `arn:aws:controltower:ca-central-1::control/WDEOZRYGKEQK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HWAUYOESYCQT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PWAHYUHVUMYA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HHQMBNTKLTOG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IYMXHZIOFYDY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XDLQVFGAZWOU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VECSKJBMFGMM` Europe (London) `arn:aws:controltower:eu-west-2::control/FADFVQHALJXO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OOIWAZTWKKPE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LSFQOWIWAFSL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WGYBRYLPERPA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KCIFTRLVLAAP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YLMPPINWZYZY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CSLQUIKVRGVG` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZZRGCTUQTBPU` US West (N. California) `arn:aws:controltower:us-west-1::control/ITPBHOOWRJGI` US West (Oregon) `arn:aws:controltower:us-west-2::control/CQKSRVXTWTEC`

CT.APIGATEWAY.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APIGATEWAY.PR.5	NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WSNSTKYGKFUC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EGRYMABJBFUD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UKYEADDRMENU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RFIFJOHVLBAB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GVUDUCUXKDLN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UXJBMYYQDHMX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EOXAVTBQIHIE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FXZEDHLSFKXJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RBLHXKSFLKZA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PAPTPLXSKUJL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XOIJWVLCCYTU` Canada (Central) `arn:aws:controltower:ca-central-1::control/NMHBYPLKKHGT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UQCQWSUFRSVB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WHSNEETRFEHL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BVSVXEMRTBNG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BROASONAOUZH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ATODWGOMZUCX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AKVOXJCRARVM` Europe (London) `arn:aws:controltower:eu-west-2::control/YYOCPBGNDCOQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JNGATIWVCCYS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EFKJPLZIUAII` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ILMJIBFINEQK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HLDJVPJJOPEY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZHWUFJCAJBDB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YNAHJMRFSATY` US East (Ohio) `arn:aws:controltower:us-east-2::control/KRLMXVLLTUAN` US West (N. California) `arn:aws:controltower:us-west-1::control/YHRHPQEAQQFX` US West (Oregon) `arn:aws:controltower:us-west-2::control/QSEYQKHHJZQO`

CT.APIGATEWAY.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APIGATEWAY.PR.6	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TVZMDZVNREUD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BOFKPQACPDVG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MQYPRRNUCSOT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KUTDOXVOKANL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GRMWXCQOGMBQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FYRZEYAUDCMX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/STHZPVSVPASX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HKKDWUFJIPOW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NGYIOYBYJLXL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QDOMOGKGWUOB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ECADNMFRQVPH` Canada (Central) `arn:aws:controltower:ca-central-1::control/OTRRYHQQAPMY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZWRTQAVLHFEX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FXSQWOABYYRI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VOAFRPAPOKKZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JMBKFYKXNRRY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HDUPSFYARAKE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GODRTVCQLFRW` Europe (London) `arn:aws:controltower:eu-west-2::control/GDUDQJEAZOYB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FTMJQQMLWIID` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NOWTBXQMFZOI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MUHJMIOUYMPR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HZBRLLFMKYLT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PRKHFLPAUJQS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LEGXJUSWUBYG` US East (Ohio) `arn:aws:controltower:us-east-2::control/GCVCIFYYIDDI` US West (N. California) `arn:aws:controltower:us-west-1::control/ZBNWFGFGNOLW` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZHTQTRRJWMVV`

CT.APPSYNC.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APPSYNC.PR.1	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SIIOFVZPPRKF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BFEHJBXPOGJN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XRXGFZGEYPMV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CXEXLMCYDMPY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TBPGNZBEDTST` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QHZRCUZCBFVR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KHNUYYGINTJK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SZSRSNLXOOXB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VZIWINLZXVMA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YVQNVHXOXYLS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NCDTANKPPSFX` Canada (Central) `arn:aws:controltower:ca-central-1::control/KRLWEXIIRJPA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MTIRJIPWCKMX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VFNPSSMVRVNT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DLWGUVABSKGB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WHCWMAHTSOPR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VTIFQREJYECJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CXUKMNSNXBOO` Europe (London) `arn:aws:controltower:eu-west-2::control/RDKAXOQVBPSE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QUFDDHHUWEED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ORFYDUQFUMSG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IXVVMUCTNMOM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ABNGUTRSLNDB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KBRRHKUVKJIV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ECXYQKUETWKC` US East (Ohio) `arn:aws:controltower:us-east-2::control/BCZEGAHHZSII` US West (N. California) `arn:aws:controltower:us-west-1::control/NYHHSONNHIWM` US West (Oregon) `arn:aws:controltower:us-west-2::control/AJBUYRGFMZAE`

CT.APPSYNC.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APPSYNC.PR.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WRAJDIMQFJNZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FAZJYQKXZNZD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BYDTAFCKTVON` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MMIBKBUMAXKX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YMEIVNTGKVYF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YZTDFULTHZAI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JXQTZKIXJRCC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SQADHLZMBZJN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EPAPANCGHNLC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XLMCUHYROLCP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HJCSACGZAZKN` Canada (Central) `arn:aws:controltower:ca-central-1::control/MDZMFQUIFJSZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZFMIUZRFIIDZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JJINXXJYEFGA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BLRXDIMFGOJQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JZUYXWPLLCYX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BMSDSLXZPINV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KPCUMXFUZQWY` Europe (London) `arn:aws:controltower:eu-west-2::control/WZDLWQSTOSVK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KPJYMSGQUONE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WGYORDBIOUGK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EVXZSWWFVGMF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZRBNZNZKFVSB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CORISMGRVTBQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YALQWSJIMFVU` US East (Ohio) `arn:aws:controltower:us-east-2::control/IUACTSJITYIP` US West (N. California) `arn:aws:controltower:us-west-1::control/AWCIAJRPMESS` US West (Oregon) `arn:aws:controltower:us-west-2::control/OJCFZINVIMTK`

CT.APPSYNC.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APPSYNC.PR.3	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XXAMXNJJHIZX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PARBBQZHXMYG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HXVOUTLHLMAS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DKAIJLHZEZFI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OCFAARZLCVUW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DSCBAAVLXJTA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IKYKQMGGAKTZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VNCILGZEFDHS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SZDKCLTUHPDS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FRBNCATEBZVB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TUDPSRDPJIPG` Canada (Central) `arn:aws:controltower:ca-central-1::control/GQJWEDLMDAWD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LHJSAZIYQGBQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JBDXGSHRENLT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JNBFWDSXTTSQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GEZDAESWIHAV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EQEGUFUDDQHJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZCAGTBPRCATH` Europe (London) `arn:aws:controltower:eu-west-2::control/SKVDXXAIZXAS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NSUWZXLBBZGU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FXLRULXUOQOB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IDFSZUUIHHNO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VQTAYSFTYZWE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WQRXWMANRGTV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CDQLXCUGHCOY` US East (Ohio) `arn:aws:controltower:us-east-2::control/MMGMSISTUNPH` US West (N. California) `arn:aws:controltower:us-west-1::control/PDCBBSRBGWCU` US West (Oregon) `arn:aws:controltower:us-west-2::control/MTXEWCQXZRSJ`

CT.APPSYNC.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APPSYNC.PR.4	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HXPDFHUHEAGX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ADBIOOHVWILY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SKJIDSWEEBBR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IZCXFCDNHOEL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SLXXVXFLDWNV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YBIIYQMKPBJC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CDKXWSFZGMII` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MSRCCHVLERDN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QMIISENUKIZB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GZLYQHADQMAH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KQAFEIDTVWYB` Canada (Central) `arn:aws:controltower:ca-central-1::control/NAGLSYFOFCUE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UPRFZBBAREAM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AAQCADCUGNNZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TITPSTZOQJEA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IZKKJIXCHNGE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PBWZKZJTUYPE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JEWJGQYDTBBV` Europe (London) `arn:aws:controltower:eu-west-2::control/SAUCBCNEYIBQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VYCGKMZTLQBB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XCLYSHBAFVLP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JNWFIEANKNDM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NJNPPEGGGHUH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OWXHGWEYHXGT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KXQLGHLTDUKA` US East (Ohio) `arn:aws:controltower:us-east-2::control/PEPMJSRRAZXC` US West (N. California) `arn:aws:controltower:us-west-1::control/ZHBAGUQQVLKG` US West (Oregon) `arn:aws:controltower:us-west-2::control/KPAZGUODKWRH`

CT.APPSYNC.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APPSYNC.PR.5	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VQCMTFWZFESX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PVJJZFMQQSPF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JYPEKUMPXCUA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CXBGWZGMPXHM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LWZZOXDNXPAK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LLJEFWBUEEMA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DLCUIJBZAGXG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MGQZMYVDXKJS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DUHLLHOUMSWK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HBAZXGAUBONS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UWWOREONBQQJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/FGRIEMDEJJCD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QBIHQJYGYUJQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MGKBZFZSNASR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JCAXXRBFBPDQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PBFQTTVIAQLU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BFVDRTHKJLKL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NNNDVOOEOQGB` Europe (London) `arn:aws:controltower:eu-west-2::control/YHZYLRZMFPHO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FHCEXHBWDKID` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YQQNPDLXEBEC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QVSLVDIFAEBE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GUKFISUDEUYY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YKVSQPMKRYXL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JSKWYPYNUFBV` US East (Ohio) `arn:aws:controltower:us-east-2::control/RGSLGMUEQOXS` US West (N. California) `arn:aws:controltower:us-west-1::control/TWYHQJHYOHHK` US West (Oregon) `arn:aws:controltower:us-west-2::control/SNXQHRNUFTVT`

CT.APPSYNC.PV.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.APPSYNC.PV.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VNLZALRQBJHO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JUWGYFFVXBGQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YNSQAMIIRMGX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZVMZWNPPTITL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RRJRZTMNIMKB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OAYEUAAFUDDQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XUCEXYLCFRYY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AXUBGPDVHUEE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GIEDWCIRISTE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DYSCGAATRAXF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YQEEAIPKXPEI` Canada (Central) `arn:aws:controltower:ca-central-1::control/XNSSRZIDASBO` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TEYGHRDJVBWB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NNVLEIVTNFHB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WRZPZVPZIXTG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XYERPUKVVRQX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DSFMITDCAMSZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AMGWCNEXGLWL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HJUTBNSBLFBB` Europe (London) `arn:aws:controltower:eu-west-2::control/QTKUHWDNZXGO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FSUFJSWNSEOR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UROPEMZXDRTR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CAVGFRMHJJHO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VQLWSAXZPUIE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BVZNWLXUCMHK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GDWPOPDDUXNQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/CLWUEYFLOCEQ` US West (N. California) `arn:aws:controltower:us-west-1::control/TMSFTWZRWSKG` US West (Oregon) `arn:aws:controltower:us-west-2::control/QLTPISPJRIPE`

CT.ATHENA.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ATHENA.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GXLVUGZWGPTI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FSUYBVWAVPGK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KPLQRIMZGQFV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JPLEOSQGPVEV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SVHRKRGSQYKT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XZSYTUYWCXPR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WPKKGXFEUSGM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XMSFGWXQSOWH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UICXTPHIPSTT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ORRXHOXQUYOA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LBESPKJSMPZT` Canada (Central) `arn:aws:controltower:ca-central-1::control/IAMMTTGPSEKX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EADNJFRAYKUJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UCHRTODUKKUV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MPGNZBGWNFVS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/REDTAGETRZSC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/URPFISNFLYYG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AZHMIHHETZDO` Europe (London) `arn:aws:controltower:eu-west-2::control/PUSAPFIQCZNX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XXXDCQWYZWYF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CBHKJDCZWOWR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CMPWKYVHAJYB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DQSSCZSZUYSW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZETBPDEAOPXT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LNAASCWIYQWF` US East (Ohio) `arn:aws:controltower:us-east-2::control/BNBFJQSJJIFX` US West (N. California) `arn:aws:controltower:us-west-1::control/VQPTJGDPPKXK` US West (Oregon) `arn:aws:controltower:us-west-2::control/FKFIKKLBQLRU`

CT.AUTOSCALING.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LPDQXNXJOCUG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EUMJCOCOQPZV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UYJOBTDPHAIM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FSXLENXSGMGD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MOPBPKZRKDTC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UWTJAKCQQDQS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PMSUPKWKNJRZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QYEYJCSWQXXD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GUKAWPWOAMGJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BXWJNMFCDYNN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XQUOYYWUREYF` Canada (Central) `arn:aws:controltower:ca-central-1::control/SDBNXVSDHXFD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LQQDNIWFNOQQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YUDNGTLYTVYU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/POOFLSRCMVHC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HDSPPVQSLZUA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BPGHYVYPPDUM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MOLUIXBLTNNW` Europe (London) `arn:aws:controltower:eu-west-2::control/YJQLIPRDBJSM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LURITYKMZLDH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ISDBSSNARIHR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZIIKRKCQBGWF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RFZEANHEBLOT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DTNVACZLNIPM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LHUKYNEKRWTH` US East (Ohio) `arn:aws:controltower:us-east-2::control/IBUFUPGANKZJ` US West (N. California) `arn:aws:controltower:us-west-1::control/NCYEGHVMTPXX` US West (Oregon) `arn:aws:controltower:us-west-2::control/KFRLNAHWVNDQ`

CT.AUTOSCALING.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.10	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2	Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XPMJUVGQRZQP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XIANJOZOITXH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RBQYQGMSHNLF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZQNRMCZKOUAT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZXFBYRTFQSEF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LGTYDBJHKRWY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XUABKDYXZWKI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XHGVMBLNPPWK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OISPUYEMXWDM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HRADZAJMASBP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FXROTUVAFTOK` Canada (Central) `arn:aws:controltower:ca-central-1::control/SNIFZDSHBSEQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NKCXAQTTDOFG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SJHFPGSBNCCP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CYWGZFXYCWBH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JKBGUGUPUXOH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SVBZRUZEGMYE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HMVEFWNHHUTX` Europe (London) `arn:aws:controltower:eu-west-2::control/EETUIZAQWGAA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XUXCKEHNSBOG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QNSBUMGSEKRJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SLDGWHPFIJKK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UEWBEZWBAFAT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EVOJXTEIPZKN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MVJMDOPCHBBJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/DUYNJIVJYYES` US West (N. California) `arn:aws:controltower:us-west-1::control/YTLCCWECZXYU` US West (Oregon) `arn:aws:controltower:us-west-2::control/KCPRFSJWXOGM`

CT.AUTOSCALING.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.11	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2	Encrypt data in transit Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZJUKULWWSHEE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NUZQYTYKBLMD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SBSPOYCVUQFI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BPRUTBOPITBZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WVMBATXXQYGH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RZLFQWHTFKLX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DMKZTXZXOCDV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LTEZJRQBQQYX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GRJULAQNDWZL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AIVKYADIWIXE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MCUARPNYQNRM` Canada (Central) `arn:aws:controltower:ca-central-1::control/CQVXMPTKZZLD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RUTQHWVKEXOQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PIJJPHEAASZC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QVZFLXUEKXMC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BYNSJFXOHCOC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LGAMIVPBSHQS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CHBXZVZCTIBQ` Europe (London) `arn:aws:controltower:eu-west-2::control/QKJIOLFNDGMR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HNIZWLRFKMZJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OFDKFLDYRGUH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JPXNUWHGCQAF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BHETJYCYYMGR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YTWQBJWKZDXS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OLRACLXUGWDA` US East (Ohio) `arn:aws:controltower:us-east-2::control/DUAMDOAQRDMU` US West (N. California) `arn:aws:controltower:us-west-1::control/ENFCDXVLDJME` US West (Oregon) `arn:aws:controltower:us-west-2::control/MPAFQHWVRUYV`

CT.AUTOSCALING.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.2	NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PCOGZFZUZXPX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MREILTLELYSG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DUPFUTISTCKO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TBBXRAYTVDEK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EPLQWROCHULU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZSFUPIZUKOLS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PCDFZDMSEJKW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WASLCDWKGJBP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FWWWWDZRSYOB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OKTFVJFNOEGH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VAHIVVEVBWHB` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZRMHGMLRJGDN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PKWPQZWUDPMC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OCWPOVIYYTSL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WYHXVTOLLLXU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XEJSBBJIGSRI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XGADYEWUCJUE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UBAHWQGSLVPQ` Europe (London) `arn:aws:controltower:eu-west-2::control/JZYHTBOMKDXG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RIBMFYNUIJWG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NPETPABQDTNO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PYCZYCNDAYHZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JATCUEWOCJQZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IJFUBJAPHSUS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GZBGBNOSJNHE` US East (Ohio) `arn:aws:controltower:us-east-2::control/FIAZHJHSVVLM` US West (N. California) `arn:aws:controltower:us-west-1::control/INKEXBGBWVPF` US West (Oregon) `arn:aws:controltower:us-west-2::control/AJUNDFQNUTWW`

CT.AUTOSCALING.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.4	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZNILUGCQAIUQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XJPQIYKNHPPF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WWETVQMUSGFB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZFEOJGAMVVZT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ANKICWWVQKYV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SOTBXAWRFPZB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LPLVNKCQLVJF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WAVCCMIDCEXH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DIXWASPFNOFQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XVBYPLVRQXBC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OJSMBFTLWYYY` Canada (Central) `arn:aws:controltower:ca-central-1::control/VCDSRAZXDLZP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/POLAIJLNEGQU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KPACOOSYZFZJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NVNXTLBWMDUW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BDAQOQKWQVIX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EEEUVWSLNVLL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IYKSVEZZLTNF` Europe (London) `arn:aws:controltower:eu-west-2::control/TJGWWGICHSES` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HHTBCTOYPGHZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LCGLUULINWMJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CFRAAHZMNZLB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XCWLRKVTYWNJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MIHQDSUSOAVN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UKYGXEVHJUTL` US East (Ohio) `arn:aws:controltower:us-east-2::control/WMWBOCEROGJK` US West (N. California) `arn:aws:controltower:us-west-1::control/ODABNVXWCCWN` US West (Oregon) `arn:aws:controltower:us-west-2::control/UEEYNVTGUBLF`

CT.AUTOSCALING.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.5	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YIJBLHBBQZVZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ESHYEDTXWSUW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RJDSVNZODQNV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MOWUHFAOJRJY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FOSLERMMWGCQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YWRLTVCFEEXT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TQETCIZKIMIU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/THTGVEGTGXBO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AQIXLPCCRQHS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MFBWYIYZRDWU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IDGOEBRSQBUY` Canada (Central) `arn:aws:controltower:ca-central-1::control/CXHVXOATJHPY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GDYUPFOPBKQP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YJUEUNVOJKAO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CZLFMLNISVYS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LZHHRTKSKBYG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HBCLYPOQKNIW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KICFAVQBOREF` Europe (London) `arn:aws:controltower:eu-west-2::control/UPTNYPJYCVOW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IHWPSXMEXIFN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DZZROKPAXCYC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OGJVZSSMIDLA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HWYCVNKQJITZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NPDLNLLZAFAC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GXOHAMKZZBEH` US East (Ohio) `arn:aws:controltower:us-east-2::control/RHEYJDCZKXSD` US West (N. California) `arn:aws:controltower:us-west-1::control/PKLTQMQWOKPC` US West (Oregon) `arn:aws:controltower:us-west-2::control/IKGGRITHSTQX`

CT.AUTOSCALING.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NCNVPQRRQZRO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EVLGNFFONEDR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RIHZBJGCQNZN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PALLYLIKPDOO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BSHZJGOWIYAN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OLNBKFLLQMBM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NCSOESJIZPDJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JBGGLEZGYNNY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HYEMAFKYGEOG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RIAGHUSPABQY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EWEADHPWKAQO` Canada (Central) `arn:aws:controltower:ca-central-1::control/KNWXLCUZBJPR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PFKPZDJXQARN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UGALPVVXQVQC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EQRHGKGNQNGX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WTWCPKFEWPYK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LEMBCAXJDJXF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WMTUSTWLRDZO` Europe (London) `arn:aws:controltower:eu-west-2::control/ZPCRFNLDIVTB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VVHBDVAENCXM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QAQRWYEEZZGK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HLLQBYJSJHOV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DWSDKOZNKSIN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RRGVMSFSHYVI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IMJNNSRJLUDS` US East (Ohio) `arn:aws:controltower:us-east-2::control/SBFDHQUFTINU` US West (N. California) `arn:aws:controltower:us-west-1::control/VULHVTLCFHLY` US West (Oregon) `arn:aws:controltower:us-west-2::control/XMQUOEMIYMAQ`

CT.AUTOSCALING.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.8	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YVPFFBYVWOYU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LMMGXHIXUJYZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LIFOKTEDIUJG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YZYBKZLRYPLJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UBFEQJTBFABY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JUIBGGNJBHVD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DKHBSPQGATGW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CTWWGOPBJZZV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZBBMSBCWHDJT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HFDQZKOIUTPA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CVLVWHPNFDHV` Canada (Central) `arn:aws:controltower:ca-central-1::control/SUQITVFXSNAS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/USQMZZGHDRYN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QIRLBHLADKAB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JHZVIDCOFKWQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YTPNKYLIYKVY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PSRDUBINGKQS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YBNNIYMRBIYN` Europe (London) `arn:aws:controltower:eu-west-2::control/ZYAHAGQKQTAU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DQVZDZGYRISN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SACRRCECVZND` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FJYUYTKCFRPF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AEHEFPZQXLUW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GVXMKGJZQXQZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JAZMSKNXGBDD` US East (Ohio) `arn:aws:controltower:us-east-2::control/CBEYLWICUQCE` US West (N. California) `arn:aws:controltower:us-west-1::control/PISDHZLSRYXL` US West (Oregon) `arn:aws:controltower:us-west-2::control/PKAHSCIYKNJT`

CT.AUTOSCALING.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.AUTOSCALING.PR.9	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PJFBBOZDWVXS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XHMWNRXPSSEC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VNUBXQIEBAGA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TXADDEAXHQJO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SDWSYCVWCGEH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PLFOJFSZJQRR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PVJJTCCPQERK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MMTQYBWWZFEN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XCDSJCZAJAGY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CRAVIZGSUZNW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YTUQPNAGTVUD` Canada (Central) `arn:aws:controltower:ca-central-1::control/GJMTGWEQYCFK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JQQDQQJXOGNO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VMYTQLGGELGN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RUZQHTXLDRVI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GMSBKMGNTIRU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HXLTCQISFQBE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XEPRSGZCLSZI` Europe (London) `arn:aws:controltower:eu-west-2::control/UIHDQDEKPNFW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EXRJITRPLSJJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TGPNJGPMKKAF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SKRIPSOLCETA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EPWSVXENIYJF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XOIVXLXSTMHC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RROOJIJVZTCD` US East (Ohio) `arn:aws:controltower:us-east-2::control/ITCMHPPHFUUS` US West (N. California) `arn:aws:controltower:us-west-1::control/SHEBBMZWBBUF` US West (Oregon) `arn:aws:controltower:us-west-2::control/XAJKDEPPKMLS`

CT.CLOUDFORMATION.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFORMATION.PR.1	None	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OBRUJGFHLWTL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TRDTWMRSUZAV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TUJJPJIYTMNX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AZAYRJYXCXZR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BKGHDLNFOLGZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZNYKRMJOMGMD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RTJYHAXOEEDY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VQJENYWQLIKN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UHAFTVUQLBJQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FZACIPKYOZWJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KCDBCIAYUXWT` Canada (Central) `arn:aws:controltower:ca-central-1::control/OMCTIJOASMIZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IEBSHSUWVLNW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZYKOUZYVAXVL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RTHCFFNNCBIC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QVSBUPSGUHVS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SUZUXRSEELFT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XLSIRLRDKWVQ` Europe (London) `arn:aws:controltower:eu-west-2::control/CPQMWUWNTTQN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PXUHPQAIVTCU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XWTPZYNDKZAN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YKZGVTHBPBQF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RBUIYPEKFWAQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QZWDNTRQVJKO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE` US East (Ohio) `arn:aws:controltower:us-east-2::control/FMBVJTKQAEAE` US West (N. California) `arn:aws:controltower:us-west-1::control/KDYIRULEPEVX` US West (Oregon) `arn:aws:controltower:us-west-2::control/DKKMAWVORGDV`

CT.CLOUDFRONT.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.1	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.7 PCI DSS version 3.2.1 4.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZKNGGEQJFJEW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MKJZCQJTJTUU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XPNZKJLGPXQA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VBJDOHQSIIAX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KFBJHZDCITRT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JURDJLNESWGR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HATHJJWTNRTE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PHMWMCANHKSW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HGEUZPXSVDOS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TOOGKXNIZTGI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AZRIXJRPZEGB` Canada (Central) `arn:aws:controltower:ca-central-1::control/TQHOWLDDEHMD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZWIHYGTQCIQA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JSTHUABMXZDZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MYOOHWLVKUVG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MLFOFPIEQPDK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WUYNTGJJUKNP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UAUKDTHXFEXN` Europe (London) `arn:aws:controltower:eu-west-2::control/KRZLJNJUOPAE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ITCBSOQOBUDP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WWAUIVWORXWH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VQHIYFLOJLMC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RUGAOBODEZXQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XOWFTDERUYHD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XDNLXQXCMXXF` US East (Ohio) `arn:aws:controltower:us-east-2::control/IQSRCUCSGFPK` US West (N. California) `arn:aws:controltower:us-west-1::control/IWQIWQREBLHB` US West (Oregon) `arn:aws:controltower:us-west-2::control/AVEFYTUYGGCS`

CT.CLOUDFRONT.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.10	NIST 800-53 Rev 5 SC-7(11) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QOUFOYZMAHTP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RMFPWFTBHEUW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RFCFGQXJZARA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YBHTLDHKEKFZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HPIJWRRRNZWV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DPDNFOCWKPXR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NCQFJEHLNVOL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TJJCFOZERMMU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XSFJGHXKKXJQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RNEBJBKTWYNP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QLWFWMZSHUPD` Canada (Central) `arn:aws:controltower:ca-central-1::control/EMBBJBOEZUXI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DPTTYLBMYLES` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RIZVPUMYJKMF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KEBVYBUGDCJL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZSTTBVOTUCTJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UTNKPVFYDNWY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/COJLJAOYFIIY` Europe (London) `arn:aws:controltower:eu-west-2::control/EDDBQAMFSHML` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JSCPKFBPTUFX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KKJWKODDJAJZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NREUZZCXLORX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CRMMYILUZFQR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XHRXFSGXWPKZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MKKANNMZZHNU` US East (Ohio) `arn:aws:controltower:us-east-2::control/WCTTAHVMYDLS` US West (N. California) `arn:aws:controltower:us-west-1::control/GQNIWWFCXLMC` US West (Oregon) `arn:aws:controltower:us-west-2::control/IJBYZPYEBBPL`

CT.CLOUDFRONT.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.11	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 4.1	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HYEDNWKAQEGW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RKEOFHWPSMRG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HFHBNWIGHFMY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ICESDVDPQUJI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VZFSUGKCIKSL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LATRCFDQWVIN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MFLJBHYHDJZA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PWKKNYCLONTW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OLKKBIYGTTTV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EBMFFONQCPFD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CQEDLAWQDAEX` Canada (Central) `arn:aws:controltower:ca-central-1::control/ROXOJWPKIJGJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OOIGLWNRDLBR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PDSOEASQXLDH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OEQBOVEXMMKR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ACOALEKSQBVA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CAMAUZYMJOPH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IAUDCMRWXWEY` Europe (London) `arn:aws:controltower:eu-west-2::control/INVLKWIIXCUX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HAPUSNWOPEXI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FVQEUPCJHDGB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FTGLJNMLYHZT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MIPXRQLYILUE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RAYNZKHYBPAZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JKSWKPYLWXBN` US East (Ohio) `arn:aws:controltower:us-east-2::control/FRBHAAKLXVJQ` US West (N. California) `arn:aws:controltower:us-west-1::control/VDNOLOGKWONY` US West (Oregon) `arn:aws:controltower:us-west-2::control/YXRLGXTHKYTZ`

CT.CLOUDFRONT.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.2	NIST 800-53 Rev 5 SC-7(11) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JTUVGABKLAFE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JYTOHOYSNLMB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BMFRHKRDLPYE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IOOJYJOANCXR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HVMWXRCNFRDO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SDPQNYINEQRA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KPXXRYKIBWCP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JPIDQBIFWBWL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NMGEPJROACOH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SLGAANKAFEYA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HAXVFQCZVWMZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/RUMPJMCCNCJW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YIXCHURUJDBK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XKAFLKSMRCTZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AKXTQWFSQTVQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TOJRWDYHNNXG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HPURLNWRKJWL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SPJYDXWVBVHQ` Europe (London) `arn:aws:controltower:eu-west-2::control/TZHFMCSVNUQB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VTSPOJEHAKZN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ENWFNBADPKGV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FIYDPNSPFBYH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SEODAVXUYYKF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PGPGHMEKOYTP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WPBVZXCJPXBZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/MLHMBKFPSZQT` US West (N. California) `arn:aws:controltower:us-west-1::control/SBRPUJEJCGTL` US West (Oregon) `arn:aws:controltower:us-west-2::control/UIWBDZNONLUD`

CT.CLOUDFRONT.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.3	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EOVQXRLMTYED` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DDVLBNVHGDUB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TMYDUSKTAKBS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MKLFHIWIEWWR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YQYFXRCGOJVL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OCRRDMBCTTPP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NJQTYERBVBJI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JLXONOZWHECI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MCQETJVLFUOU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ISFZIBFIGEYE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TYWUXNEGBHGC` Canada (Central) `arn:aws:controltower:ca-central-1::control/YXRNFYZICBAZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OIWLNKZULIHF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LRZZVKQUSKFK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KFVEGDRDKNYI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HPKHJFQXJAEV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CVMBTUQQJQVF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AGJSNVMSVMZW` Europe (London) `arn:aws:controltower:eu-west-2::control/GZSHUDGCTKTD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YDQTLQWZBPXO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AFQUJTLNZOZD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HICXKNXMCXCZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SQZNZFSSBJQD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LJBMFILEKDJH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KSCPLCGJKGHW` US East (Ohio) `arn:aws:controltower:us-east-2::control/RFNNWXVMUBPQ` US West (N. California) `arn:aws:controltower:us-west-1::control/QSWVHIUPCHAN` US West (Oregon) `arn:aws:controltower:us-west-2::control/LHFZBEUHUBMH`

CT.CLOUDFRONT.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.4	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VXRYQOGVHSUW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WJKRCBQFHZMZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VOOZHGULFVBG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GFFYUYUVPDKU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DOTFJQVJFLRM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HPOIOKYDFMZE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WQIZCKKCSRXT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RADLRUNIIXJV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ELYJMXPJVKEI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IPCYTHQFAFNW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MVVSTRHVZWSC` Canada (Central) `arn:aws:controltower:ca-central-1::control/CXLHFJBBESPG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PPDPQYKYCVQV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OMEWBMVICXJG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KLXWEEBCGMDJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OEGLEOAAPISR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LEXJMWZMLIVI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WJKMTILNPQPE` Europe (London) `arn:aws:controltower:eu-west-2::control/LEHRPQBGFKSI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GWBOIBMAAVZC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LLUWIDQCLSLL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AGTDHGABOXNI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BSHPWYCFNNBE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LULEEVQWEQRC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TTGXTDSTFUVR` US East (Ohio) `arn:aws:controltower:us-east-2::control/BCDVICOTHADR` US West (N. California) `arn:aws:controltower:us-west-1::control/IUIGCLTOJBUC` US West (Oregon) `arn:aws:controltower:us-west-2::control/RFYXXYNURHWK`

CT.CLOUDFRONT.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.5	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HZEAIHLPXGDG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HGFGDWIJHIUM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EDSGIRTYZHTA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CGZWLZPDWIMX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NRRJRTUJBKRO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QDMUYVEFHYOR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JPFMNYTBXSIX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RHBUCASOCZAV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/COFQNFPVILDJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XRYUQXKTPXYZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BPRDZIZNWYBS` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZYDBRRMVVTZV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XZRMWOAQCCXL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DAAOJZCWCNLC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JNBLGPSROEFQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LHGULLYNLWNF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PTDUOCAXIHAE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RSSXGIZAPHTX` Europe (London) `arn:aws:controltower:eu-west-2::control/NWKZMIUZNFKT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CZAGHRZSABRN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IDPOYYEWDDAK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QDFYIJJARBVP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PBAOGWJQTIKW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RXASZFBDCWEX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RSBKBJHVWOCY` US East (Ohio) `arn:aws:controltower:us-east-2::control/EMCHZAZDZNVL` US West (N. California) `arn:aws:controltower:us-west-1::control/TBJTNHJFQFRV` US West (Oregon) `arn:aws:controltower:us-west-2::control/MAPJFIKMJJKD`

CT.CLOUDFRONT.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.6	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MEVRAVQYQCBD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LEONXWJLQTYM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YFRQGLAWSBZU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MCPECPGYYPPZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WBMVRQPRAOQX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SWGZZGILWLWS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EWCULHXPMCBD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TUIUKMPMAEUD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IYBPCXPFECFI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SAEWMKRDHMRO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BHNUHFPPNUTC` Canada (Central) `arn:aws:controltower:ca-central-1::control/LLIUTEJBMGHE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MAELDXBVMXCM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LTKLSWPOPLNR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LOAXFPPQRMCF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HYECMJHMDQAO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GKTDSYXJRURB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OBRSKEKWVRVB` Europe (London) `arn:aws:controltower:eu-west-2::control/NJKKCOAWJJJM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/APQPRHGKFWYO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RLNLTYXPMQNQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CGQNUYCOSGYR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QWHDDIDDVRIX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WMHKGFLJAWPI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QFQNQHNDSHBP` US East (Ohio) `arn:aws:controltower:us-east-2::control/LQDIOWJWUTSM` US West (N. California) `arn:aws:controltower:us-west-1::control/HYJHVPFFKHDY` US West (Oregon) `arn:aws:controltower:us-west-2::control/EOUIZKHISXPN`

CT.CLOUDFRONT.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.7	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 4.1	Encrypt data in transit Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OIQLPXBBDAEF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FOMSSEIEPEIR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PVAWACSEUZOC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KYIFISGDQAHH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UHYZMCZNNITK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BYQGXIDVQDFM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UPTABJLZLULD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XFODQONNCMNG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AQDUDHILVQNE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FEOXIQQBHYQN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XZFLLXIQYNUD` Canada (Central) `arn:aws:controltower:ca-central-1::control/EYUKXNOQHBVC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FLFNIUITMQCJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UETNVSJMZFSB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AMBUPGBVMSRB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LANXJNMROUBG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CUEQJGENOTAN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PJOCVKGBLJJL` Europe (London) `arn:aws:controltower:eu-west-2::control/HVCNXRUCMQUQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VKCENIKDHWLI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VQBHQOYFACWB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RANNJKPZMAWZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JDWMKBYCFRRZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TKNLPUTAFIBQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SFIAOWRGHFHB` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZQXCMIVMKIAA` US West (N. California) `arn:aws:controltower:us-west-1::control/XDXYMIJWXNMH` US West (Oregon) `arn:aws:controltower:us-west-2::control/SUXMGZJXERLV`

CT.CLOUDFRONT.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.8	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ROHXSITDLDWI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RTJQECKEXLQP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VSBTGOOGYBBH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DNSOBLSOWZBO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FFUABXMEWYYC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CFFXQUJBTGPR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DWTWKHVWMSMS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XKYWAPJWATKR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FWXCSWFYXMCI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UCOWSXPWKCCI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ADCTWWSZWZTS` Canada (Central) `arn:aws:controltower:ca-central-1::control/FZHDAFBJJMXP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VCVFZRIJCQUZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DCSIOMFMHOTM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HLXSOZZDWMJN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JLXINGWIDTUJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZVQCJXIKMXIC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CNNZUYODKIDH` Europe (London) `arn:aws:controltower:eu-west-2::control/YPHHSQJLYWOQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ONPPIEAALZUC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CYVPKLRVWMSA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JMUEZJBIBXOG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XBLMALRLBRNO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/APWMSFWSKMFJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YPZYCTALWZLK` US East (Ohio) `arn:aws:controltower:us-east-2::control/KQTKKFCMSTJR` US West (N. California) `arn:aws:controltower:us-west-1::control/WIVHPNTBEMAA` US West (Oregon) `arn:aws:controltower:us-west-2::control/DIFDZPKTUXZR`

CT.CLOUDFRONT.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDFRONT.PR.9	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 4.1	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UMSUKOODJGNE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KYETOGMXUJPF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GITAQKSEJDXV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PZBIGNJZQZWK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LFPEMXYIZGOG` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NBUGVULZANXD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HJIQHQJZMQZI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ORPMLBIMJEYI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MRNNWKOBUPWW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VFZMJZENUMGT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RBADPCHOYCIE` Canada (Central) `arn:aws:controltower:ca-central-1::control/OJPYIMZXKWMN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DVCICCSXHKOE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YMJHSAINUZQL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IZKULFXRTZNU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HYDVIHSHNUJK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MVBZHLFJEXGH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ADCFMZEXRPWH` Europe (London) `arn:aws:controltower:eu-west-2::control/BJDRLQQZJKZL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EUOWQLXWFGNQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LCDMMMAPSTOM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YTPDUMSIBEBO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MSBIHIZOYSWP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AHXYZHBAZBFH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XCQMSOOMOOKF` US East (Ohio) `arn:aws:controltower:us-east-2::control/HXXCDBIITXOE` US West (N. California) `arn:aws:controltower:us-west-1::control/HXNZJSDBYUQE` US West (Oregon) `arn:aws:controltower:us-west-2::control/DOQSQVALBFCM`

CT.CLOUDTRAIL.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDTRAIL.PR.1	CIS AWS Benchmark 1.4 3.7 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CAZMRVABVNVZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JLCBXYFLJKYT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VFEZPSFUCMNK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IYMKUWMIFVNY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XXBNGWACEEJO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YVIVTCSBKNZW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KFVUHHOBQFSH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LDWQNCXTIACQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MQTVMQFRAQQV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JQROQRCXWACD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RAAHJHHQSMWP` Canada (Central) `arn:aws:controltower:ca-central-1::control/LADQHOPWFDQE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QHBXOKOYNIQV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IWXMEFRDIIKX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FRHFJVRAPTRV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JHSHFWNLVDKX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YZFALBBJBHJW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GNPFAAZFPLUN` Europe (London) `arn:aws:controltower:eu-west-2::control/ZWQEGGDWHBMQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KDFZJGDKJDXF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LGMUXCEBWVNU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PHFHRPTBFXEU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VFHCZZBNLJYD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AZGUTSGKCXJA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EPNCREENAXLY` US East (Ohio) `arn:aws:controltower:us-east-2::control/CTXDBBKXWFYM` US West (N. California) `arn:aws:controltower:us-west-1::control/CJBDBOPJYMYK` US West (Oregon) `arn:aws:controltower:us-west-2::control/RBOKYZWNIEEH`

CT.CLOUDTRAIL.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDTRAIL.PR.2	CIS AWS Benchmark 1.4 3.2 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-7(1) NIST 800-53 Rev 5 SI-7(3) NIST 800-53 Rev 5 SI-7(7) PCI DSS version 3.2.1 10.5.5 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.2	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ARRMQAOWVILW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IEIDAMYBJTSE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PNBCQSCEGUYV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MXWILHEXRJPT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BQOOBSDUDOJY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XOLQDYEYNFBA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QFCAJQOMWRYU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VLNMMTWXFFIR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DTIKKBFJWTRD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VLSEDZSWLNNN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FSLGMXBTMEMG` Canada (Central) `arn:aws:controltower:ca-central-1::control/KAEEWMVGTQBG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RJSEMBTEORTH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XYVNASPEROZE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YAJIWBETKSKD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OBWFNAETCXTZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GDQDYHIWOYJV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZBAVTAQOIBMN` Europe (London) `arn:aws:controltower:eu-west-2::control/ZMDJHYXAERWW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QCMJJOGTGECG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JYFTEXMMRZCC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ORGHRUEAQHKT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DWLSTPHLZRRX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GDFPFDOIRPAG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZOBWKZJTOUFY` US East (Ohio) `arn:aws:controltower:us-east-2::control/XFIDQGGGOMTT` US West (N. California) `arn:aws:controltower:us-west-1::control/KFQRNLMNZDUB` US West (Oregon) `arn:aws:controltower:us-west-2::control/SPIMIJLBSCTG`

CT.CLOUDTRAIL.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDTRAIL.PR.3	CIS AWS Benchmark 1.4 3.4 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 AU-7(1) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-4(5) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RHLOQRXGMGBQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BCJQMHEYTIGX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GUMXCBJWOVUY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QUBSRGSNRUTO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NDEJIGGFJKIR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AFDQMHYCXZPG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YCGKIQTAMTUJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ENOFMWZNYKBC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AKRKBPXLHCRO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RIRMCQIOIAWT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KWEXXNTLEAVB` Canada (Central) `arn:aws:controltower:ca-central-1::control/GKZHBZWQTGXQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DGZZTHPBWAJX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ALHFFPPGDKFH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MFOJTUROQZPI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HDBBNLSSWFJN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GCVIUCRKRZJR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BEFMOHIMGMYG` Europe (London) `arn:aws:controltower:eu-west-2::control/EMTYLMYRYEDC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BBEODOCLACOK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KGZPEYILUFXN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CFMFGTPDDQMP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BPYRAXQYLBFP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HXNJHOVBCEQW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DZJUTMXLWLMF` US East (Ohio) `arn:aws:controltower:us-east-2::control/NKNKEKYMHFHH` US West (N. California) `arn:aws:controltower:us-west-1::control/TZTITSLDPMHU` US West (Oregon) `arn:aws:controltower:us-west-2::control/XAFEOVTQSTJA`

CT.CLOUDTRAIL.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDTRAIL.PR.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HLHWSRJCEYDM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CFOQQBAUVZYH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DJVAKGGZOBGG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RFBRGAFCHGRH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PRBKENAXOJXR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UQXTLQQUVMRO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AWBLELLPBPBZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NCGCPHKAILMF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CTOCGYRSDLYB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GBLIBFBFWEWJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FDRWVVLULZAD` Canada (Central) `arn:aws:controltower:ca-central-1::control/QDLDUFIKRTAF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WGWYSUAMMWWN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YRWHYIEUGKWK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GUOVVFIECKHB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CQIIWIZRIDXD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EQJLPBKNWCEW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BIDXZLOVTAPH` Europe (London) `arn:aws:controltower:eu-west-2::control/YRILAMGJGTFS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HDTLDOKSVHCS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KVTMFVMCHBSK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YDPEPIRVMRSF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UQUAZOGJVRPA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NOFOPVIFERIB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AUDOYQMVIFSG` US East (Ohio) `arn:aws:controltower:us-east-2::control/OOPJJACQOFUS` US West (N. California) `arn:aws:controltower:us-west-1::control/ARZVFSOFFRNH` US West (Oregon) `arn:aws:controltower:us-west-2::control/MIAFWDCLTQFG`

CT.CLOUDWATCH.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDWATCH.PR.1	NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 IR-4(1) NIST 800-53 Rev 5 IR-4(5) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-4(12) NIST 800-53 Rev 5 SI-4(5)	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NSZIACKXCZWU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JASXXRCJAGRM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DZZBWHYOVWZH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JWZXOWQPDALC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XFTUWPJDDHWR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VZQEAYLRUVEW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XSCOQUSBVAKH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EFYIPKXIMWCM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MOWBJMXOIHSB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EHGRDSWJBZRD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FCCVJPUNPVXQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/VQRWIUPQXDNG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OBZIVWNWNIFK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IGPKWKCRTQSA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SFQHEJLEUAUE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FQUBDDOCHVXV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IYZCFYKTLOEZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YPSCUERHMDGL` Europe (London) `arn:aws:controltower:eu-west-2::control/EDZSIQLZSHQT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GVINKYTHSTYG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UNHKBRUEDJVG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CNMHXHONGEWR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AMVXVAUISMIH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YKLBLDSNIPAT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SSXFCVHAAYDY` US East (Ohio) `arn:aws:controltower:us-east-2::control/RAMYQIPCOQPV` US West (N. California) `arn:aws:controltower:us-west-1::control/YSCEYMWJPDXX` US West (Oregon) `arn:aws:controltower:us-west-2::control/TKCJNPHIDFHI`

CT.CLOUDWATCH.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDWATCH.PR.2	NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-11 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MDSOCYVCVKCT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FBRQUVHBOZPB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SBTRQDFYDCOK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TYKALNIDLUXK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UZOKBNYSYIZW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JPDUOXRODBEG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UEJEPFFSZUBW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QUYKUYVNWSZV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HEBNGALBPYXJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VNUHTQRCTWLU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JLVKWJATWUTV` Canada (Central) `arn:aws:controltower:ca-central-1::control/VPXBCTGURFRG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/URQEHVTSKLLB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DAUDMKIGRGOZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DSVHTVHFNRSE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OZCLFSHTISCQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DPZXYQALXSBJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TBWHZGGFAGCX` Europe (London) `arn:aws:controltower:eu-west-2::control/DNHPGCXFAJST` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QCSZCQYGUUVZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EFOQUCOHCADL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PLDXKXQWHHCV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VEWMILFDETBA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ACYWMNWHXDKN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HTUKCDNXPVWK` US East (Ohio) `arn:aws:controltower:us-east-2::control/KZLHFSHUXRWF` US West (N. California) `arn:aws:controltower:us-west-1::control/ZWPLHRTNEWRN` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZOBNLPQHKPDK`

CT.CLOUDWATCH.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDWATCH.PR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OLDFVUGRRHUK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QAJHRGEGPDMX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WYEDDRSFQTDY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CWBBUWULYLOW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AZANGKXVSQGH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OTGQBKNMWNKV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DEJFOZEGERQP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AHEQLQIVIOWD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YHKYBCWCRLJJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TGZQHFRKWOCF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RFQBNRCCEIKA` Canada (Central) `arn:aws:controltower:ca-central-1::control/RZUDTGNQSLRG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GSZUCKWWMLZM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TMUERIGFSBVJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VZXNAZZKVVEJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ORYXUPSLDOOT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SYOYMUBLETAN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GVVBWCAAOCTC` Europe (London) `arn:aws:controltower:eu-west-2::control/ZSQDFIHSSAOD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WQCLCWXDFYLS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GMIMEPVNIBZZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JBRCQFIIYNSH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ELINFWHYRXRZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CYXHPOXPXBWZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZHZBTTZMZYST` US East (Ohio) `arn:aws:controltower:us-east-2::control/UEXYNAIAHTWI` US West (N. California) `arn:aws:controltower:us-west-1::control/CZEVEPANZGQK` US West (Oregon) `arn:aws:controltower:us-west-2::control/RVGRWIMSJKPB`

CT.CLOUDWATCH.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CLOUDWATCH.PR.4	NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-4(12)	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EKMHYJGVZCHG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TIHAFDHKOGZJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AEHEUFZDKJQD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CFAQBJOYCLFH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YHLIYCNCGUAA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IHHAKHDRLOGU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TRQTFJOZZEOF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ISMLVCTXZGYF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CLDCBWOSIAUL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VKHCXDMGUOOK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HYRUNFPDZNHR` Canada (Central) `arn:aws:controltower:ca-central-1::control/IOQUGWNHEDSO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OOGEPDLGDWEM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UHOAJRVIPLHA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FKOIMKGDPJBQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JULHFFNMMHXU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SBRKWJRBLSDV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/APPYZPTNBLGO` Europe (London) `arn:aws:controltower:eu-west-2::control/XRRBPVFHMAFT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HPAIEIOARUEQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OGCHPVUOWVJB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NNVSJITSDKOJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YCKCTTEXWPSW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VCHSALJJXEQI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UUBJSMHHQBTE` US East (Ohio) `arn:aws:controltower:us-east-2::control/XFOXFWKOUFVI` US West (N. California) `arn:aws:controltower:us-west-1::control/UQPZKKDGYZCH` US West (Oregon) `arn:aws:controltower:us-west-2::control/LLRWYTMFYUFL`

CT.CODEBUILD.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CODEBUILD.PR.1	NIST 800-53 Rev 5 SA-3 PCI DSS version 3.2.1 6.4.4 PCI DSS version 3.2.1 8.2.1	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WVYQZRGTLWHG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EJMERDNUJBQJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EUUKRLJQRWDI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XWOSMSCORYXY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QVLWIFOPPDEP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PMZEKQNVBRKZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BGONJAEQQODC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RDSUWXNODESZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SCDVMCSBZZBP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LBGGSSRBSGUS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LXVUSLOKWAYD` Canada (Central) `arn:aws:controltower:ca-central-1::control/RSYHHWKEXHCO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OZCLPKRVOVHV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JPCHEZJSIYJY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LAPQRZRTCBBL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MKNRUEOIFDIO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TLIZGYOSLXID` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NCDYZQYYXIMF` Europe (London) `arn:aws:controltower:eu-west-2::control/CZYKFOXDXOAE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LFQQPETWUEWP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ODCFYBUSVHPI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YSLFINUPIWAR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/POTJCWBCWTKI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PMRWCRVSHCSO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JIMFDEAQDWCK` US East (Ohio) `arn:aws:controltower:us-east-2::control/XMPGGVRADHWF` US West (N. California) `arn:aws:controltower:us-west-1::control/EHWDQPAGOQVY` US West (Oregon) `arn:aws:controltower:us-west-2::control/DWTOSZTSQXGA`

CT.CODEBUILD.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CODEBUILD.PR.2	NIST 800-53 Rev 5 IA-5(7) NIST 800-53 Rev 5 SA-3 PCI DSS version 3.2.1 8.2.1	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GCSGHXXWTIVO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VYDLJEUYORHK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DCWLYNEJULNR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EOOPASTMJSET` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YPIAEPNIJNQG` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MVSGVYHINMLZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZQLUVNOAMURG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FTDDOMZPCICH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CDUPZGSWHYDK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JTEUUIMXIUPM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TYKATGNYMSLJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/SCRYBKUZHBYQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DDVQLINSURBW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QGKVBMJEDJEW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NACQKIAXFRVP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JEUDKXERRMYB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WZHIVERTKNMT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WEYMGAQEESOZ` Europe (London) `arn:aws:controltower:eu-west-2::control/QZKDWOTRWSLC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FHZHYYESCQDF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MBMBIGGAVEJN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BXMYBACIZYGC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BNEGCEZBVNSJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SIANVCWRXGWJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EJNHNFZRAMFG` US East (Ohio) `arn:aws:controltower:us-east-2::control/QFRBXZNMGMLD` US West (N. California) `arn:aws:controltower:us-west-1::control/WTHWLRJZZOOW` US West (Oregon) `arn:aws:controltower:us-west-2::control/WWHTDFQNALJW`

CT.CODEBUILD.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CODEBUILD.PR.3	NIST 800-53 Rev 5 AC-2(12) NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DMZLXFFHATNX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KOZNXUGUJOXA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YFGOVOOKMXZQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BYCXOWCVCFOP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MRUGSCUAOCAC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OWJXWKPQUCWT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KEFQCWMQBGJR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VBDUMCPMLQTK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QYCIHTAXYLTZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WKTXNANZYYLB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JEZZFRMLKWFS` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZNXNBMZCHFPQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UTFBCSBSISVW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CMIJYJCFEKWD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BGMCKUYVIAXA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AQXBHQXXZESG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DGQLWMRIBAOA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EBCCRSBQVOEK` Europe (London) `arn:aws:controltower:eu-west-2::control/LTEOHIIZTPFH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QNQUMYVIDFEX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GIFAWZCWRHNS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CKDSLYLCJQRL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VUBGTNAZWXKR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KQRSGHFYHVUK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YEHYWYAUIQHZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/UCDPZLBJEGBZ` US West (N. California) `arn:aws:controltower:us-west-1::control/VEHXVCDHACPS` US West (Oregon) `arn:aws:controltower:us-west-2::control/MJRSPBWBBIWW`

CT.CODEBUILD.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CODEBUILD.PR.5	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EWFVDYKGEDQM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XOOYSBYTMVEE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QMYRAUAAQSPG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JIRHXXYRRCPU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BILMNUNVKGQU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZUBAPDKBHPEE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ETTGKYPZHDWE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BRCVOCSEPXIQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YKADOBILMOXE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IIQOEVFKXQUA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RWIXRMHPKSME` Canada (Central) `arn:aws:controltower:ca-central-1::control/KJEOAYEPVAWT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FPCUVSCXOALO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PVMESLBTIORK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KSTOQHLUUMAB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XIPONLRXVTLM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EZEDZUYHEOZT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HSYKYLVTHMSC` Europe (London) `arn:aws:controltower:eu-west-2::control/WLFHTAHNSJRK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CUBUEWNCWWLE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RFRJCMVGRGLK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IKWSXRBWZGLC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YZAEAAYHVZTZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EOQMRPVCYIVQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OJSTETVYFKHE` US East (Ohio) `arn:aws:controltower:us-east-2::control/XELBXZJFBGYK` US West (N. California) `arn:aws:controltower:us-west-1::control/GMPADQDKOOSS` US West (Oregon) `arn:aws:controltower:us-west-2::control/NTHPULVMAKSY`

CT.CODEBUILD.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.CODEBUILD.PR.6	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LXQDTRHEMKEN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DQVTQLQFTTBT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RXRLKZGUXBFQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MFNMFPARKBBF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BJZEVENBVKMT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XFEBDNHXUVOK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SRRAJIIMEVGE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LJAFCKIMTDGT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BKDGPCXEHUYM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RCUQGUPBRITK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BBRKFCWFUGLH` Canada (Central) `arn:aws:controltower:ca-central-1::control/LWZACZNXEWFR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LJXNLOULCHOC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SDLNCTLECQXF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NKXXSZNQJNAG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LKLEVOQIMCUV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NKSJVWJEWECR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RRRKAZCWMWYC` Europe (London) `arn:aws:controltower:eu-west-2::control/TUDOZOFBNLBJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YLCNQJWSXLBS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AGOYHKVDQPPM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MCFLNKWOTMGG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PKBWTCMWQOAH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UFNUWPKHJXLL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WEEZOKNMKWFK` US East (Ohio) `arn:aws:controltower:us-east-2::control/ARXGHZDJMVEV` US West (N. California) `arn:aws:controltower:us-west-1::control/AWLHICDELWPN` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZYXLXAIYZXWK`

CT.DAX.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DAX.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RKQETEUGOLZT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YERSBEZNALIC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YJPSKRTFOVNI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GKKAWAPRNSLP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AVRDIKUBVIEL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IPCTFYGTPJQK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HDSPSOQHQADH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QWQALHIYPODD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WQDLGHQPLUEZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MAULWZOVBHAG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RYLGGCGVEELG` Canada (Central) `arn:aws:controltower:ca-central-1::control/NBKPOCFUAYKO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/USAYUGMVGVCZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WERBGVNLRWCP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QRIOKXQBWHTR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AHWDGTQANTPZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XTNHYZREDREV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HPQCLFNNHNVS` Europe (London) `arn:aws:controltower:eu-west-2::control/YQFMNRBYQZUH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PBMMRKGQLQSP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MEQGYHFODNJQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DNVHZNVNIVFL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TJAYEVJIIWMC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XUCCOZBWAWDU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EMIZNBUBWZST` US East (Ohio) `arn:aws:controltower:us-east-2::control/PWENJMKYDFLI` US West (N. California) `arn:aws:controltower:us-west-1::control/OQJDQHXHVHYQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/LIDITLCMTBXF`

CT.DAX.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DAX.PR.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve resiliency Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SILHLNRKXURR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GPIACDHSJUVO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KCZJTMRTLPZH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MCGGZQJDQSEG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HGXHJVIRQSTJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KIADSEVTATNK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RDUKUALNEVNU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LSYCOPMQSAQK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YLPPVNACLIDZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SDXGBJAMZIPN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DNCWSEOZINHL` Canada (Central) `arn:aws:controltower:ca-central-1::control/JUNTGFKWFFJA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WYPOTMKGGRTF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SGSXAYLHNUSK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LKWSOIJNZRRT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UNTRGVLZHGWC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RQKTASYXHVYU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GTNFGAXVMTIY` Europe (London) `arn:aws:controltower:eu-west-2::control/UDVRXZWEHJLQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RDIXQORVUYTX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GHAECZAUNGWM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RYEAAPJMVRTI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QVZKAJFUMHFI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WKKCRCZYVOYA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SBKTBSUWMKEK` US East (Ohio) `arn:aws:controltower:us-east-2::control/XOLXWDXOTSDS` US West (N. California) `arn:aws:controltower:us-west-1::control/HCQNVBKSJPXK` US West (Oregon) `arn:aws:controltower:us-west-2::control/BXXBFHSEQZVC`

CT.DAX.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DAX.PR.3	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PWUHXPBZIORO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OWWBUIFRTHWC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KANMRMPWOUQV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QSNXKOZMYMFR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BBMUTVSRZXPV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ACWSAQRXMAPJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BEFHHEFAMIGJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VNHVFUCLAKSX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JCLDTMNDGRTR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BHRDSDRZCZYS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XTHSONULVJIP` Canada (Central) `arn:aws:controltower:ca-central-1::control/BYNSAWVHNTAJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XRLXMRYIIGWI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OOLZDMSTRWYG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DBOHJEJMYNWG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EXACLWANURZW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CJQFLUNIGRDW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZDNATWERTBBL` Europe (London) `arn:aws:controltower:eu-west-2::control/NUXYWFVUJBLH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VXDLDZAZJHUP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YWBDCWQRVAPI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UYJFPVBTWOWY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EKWOVFGGQRQF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HVXEDWNTFVJA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JSRQEOOLHCHQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/OUEBONYIBDEN` US West (N. California) `arn:aws:controltower:us-west-1::control/EFBZVLOIFTYY` US West (Oregon) `arn:aws:controltower:us-west-2::control/KJQULRXQPSVI`

CT.DMS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DMS.PR.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UNWEFSWWLQTO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QAPCPDZHYEBF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CTFMRJPUPGCC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PMXDPOCYQXVY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CPGOCDMDHGFI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UICXSEVCABSW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EUCLHHUYDEEC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FVTCTPBWHDTL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZERDIGHMXMHK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CXVEOOHIMNNL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ROMIMQWYAGFD` Canada (Central) `arn:aws:controltower:ca-central-1::control/XXXIGZQSIPVK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OMLKCPQPSJTR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UMVTLBCRRGKV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LEXIGWTCMJSA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OPSWXXYSYUMY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TGGYQCVRRDMF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YCHPEYBHXVBF` Europe (London) `arn:aws:controltower:eu-west-2::control/WGOOQPQGGTCC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EOSDYNKIGAWA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HZSULTIXLIGQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LTSKNULFPUTG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZWSGRHYTXZSN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XOKBSYBQKJOK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TZMIGTNDHQVL` US East (Ohio) `arn:aws:controltower:us-east-2::control/VSDWQVWSEVHU` US West (N. California) `arn:aws:controltower:us-west-1::control/TSMFXMFCPLVU` US West (Oregon) `arn:aws:controltower:us-west-2::control/TEUGLLCMRFBE`

CT.DMS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DMS.PR.2	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FESPIXJAOULK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GLHMEPNCYUSQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SQLHUPEXUOKU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WKNUSICBMQOV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WDEREYMNSGMU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TCEDVKZNCHKW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YRGKYVHVRBSL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WSXHLSUCKDGH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CHWMZWDERDLU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ENVXMQEWHFBX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YFAHKVXXOCSX` Canada (Central) `arn:aws:controltower:ca-central-1::control/QOJPATDAWFRO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JNVVNWEUIOGW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UJGYUMGMJBEY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YAKMSVKKUHUU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZXTHNNMVRRGT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XGZXZOCUAKPP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LUJEQBWKCVDA` Europe (London) `arn:aws:controltower:eu-west-2::control/APLZCDFPGPZO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UFYAUPRMCMWX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NPTLETTIZUMD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WOTREEFQIYYS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OJGKHKSODWGV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CRIBTOSVESOT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ORQVPINRLMOY` US East (Ohio) `arn:aws:controltower:us-east-2::control/RAJOOXRIMDFG` US West (N. California) `arn:aws:controltower:us-west-1::control/CKDDWAKTYAFR` US West (Oregon) `arn:aws:controltower:us-west-2::control/AZMPQPEABVJQ`

CT.DOCUMENTDB.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DOCUMENTDB.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AIQLWAENCEVZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NDCSWMCFZFWK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EONQZXNXGAPB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TEZXETAGKYOT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FIHFPXXSWPVR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NJTDQSHRSPIM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ECVIEFMUQJMZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XUVXIHBPXAAM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LVZGOWHNFFQQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BMNUBLZWWWWA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KNYFLVIZOIAZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/CUUSQEVMNYIR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XOBYNMAVPBFP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UFMCCFRSISYY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CMAILYDYAUOY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DTKBFEIQNVQL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AIUTNQWKGFDR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UWYKAUHSRUKZ` Europe (London) `arn:aws:controltower:eu-west-2::control/CFNPIFZENDEO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ACFERMCUQLYD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZKHDGAAGCYFF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BBACQBVBHSDC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GVXHDHLTISRP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NSSWQWRWJNFM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/THVIKWXJQCEB` US East (Ohio) `arn:aws:controltower:us-east-2::control/AGSEOYNXOSRK` US West (N. California) `arn:aws:controltower:us-west-1::control/TRACDDWLKDRI` US West (Oregon) `arn:aws:controltower:us-west-2::control/HXVOHNCIJRUC`

CT.DOCUMENTDB.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DOCUMENTDB.PR.2	NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XDBAEAOQGFZQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HTINNLWMXRAD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UIXMPMAVSMSO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CMOMYYELJWTW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TYKSQTKVDRPU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XDKECWMGYWQS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WAJSGCIJCGCH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UIHMUQNGECFF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YDRKNNEUEWMB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NTKVAPLDGPIE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KWPVVWPRUBZO` Canada (Central) `arn:aws:controltower:ca-central-1::control/NURHQPDKMITF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NDOASXOMEPNB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YMMXEICWPZQC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UATWYHSUXSUY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AFQCMISIBNZC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NOKRKREQWEPP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DVXWRDHUPOPR` Europe (London) `arn:aws:controltower:eu-west-2::control/HBAHNXQKSECW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JXPLMTUAETRJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TLEHFGYBIPPV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZBVKSKSCLRSO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LBGOTUKVIBIY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GCAWCOVVHNPC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ARZAKWMXVIVC` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZIBRJZXDXMYK` US West (N. California) `arn:aws:controltower:us-west-1::control/VTWYHTWZJXDS` US West (Oregon) `arn:aws:controltower:us-west-2::control/XIHJTNHDRQAF`

CT.DYNAMODB.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DYNAMODB.PR.1	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XHWTLSZDRHZD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IGOUAMZMJLPQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YLNVMSVQPPOW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SICGAIHKEQSW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CRICQPHNTAAY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RMGEYQOKBYAT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CUNOZJCLCDXS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BQIMDWJDEKLB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HYEXGEAODQCG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XAWHUFNRUUXO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HOSCJVRPLNZP` Canada (Central) `arn:aws:controltower:ca-central-1::control/MUUOXHEGOERO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PUHTGIFRKSNJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DMUBHZWCMKBV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CYGILLICLUBJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CXPURYMVYMSC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EFNQESSMTRWA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EZQDFKIPCMHL` Europe (London) `arn:aws:controltower:eu-west-2::control/NWUTQTYYDZBH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZZZATCBZSQZS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IKNHTZWYSGUQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UPBXICUCGOPG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZRREDRAAHQUB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OWRFVRAEHORK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OIZVLCBZARKX` US East (Ohio) `arn:aws:controltower:us-east-2::control/MMOPKUVAJYZD` US West (N. California) `arn:aws:controltower:us-west-1::control/AOEAJRZQUOJU` US West (Oregon) `arn:aws:controltower:us-west-2::control/FEOCXMTUXONR`

CT.DYNAMODB.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.DYNAMODB.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FWOEVCMMZRIE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PRMTFXGWHHGM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CREBIEGAAVZS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PGHDRCMDDFER` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QFZXLJQCUPTB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WZFVBOYAOMIH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MOYLIDKDFBHL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VATDYITSDFZT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MXJNGHQYSQWT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PCYSWLZHMHPW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NCULPYCWMENB` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZXANARWCPQNW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CBZJAPZHXFDX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TRYHWAUMSGSM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IADWVKAFGXUW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GCGXGJULMUJR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GFIJUMQYZYKT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VNDWOJRWDJIZ` Europe (London) `arn:aws:controltower:eu-west-2::control/RIBSFVFNWIAR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QVMDXANQFBCA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SWUAFOBXQZSO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MPZSKTTPNYTV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PBRYEFBWDTNV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LZFDTLNKOQXX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AVPWTCQJVZFL` US East (Ohio) `arn:aws:controltower:us-east-2::control/GLNZIQOIDTES` US West (N. California) `arn:aws:controltower:us-west-1::control/HMMSCANOFBEX` US West (Oregon) `arn:aws:controltower:us-west-2::control/RIOHZBTKOBKP`

CT.EC2.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.2.1	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RDGRKFSEPUCK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PNKPPQYMTJFF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YSQCFBUOTEPD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PRPQIPYUCLFE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RDUEMSJPXBWR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OZFCKKRKZSIB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MTSLSKQKPIFR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UKDFSIYPXFVJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IZBFOJRZKBEV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PWXEQPXBWGJT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SPYIFBBRIAND` Canada (Central) `arn:aws:controltower:ca-central-1::control/HHAFBCZLQYXY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ADABIOVNNTMS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IMRVGYYQJLLW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UTXKBQQERGVI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WLUUDFWBDJHU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VNHGWWCSJWRA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GFKNBAOPNHXF` Europe (London) `arn:aws:controltower:eu-west-2::control/WYVSVHJYIHAD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YAIRLGKSVPZS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FUBCSHOJVEMA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FEMJIFSFEJOI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EGMHACFCYINC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IJAIPRTDFHRB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NOTMRPTQNRAA` US East (Ohio) `arn:aws:controltower:us-east-2::control/SMAKVTVJEPXO` US West (N. California) `arn:aws:controltower:us-west-1::control/QEIYONGZGVCI` US West (Oregon) `arn:aws:controltower:us-west-2::control/HAYOFUSRHZIZ`

CT.EC2.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.10	None	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZBXPGHGLMWXH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HISQJLSEBWSD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PRVLLJPYMYPC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GNMPIMBYNYKE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GBITMJKPAKCE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IUSDZWVDETIR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TWBJIMNVQOYC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XXRXMNFPAIIR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PBNLHCFGRZZO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GNBOOTBHJQVG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LYBOKWDBULNW` Canada (Central) `arn:aws:controltower:ca-central-1::control/RTCRBMNLMGBL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HPOMPECAFIAJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EEVRMJQGHIFB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LAUHKWTATLXY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DNLPNFANEMRU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DCORPIATUVCG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DBKJHDJXKWNY` Europe (London) `arn:aws:controltower:eu-west-2::control/CTADRPGOQIHX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YJMLRILGRBSE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TJMFQWKSYRGJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XCQTHTUPGSIF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KDLJUDSYZQNF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VYTXCSGZXJJA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VAWEVAFBTTYX` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZXUWTNZZOQUI` US West (N. California) `arn:aws:controltower:us-west-1::control/YCLJPFTXKZYU` US West (Oregon) `arn:aws:controltower:us-west-2::control/MPIXENDLDJMR`

CT.EC2.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.11	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JCITPFCDZUQI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GROFHQWVWGNJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ENUFAUVEZVFI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WOPJHTRSHEFP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VSDSWNNKPRRO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IRKWHFEJOBYB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TCPUTKECULUH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GAEZXFNKITWD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HNTCZVIEEJOI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CRATTPOFXYCU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IZALUCPZOAYN` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZBWKQBJUYPUA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PDKCUGSWCJWF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RTMWZJPFHFER` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TXQCCBSQPFNB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RTEWMJEUHLJQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SUUBDBBVLXLQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RAMFRLQUWVMN` Europe (London) `arn:aws:controltower:eu-west-2::control/XRFWIPMMYBWF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AZQORBOHZJMI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PDCSLUSATDKY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WQCLEHZIZEEQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QXBAGIPQXETT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BCNLWTEEHTHE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/USZSBVLKBFJW` US East (Ohio) `arn:aws:controltower:us-east-2::control/GAJQJEHKYENL` US West (N. California) `arn:aws:controltower:us-west-1::control/TLXGBVBTJUVZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/NMURDTFOJDZH`

CT.EC2.PR.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.12	NIST 800-53 Rev 5 AC-4(21) PCI DSS version 3.2.1 2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ERDLIQVQFJJU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LSZFXIAPRTNL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YBIIKCGWAORD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HFYUZFTNQRZG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DRLFKVUWERWU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VEHFJHVKJNRG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HLEAKIWSBDXQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/INYDINMLKHFD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DRPWGXJHMIQA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UQOCEESBNNIF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UBPYTWKIMQOK` Canada (Central) `arn:aws:controltower:ca-central-1::control/HJKXVHTKUFCB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EBSIWJJPVVBW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VPOJZQAASXUU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SIJDBTELNSUI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EPDEAPQFUAPZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CNCXWXERYCOC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SDYXHOVWBMMM` Europe (London) `arn:aws:controltower:eu-west-2::control/JWYSLVOEAOJJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JCOYUSUWIRJX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TGQZBFRIVBZD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NCITYDSETUMX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PTDARPFBEGAD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UDKUYKZVSBVJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QNDKUCEIGRNB` US East (Ohio) `arn:aws:controltower:us-east-2::control/IFRKPJEDMUUU` US West (N. California) `arn:aws:controltower:us-west-1::control/WJSMEAZXXXVG` US West (Oregon) `arn:aws:controltower:us-west-2::control/VHEHBTESLGUN`

CT.EC2.PR.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.13	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QQXKJMHCUFTX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DTDHLEWFGSKV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OHYRLAGKXSXR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OACEJPSHEDTT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZBKKUULMNWGL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SSCKAJIEWDZO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LXNQLJAJNVLT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QZMARZRDZENJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OSVHEFPIYSYR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JYEUKJNOFJQT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YXZJOTGZJJVL` Canada (Central) `arn:aws:controltower:ca-central-1::control/MTUNNERTAWUK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MYCUMPVJEXFZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OOEZRXCQHBCZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ARMDLUGJAMIC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AYFZQOECAPEH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SZRCWAQMISFS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QCBNFLLWHORL` Europe (London) `arn:aws:controltower:eu-west-2::control/ZJDKEANFYUMV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BWHESSZGTPFW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YCZVKPCTQOOV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EWZWWABCTOCS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YOPBAHVWMVOA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HLGYBXIMQRHU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FZSUCEEYAPWI` US East (Ohio) `arn:aws:controltower:us-east-2::control/ANUKCTRRCCFE` US West (N. California) `arn:aws:controltower:us-west-1::control/BTLZSJIHIZWG` US West (Oregon) `arn:aws:controltower:us-west-2::control/BWUUBNNIBGXB`

CT.EC2.PR.14

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.14	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PPWMLTWEAVHD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YGASEHTTCVJZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LUUPJIKOPJWO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WCOMSKMDNAFG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IZAZFFYMGZOS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TUQFRYIKJBAM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NAGYSJVVWTDS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GIIXBVQAQTNT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GRIQSOWFTUZO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VMKDWYCKPKRH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PTTAGSYATZTH` Canada (Central) `arn:aws:controltower:ca-central-1::control/CGSRRXAEKBDN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RIERQJRBKCVS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JYGVQKJQFJNI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KFIXEWHUEYPE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IALXTISTUWWM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PWARGJRTRQXD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VBAWHSPRVFFO` Europe (London) `arn:aws:controltower:eu-west-2::control/TBTEUVAWFLJG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QTNFAUGUTMHB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DNVFRNRLGAAP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NYIKBWEVXMCD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TKROLDYAXJKI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CCWGUWXJARQL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MQKNFAXJGETK` US East (Ohio) `arn:aws:controltower:us-east-2::control/VMCVOKHAOFHC` US West (N. California) `arn:aws:controltower:us-west-1::control/PHUZHFOQIHAY` US West (Oregon) `arn:aws:controltower:us-west-2::control/AGCVMUHOLSMD`

CT.EC2.PR.15

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.15	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.2	Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TLUQUBLLKEWN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QSCQVDJHEKMV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TJOEOWKONPTN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CKNBWALGPVDU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VWBDQCRJGCBV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WCLNDTLLGBLC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AFZIXCJHXMFE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MLGHLUDGFFBA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HEEZTXAQNUXR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ORVERZAWCKRO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YCGPCZCVFQBM` Canada (Central) `arn:aws:controltower:ca-central-1::control/VLNRASMMQCCT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZAOAPDYMTBOO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RRIIDIUCCWTB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JSDWJRIKGIEJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DXGDLUEZMICZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NHDZBTZUXELQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OGJDLYTMEUMV` Europe (London) `arn:aws:controltower:eu-west-2::control/WVELBOWUFUVU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UUXDVLGSYKWG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KKCNYSTPSDTM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RUBZGVHDFFLT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MAOAWNIEEAXD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HNROLGCXXXVS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EKBEHJFEWPMC` US East (Ohio) `arn:aws:controltower:us-east-2::control/LOEXLMDALOIF` US West (N. California) `arn:aws:controltower:us-west-1::control/VXSHNZFMMSKV` US West (Oregon) `arn:aws:controltower:us-west-2::control/NIVMCMYSFNKG`

CT.EC2.PR.16

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.16	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.2	Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WZVBVFGPTFYF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GUVGIHUKHMJX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KUMQJAZMVWLE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CWVHKPAVXZHH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RPJHCTJTENST` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YAAAYGTOXOOU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ATWNDZAYESGZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NCYJQJARMYXT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EWRFIOLHHUOD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GTHXKJHCJEJJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GHHWSDLFCIMB` Canada (Central) `arn:aws:controltower:ca-central-1::control/MXJEIQXYMIFJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PHNEHTTRJBIV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IRLXLBMFAIST` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WAKWHQKMGGOF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KASYNBCCNYUL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UHZJAZABJYWG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PGCWQUDCXAJG` Europe (London) `arn:aws:controltower:eu-west-2::control/MIPGTOZISOWW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BIJJDUJCHVWQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BYDZQXJUXHWB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EFBBAJPKWZRQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BJDVDDJKGDCQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UJBYDUSDWDCL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MALASTZISXPG` US East (Ohio) `arn:aws:controltower:us-east-2::control/YPFNZAUCHUGK` US West (N. California) `arn:aws:controltower:us-west-1::control/GTBKAFMVAFYA` US West (Oregon) `arn:aws:controltower:us-west-2::control/LVYDZONSHIBC`

CT.EC2.PR.17

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.17	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.2	Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZUUYMACFMBYV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SSGQVSULIUCO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YNGFYRMLIHYY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TWGQUMHBQPEQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LAAWESZWTFBN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VSOAGVUGDSFC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YVOTFUWYGJCL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HRLZOUHQKYBC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SAIQVZXZKNBG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VYPANYUFOFAQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HSVUAIMCVFGU` Canada (Central) `arn:aws:controltower:ca-central-1::control/DWQPXWTEDTUY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WYEFRJHTHWVV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JVSSYWHLGQNZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FYSQOJHWVNSR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WAZWRSTLDPDP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NEFCDEMGSOWZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ETEVULKQLPUO` Europe (London) `arn:aws:controltower:eu-west-2::control/QPBHYHIHIBIH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SLVMAGISUXIW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TPIAEPAYBIMP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DFDUSDEFRXGJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KUGZGUCJEEWT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OFWBUELFVNWT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FPFKOPOEZRST` US East (Ohio) `arn:aws:controltower:us-east-2::control/LVAJMRVLKXVW` US West (N. California) `arn:aws:controltower:us-west-1::control/HMCQCTHXOJAK` US West (Oregon) `arn:aws:controltower:us-west-2::control/JJBWMNJJXOLV`

CT.EC2.PR.18

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.18	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.2	Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HCWCESPXJIHW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NTPRVWTJPLDH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OIHVTXVJSFLZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NDQNZAIVSEGA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CHWQTIITHCLL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PJAUVLXZJDJL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GJHONUWZLYGN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WLGOVQZCVMAX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KFSYTINXOISA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CXYLMYZHNKTA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XHXUQXLXFAVC` Canada (Central) `arn:aws:controltower:ca-central-1::control/FCQLVHMQUYEM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JWTQANYVKKRL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QQPUOVYQOUFH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BLHVJCEFKWFP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BIHFKAGSIGRM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WNKTVRGNDUBE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CANOYGXZAKRK` Europe (London) `arn:aws:controltower:eu-west-2::control/TOVXSJYBPSCY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XNFTRACVSIJH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KWCXRCDPQJFR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KQFVBHZMGEOH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YMTYKZEGMEVN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TDOKHZLKLJIS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TOHTLYNBKVYA` US East (Ohio) `arn:aws:controltower:us-east-2::control/XBDTGEMIMJYY` US West (N. California) `arn:aws:controltower:us-west-1::control/KNZWSVFOLGDW` US West (Oregon) `arn:aws:controltower:us-west-2::control/RERWXDLVIIXB`

CT.EC2.PR.19

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.19	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) PCI DSS version 3.2.1 4.1	Encrypt data in transit Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PVGFTIQERUKY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TRPSRCVRETKA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IFTNPUBQDYXW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DKNVGKMOCFRK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PCKXSLRDAWML` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GJAZFJQQYMYY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZDTJVRYSTEYM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RQZHICZBNKIT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RRIYZJRBCSNN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LKNKZOMUUQZI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MCLMJUHLGSBQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/TNQREQCHEREZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XOAHAPWXPEJL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GTCJJWCENYCY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TQYOHUVRBVLH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KXRIYOKIOLDG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JKALPJXNDEUJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DLHJFRBQIOUZ` Europe (London) `arn:aws:controltower:eu-west-2::control/ESFZABHNGKFV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YUCZSOCFIIYL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OELBPSKEEGEA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DUOGNRYPNSGJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CXDUKDCKMLAX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PHGMDGBBZZVQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ULWNHDAVXSWD` US East (Ohio) `arn:aws:controltower:us-east-2::control/WHXHNBCLHZVK` US West (N. California) `arn:aws:controltower:us-west-1::control/GHQNRDIDRRRI` US West (Oregon) `arn:aws:controltower:us-west-2::control/HQVYJHBVUYUN`

CT.EC2.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DUKUFDMKZNNE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OXDELGPZPGWI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IQTZLHSDAVPJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UELALJTZTKJG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UWVOMYBTMINT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UMDAUNXLFJJI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AKETHXXMVTQR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TTTKTHOMEJGW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TPIXAIIDPGBY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NSYQYXIHEBWE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MIZLGQYHHGNA` Canada (Central) `arn:aws:controltower:ca-central-1::control/KLTLENUYLCHX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LDZLIZEYHSBD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CJVAWZZZEAFY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YYGFVEDLRYTJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TPMKJPKVEDNA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VHBUBKOEZTHI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XOCHLLPOOVTV` Europe (London) `arn:aws:controltower:eu-west-2::control/CJCTXIIMNFJX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SSTRQDHRJJFX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FRMAUAMPFCPJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EHLAXLXRJAQD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RBSTYRGNTGHQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AHSLJKRCKEVG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CVFETGCJNKXF` US East (Ohio) `arn:aws:controltower:us-east-2::control/HFMYOOXSTPVC` US West (N. California) `arn:aws:controltower:us-west-1::control/FLIITHQMTLZG` US West (Oregon) `arn:aws:controltower:us-west-2::control/GQRIEQCBOSSI`

CT.EC2.PR.20

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.20	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.2	Encrypt data in transit Protect data integrity Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HBPHHOIUVCIC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BWQYYGYNTYTF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JKUGSAKGLTHD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BFORNBXJKDWW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SQHOCRNSEXEJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JIIMKWUYJACB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RXGLYCJGBYGD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AFBXGNHALNJF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WLRZMSULFIXM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LDIQIPNKYDDU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GQNGXWBTGEVE` Canada (Central) `arn:aws:controltower:ca-central-1::control/AQALJJABNSXP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SQNTAPQOUGNH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/APEAFKRGXXGL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RLGGIJOQHTWU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DYPMGYDYNEIE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YFIOIOFAVNPW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SUARJCFCBBQV` Europe (London) `arn:aws:controltower:eu-west-2::control/KLTLMNETYYCK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/REZIZGDEHWRF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LHDZEXSDNLXU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RKPIXCUNYTJB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FQNDWRNEBQSL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MYAUSTBPZYAV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PDFDBIRUZZZM` US East (Ohio) `arn:aws:controltower:us-east-2::control/OLCBWHURMETT` US West (N. California) `arn:aws:controltower:us-west-1::control/UCNADOAQCDVL` US West (Oregon) `arn:aws:controltower:us-west-2::control/EMEHQZEQOKXY`

CT.EC2.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.3	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YHTHJBQJJVFQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WOHIMVFOWTAL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DCJBSGYTZDVE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TLXGQRQZRNJR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VFVJCOMQJKBH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QIMWICZWNCTJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YCUAGICDVCVG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LZMEYSKSQSYC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WUNOAUPAPJBR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VCSBDJNKNXJR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MRBMELVZIAZK` Canada (Central) `arn:aws:controltower:ca-central-1::control/XENHMLFNKUIK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TKGSLZFXKVYW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VCNQWOBRFBYK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RASRTLVWUAOU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IXEOZHLDVITA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UWWTMOVSNRCU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KEAWNIFQNQOD` Europe (London) `arn:aws:controltower:eu-west-2::control/RLLXYAJVITSR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OOHNQEEZASSE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BLIXQJMENCVK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GMIFXFKTECRV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TMEYCYVUCYDC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QAMRZHHGXINM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VVDNPMRRUWKZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/PZRWTPBHWDVJ` US West (N. California) `arn:aws:controltower:us-west-1::control/LBDDZFPUBGSA` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZDDEIITTHMLA`

CT.EC2.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.4	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NLXKLURXRNDL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JYOPIABWXZKO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MHXZHOBFJFUN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YTLKASXYASWH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BNIHBVSGLUNE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VALJQOMVXOMI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KMFIIHJHPROT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BWPBQRUMLZXK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GEQABOPVFXCO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ERCKYPEQKGQY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LPEKGJIKOSHF` Canada (Central) `arn:aws:controltower:ca-central-1::control/KPFAQFAQJAWK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NUMPUVXQDHGA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VBHQSMHYYHTM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CZTDWPXRIDER` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GFIGHDGRWXGM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DRDSQMKCIRRJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NMIWXPPBIJIC` Europe (London) `arn:aws:controltower:eu-west-2::control/BMSDUHXWMANZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AJJMZXYCZHPO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FDAHSWCZBUGN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NXZKINMFEMOI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NUDOLFIXZYEZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JZHLGQYTWPNK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KFDQQXDMBXXV` US East (Ohio) `arn:aws:controltower:us-east-2::control/UZFYNYFHIKDE` US West (N. California) `arn:aws:controltower:us-west-1::control/PVHDAKCIBKQU` US West (Oregon) `arn:aws:controltower:us-west-2::control/AECZRRYXCRTG`

CT.EC2.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.5	CIS AWS Benchmark 1.4 5.1 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ETMSBMVIDBMK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NXUWXUAOGPAS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BWLZVKGFDRIG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LMVUECWMMMAG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HPUAFLSJFNNQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PEKEYNXLWHHA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GXAMOHYONSAY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XTGIABCGSEGH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JSPEJFTHBYZF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XNOKLOVHWBEZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DBGPJOSFENFN` Canada (Central) `arn:aws:controltower:ca-central-1::control/FTWNDUKURLTP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SWBFLJHBRLPW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RUGKAUTIOKRF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EJCXPRMBYXHH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LSSLWVUIITJC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CFPKOBHYVXFU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GNLTWRBKGZMV` Europe (London) `arn:aws:controltower:eu-west-2::control/XMREZWZEQWZR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GCHXILWGOPBI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OFNGRJURIHXN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JYHMYCYWFDIE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WFKPVQJGGPGC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LMJNAXCWKFLK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DUQKORYIWJYQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/OEYVCMVLVIAT` US West (N. California) `arn:aws:controltower:us-west-1::control/GONSQXTKTNDT` US West (Oregon) `arn:aws:controltower:us-west-2::control/JZWYQOZYBXKL`

CT.EC2.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.6	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VFXWJQXLUIHI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JGBJBNJYKXYS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XJFUTUKMXHKB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UBNOJKELNWGQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RKIVCDUNAHHS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RSPKEHRKFSKK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PQKQBDQPIXCA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TJCZQYWQVXKW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NCDDQQZLDCZI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OEHVBKEUNBFI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ATKGMNOIYDJQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DKUIAHCHYZTU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VGTXIUNUITGO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TSZFSULSYZVH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TIUYQFRWXSBR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YPBPJCBGKRXG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YCUDIIRUMWEV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KVVDNFFOMGMT` Europe (London) `arn:aws:controltower:eu-west-2::control/XAXENCPCHDJK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UKGTSWXIIOEJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SGAIFIRXPCUH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UKUCDQFEMDGT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DQKFUMTNBEXM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FWVYDJQAPZUF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/THHTKPOPPVGC` US East (Ohio) `arn:aws:controltower:us-east-2::control/FAQMZVDILTRV` US West (N. California) `arn:aws:controltower:us-west-1::control/AXCDWYYFELJJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/FSNQGGGOUBAE`

CT.EC2.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.7	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HYWNSPMVFTMM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NIMAUKZKMIOE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZAXKMESMEXSF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XMLXJMIJGLVL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QVTIUYOTIXLG` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MXXCFQMDZVVY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HLKXSQDKBYSC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FISHMDVXAKTQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QVYBWOWBJXKC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZPFLDJXNZPIE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EBKEMPBNWLYF` Canada (Central) `arn:aws:controltower:ca-central-1::control/KMLZLRNMCKXY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NILBBCJYSTMS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NQITDCBRPBRP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SKZQWOOFKNWA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YEATEJGNLHKD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RVIOCFZIRSNU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CZSRNXVWVWON` Europe (London) `arn:aws:controltower:eu-west-2::control/JRGGEILMPZCB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZQJJBPROZEJK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RYBRVORSWOMK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PLWJRFGUNUBT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WQKSUTLCTJZO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HMVXESEHIEFX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TORIRIQKVTCS` US East (Ohio) `arn:aws:controltower:us-east-2::control/KWFITNUSNTWO` US West (N. California) `arn:aws:controltower:us-west-1::control/PQKLUJPAIDPH` US West (Oregon) `arn:aws:controltower:us-west-2::control/YJXXNEDHNQGK`

CT.EC2.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.8	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KHRCVSMBFTBG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XRRNGSVNWUOX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XNJAYSGVGVMT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DMNHGNNKZEBP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AFMPKBWMAQVX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PTTXRHPKISJL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LPNSPPZGRSQC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HVUXMKMLIWUT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WTYIJXIQQBWX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LCZICULVYVTQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VDOHFFWLBMLL` Canada (Central) `arn:aws:controltower:ca-central-1::control/BFYFBNGDUPMY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ESEUINWAQPFU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UCCVNQSPNYVQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FKBVRKHONPPP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DBCLUROPTPQJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GAOYRTVNQGHB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KMDVQBZYAHYQ` Europe (London) `arn:aws:controltower:eu-west-2::control/ARDGJZTPMFDP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZZTQVTTCXGIR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LSMWAQUJVBDF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BEKNCPBAOLVJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CNOBPUWJKIGF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LCMLSYPEDNHH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SZOFEUATQICK` US East (Ohio) `arn:aws:controltower:us-east-2::control/KUQMAGPMTIYY` US West (N. California) `arn:aws:controltower:us-west-1::control/YCYMJNOFKIMD` US West (Oregon) `arn:aws:controltower:us-west-2::control/LPPLQODCGROV`

CT.EC2.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PR.9	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UBKVZJIXAHCA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ALCTCNZFFPWY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WSPJASMSHIMH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PPEWYVJJUTDL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EBCERJIZRPES` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RWBQBCWGSMYZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QCWEEEETSSTC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JHBKWBDQDYGY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NKVJXXQBVISF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZRLPKTZVMADM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BFPRPYTVROPT` Canada (Central) `arn:aws:controltower:ca-central-1::control/SLQHSJSMHMNF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DVZJISBFGPXQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MLYQXYDSMSNO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XOGWRUHGLMYT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LLULMHXRNSIP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FMACBWHCXOSO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OTTRCZABNRLV` Europe (London) `arn:aws:controltower:eu-west-2::control/UKGRYFSQWORG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RIHKQEVJLWKW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KYQEYIPKZZGL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HZGIRZSHINZB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NIJPSHTUOAZO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JPSBSZNEPWSC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CUDBAEGSAETL` US East (Ohio) `arn:aws:controltower:us-east-2::control/BOOVPDGTDMMV` US West (N. California) `arn:aws:controltower:us-west-1::control/VSYRJAIQJXRE` US West (Oregon) `arn:aws:controltower:us-west-2::control/JAUAVPLUCXQF`

CT.EC2.PV.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PV.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JEJIQALGAMRQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZSJSCYPAIBXQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KNDLVQMVYRIW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CCDKONBVFHMX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TFTCJOVKJLMT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NMUXQXQEMYOU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GRWQKMQTHFTA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZLTPOVDCNCGM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JXRGCRRLVVDI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JJJXZNGLHLUF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MEPYVZXUOIWE` Canada (Central) `arn:aws:controltower:ca-central-1::control/IWKYDPSHHVML` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PNKGHRRUZPUZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KJKTXJUCVRWI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OVJYKTCVHJFK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MNUWGXOWKURU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DEUUOIHPMKAV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QPCQUNRTQSAB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ESBANDFNAUPY` Europe (London) `arn:aws:controltower:eu-west-2::control/YPAJJQFPQHZQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EAXMQNVTMKSR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UDWMDOPMGLTO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZYZPAEQXYYYZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KTTDGYIDMQBF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CJWWHCASSXWQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QYNBJXVUADDJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/DGXVMBTZVZON` US West (N. California) `arn:aws:controltower:us-west-1::control/PPIQEJBMLGFM` US West (Oregon) `arn:aws:controltower:us-west-2::control/VDGEODIDZXDR`

CT.EC2.PV.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PV.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SAMYCDSLHRSP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RLFTOFECFBLX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QBBKUFGDMMSM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KPBTWENBXJVW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LYRNEBMKPRTR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JDQDBMIYNKPU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VCZVABGYJPWF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FDIWDCPRVBUD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DYMEHJARMKVA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EJDXIYMHLMFA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HYKICGFAWYUK` Canada (Central) `arn:aws:controltower:ca-central-1::control/SFHBTRLTBPKE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/CNXHFYQZKZNR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YXRJTFNSRQBT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YCHZHVVXGHRV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UBHHEAUUYQRY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TUCSBMYCOFPA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WHRRRJKPJKBR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EMUCXPDDRQRS` Europe (London) `arn:aws:controltower:eu-west-2::control/XNMPIQQUPZZQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IQBWWLOWSJGW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FEJPHVPBVSLV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QUKENRWGEKDV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QMCWKFJKDPTH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FPLODQLMJECQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XFNEYNNZPTGL` US East (Ohio) `arn:aws:controltower:us-east-2::control/JRCJLYEUWEAR` US West (N. California) `arn:aws:controltower:us-west-1::control/SJTQZMYHXUUW` US West (Oregon) `arn:aws:controltower:us-west-2::control/WKQRXQBHPKHM`

CT.EC2.PV.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PV.3	NIST 800-53 Rev 5 AC-21 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VHAIKMBJAYNU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XOCKEFMNJOJL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DDDZBLDXBNLI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IKBXDKHINKQZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FCBHSKCCQWIW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PMUHWXSMSWPJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NEQJLANSJHSN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YDWHLDLLQYKQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZFGPINZEDNHA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DUZAZKIYTOJI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JNVLBGKIXGLF` Canada (Central) `arn:aws:controltower:ca-central-1::control/QERNFETYILJR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZOEDCHXCGVJL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XCBBLVWRUUZH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XGUQGBDNOFSP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LMOGZFXQTSFQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UAXGCRLSTKBX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HNBPMELXEFGD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DXEDENHXARDC` Europe (London) `arn:aws:controltower:eu-west-2::control/VZAGIIIWANTB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZCCRTDVKBPMW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZOMWXWDKCNRU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TXTQVUKURANB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LHIONJLMUIVY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KIWWTIKZGTJA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XGEAULNJZNVE` US East (Ohio) `arn:aws:controltower:us-east-2::control/QFUMDYUVOKNH` US West (N. California) `arn:aws:controltower:us-west-1::control/CWFSOMNPVEWX` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZRARVNPRKEDC`

CT.EC2.PV.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PV.4	NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SSTBOJXRKDQW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ODNPAKUTMSCP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DKWRBPJYSHBT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LZLMUHOWCXXM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HIZPXMQPAOIA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JODKGYKBMUCI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TADWJEUEHALG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JMVYSFPCMPOP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KPDJIJGHKWZJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LETJITMENKEQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TDHBNSHLEYAW` Canada (Central) `arn:aws:controltower:ca-central-1::control/XTCFTTKIVGTN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HNFEVFDAPVEB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZBOMDKMJYNRN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GACNHGSANTCE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IFWQXGYWXHPG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YNCMWZYJQYVG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KWVFIBRUVCNW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SNXTYMBHGDFS` Europe (London) `arn:aws:controltower:eu-west-2::control/QVTYZILQTNMC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MXJHNTCSCIJS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PQEPOZEKFKXK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OTYTLEJSOJRC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PUTUJBSEMFAP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QDTMWFLIWNVW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GHSJTKXFXHRH` US East (Ohio) `arn:aws:controltower:us-east-2::control/YTABBDOBIHED` US West (N. California) `arn:aws:controltower:us-west-1::control/TCNVZHJEWTIH` US West (Oregon) `arn:aws:controltower:us-west-2::control/EBWUEMXUGAPN`

CT.EC2.PV.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PV.5	NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YZBRYPYMHOSR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UYBYUHTDNANI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UWULNDELZYCJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QFGLUGBHYXZK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BZXQVPISUJUE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KXLRVKUCFQSJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RWAJOWNWXEWF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CKUTHXNXRMCF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BXVVWHFTYOAF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GMSHBDOAHKHI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KLIFZQIZZWDM` Canada (Central) `arn:aws:controltower:ca-central-1::control/JUKQTEJGAVSA` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VYACUVDAJFDD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FLVQLJKGJQCU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JDLBRLVBZOYN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LPFLLHDHCXRW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CIFRWUDOGZZZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SQPMUEDBMIYH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SKYWKZNFEZBH` Europe (London) `arn:aws:controltower:eu-west-2::control/UVLTSHLSBWJZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NFLPMHINYBWP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BERLGJJSNKMM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YPYABWJDKHVL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WIRCOWSJKYEW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VXQUMHXZOVIU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NNHGIDDKHHWE` US East (Ohio) `arn:aws:controltower:us-east-2::control/BEIPHXRJNBTF` US West (N. California) `arn:aws:controltower:us-west-1::control/MSDFVWAYUUFU` US West (Oregon) `arn:aws:controltower:us-west-2::control/XRKLQWOPJVYS`

CT.EC2.PV.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EC2.PV.6	NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UAXLTHFETOAY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CVIASRNENCBK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WEAEZPVLACWY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WEOIFHCTULKV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UVSJZUHFSUKD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GTSXROEFLIQQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ACJBMMGJKLKG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OGSGHVHZCIMC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GUMQHPYKEKBX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZXTGGJQZHLQY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YQZPJPGGFKNJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/HPAJKCLSWUKI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZGDPBHBOGACN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MIQDLAGROXRA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YMJBBGSTFCVN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KDBTSQXEVFKN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DTSIZQDYZVPQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FXLWNQRVHTMZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SXASPFXVYCVQ` Europe (London) `arn:aws:controltower:eu-west-2::control/XBRSUVRBMRYY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FSUBQPEADBIK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FOPVKXPQQJNL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NNLTLRTCRFJB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FANHZDBWKZLS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JPBFZNFDOLMK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ROQSXWNZWNSL` US East (Ohio) `arn:aws:controltower:us-east-2::control/BXTIHYDLSFUP` US West (N. California) `arn:aws:controltower:us-west-1::control/YRJCCIPDCHPN` US West (Oregon) `arn:aws:controltower:us-west-2::control/HQXFMTJNEBMH`

CT.ECR.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECR.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 3.1	Manage vulnerabilities Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IOIUROJXAOTB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EHPCWFMOJUEW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IRDDNOLWNMNN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QMYDBMPBOOHM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QZAKDBVRAQPU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MYOMRLIOXVFN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RYSKJQCTSTWT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UKSAVCPEYYXG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QBVJWKFJGIXU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YBFBQOOUVSWP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TZCTUGJAEZNV` Canada (Central) `arn:aws:controltower:ca-central-1::control/IMGIIRQPZYLI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BLRQAAKNFKRK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GOVJWUEVROCT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LAUYCZEXCNRP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KIPJOMKOBOMA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SSGGVLEUYGFH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JHXDESJFVFUH` Europe (London) `arn:aws:controltower:eu-west-2::control/GEXAFJDYDCYJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CXODZHXMCVEE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DKZSCADUUVKR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GPJWARDBOLYJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DIPXXRQWFAQW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UERWGVPURZSY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QXNBGIPKJBEQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/WUAWJINPVBIG` US West (N. California) `arn:aws:controltower:us-west-1::control/THFIWZWCVZGV` US West (Oregon) `arn:aws:controltower:us-west-2::control/IRQTOSLASFTT`

CT.ECR.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECR.PR.2	NIST 800-53 Rev 5 RA-5 PCI DSS version 3.2.1 11.2.3 PCI DSS version 3.2.1 6.3.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZCFFKHBNTVBL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PIRUMJAENJDF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BBNLHIKHVSDF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ELSOUNERQMFA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DSZQHOHPILVM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WBSBAJCHOSLR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JUTYWVTNRCMS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ATEORBKQUMYV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QZCGKPXCBXGB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NQTDLNZGOGBG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QZESSATNRQBL` Canada (Central) `arn:aws:controltower:ca-central-1::control/NTNTNZEGMLUH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ITYUPRDRHQJX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BWSAXHIZEZDD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CTBPMNOJRRRG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IOCROVUHSSPK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EAUQCAJHCRLS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WYFFKCKEPLJD` Europe (London) `arn:aws:controltower:eu-west-2::control/IEEUEQBFFCBK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YBYDPISAFGVJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OCSHRWCPBIGG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PFYOBUVMABUR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MDCLENDMMJGN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OUGZGHPIBMEQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MOWSMMNGTNEJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/QKPSFRNOERPV` US West (N. California) `arn:aws:controltower:us-west-1::control/SXENUGPYUKAD` US West (Oregon) `arn:aws:controltower:us-west-2::control/WODEILPXPBWH`

CT.ECR.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECR.PR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-8(1) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FXWIRNEDJUVP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CPTYXYMLLOZE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KIXAFVFYWNOM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ECNPMKMZLJXF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UQFGHQUAIBAI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QAMXLOUSWQVO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EEHWJWMDSOSE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XZFSMLDDYHOK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NEMIRSQYEPIE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QRCFKIBEUPDE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QGQOOLGEUFRO` Canada (Central) `arn:aws:controltower:ca-central-1::control/FKSEYKPJSDJT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CZVDXRYERZBE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YAFJVSLTGBPG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DQXOSGOLEFTV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KIFLKMDMDVPH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UHSKPCFWWNHJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EVJNATWHXBEW` Europe (London) `arn:aws:controltower:eu-west-2::control/ZEZBSLWHLNTZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FNBIPNPRWVQX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FHVQFFFGCFWK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NPSTOIEYDVPV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GRIJKPPVEHJG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FVDLDRMSGHME` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RKDZMSUYQTHO` US East (Ohio) `arn:aws:controltower:us-east-2::control/ARYALUPZXERR` US West (N. California) `arn:aws:controltower:us-west-1::control/LQFQWXGRRJXG` US West (Oregon) `arn:aws:controltower:us-west-2::control/FQOEMCXBLGKN`

CT.ECS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.1	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 1.3.7 PCI DSS version 3.2.1 6.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.2.1	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NDMGEEZJEXYO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MZVXPGLPGWVM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OXTKLLLGWCQV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AVQAVLSBSYMU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RXWKVANCUWSA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KPQKCVEFHKYM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JUYGSQOUWUFL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ARPWJUYLVOEF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AELENOQZMXVF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ORAWXBHCEJWG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OQTRAOQXRMKF` Canada (Central) `arn:aws:controltower:ca-central-1::control/GBPYRLBOQCKZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MJYZZTPTBHOK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MUCKKRINLINT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JQRIGJXOXPYN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JRISOKFFILDM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GMOHYFMCJQWC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FJIWSMFTNUJP` Europe (London) `arn:aws:controltower:eu-west-2::control/PYRWLZWVZEGC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TFUJIAEBMCWO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FYQMDAKQISNQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QJGKAZAAQHWG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EBKWKZSZPRTF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LBRTCEKHUMKQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MHZENEKNVRDM` US East (Ohio) `arn:aws:controltower:us-east-2::control/MYSVOZBSJPIT` US West (N. California) `arn:aws:controltower:us-west-1::control/SYYXANDPGYMO` US West (Oregon) `arn:aws:controltower:us-west-2::control/PRTAZZJZIMQM`

CT.ECS.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.10	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.3.7	Protect configurations Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LUPHAYKCDNOT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BDWFWMGKGTLC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SFTBSYXOGMZG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OHEAQZBMADFE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NTURYGMJMIDN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TOAJYCRKCFXD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TEOLHJITGNSI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JYWFVNVOCRVR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BARUWERYCVPZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AJNKXRBUKMIW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KQEMAQVKCPAV` Canada (Central) `arn:aws:controltower:ca-central-1::control/QFQHDLEJLUVA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NIQDIWOHUBIN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AJKJAINRYYQR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XWUPVDSFNTVZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NUGUPHOMSEQV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VCODOIZDBXDK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QTCQLTCIQJQZ` Europe (London) `arn:aws:controltower:eu-west-2::control/BCRKCZGDGDIL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZBUMWEYBEHMP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NCVWTYNSFNOA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HKCKNEDVBSVT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LVCENSFTEGNU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XJRVRGJIFJMX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SIJXAEJNCZRU` US East (Ohio) `arn:aws:controltower:us-east-2::control/KRBXESUGGRWX` US West (N. California) `arn:aws:controltower:us-west-1::control/NNYUGCATXOCK` US West (Oregon) `arn:aws:controltower:us-west-2::control/TZNJBPCHXKPN`

CT.ECS.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.11	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VHGSWXFFXGEA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EFCZNPVOMKNP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GQVKXJHRWRZY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SEFHYQQECPNZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QHUEUPKSMVAC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HZHMSMNSGECV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UZYAASORZSTK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TXMZRKTZUCXZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EUFKWMGWEVVF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WANJBLRHTDXZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YICNYVZHGQFA` Canada (Central) `arn:aws:controltower:ca-central-1::control/EINHSETMUTZS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZGZXTLVZQFHO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TXZQCWTXJKSR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LBWOHEISYBLE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OKDUSHUVONOT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YKEDJRVRZKEH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UVDVAUNQEEFE` Europe (London) `arn:aws:controltower:eu-west-2::control/HFPECCDKNWON` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HNGJINPEUOQW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DISVJHLQHYOO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MPHCEJEWQEZG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HTCFOMOTTSOB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OMEPVOAXBHGF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FKKIKNEMQIMG` US East (Ohio) `arn:aws:controltower:us-east-2::control/YMJJJSFOHTFV` US West (N. California) `arn:aws:controltower:us-west-1::control/AIYVMWDWTLCW` US West (Oregon) `arn:aws:controltower:us-west-2::control/FNUUGNHLPMKT`

CT.ECS.PR.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.12	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 8.2.1	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ICYGGNTPXDRI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XAKUNACPPCIH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MGGRRKOTQYGT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JTQTBQTJXRTY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CUTNMQPJIESP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PHUSQUZZKDFW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DIMYMTIRUMAR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EDPKYCGGTMWS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QANDDOVBOKJX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FBNIUCYMSFGP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JTJZEPHNXQVH` Canada (Central) `arn:aws:controltower:ca-central-1::control/UICVAWRLEUIA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JWXCYUIPKHHA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RCKSOEOJJJXQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XBKALBVBFBMU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LGDXTFQGGNDD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HCQDNSIUYVIB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EMXLYJRHKCXQ` Europe (London) `arn:aws:controltower:eu-west-2::control/ZIQTSJXBFAEB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FRGKEKWRNAFI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JMISFEYTYRYK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WIKFYNHQWXXI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CDBKAMWXZRHR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ANOIHODOAZVF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AMSZNQJFMYFK` US East (Ohio) `arn:aws:controltower:us-east-2::control/PDBTCIAMJJFJ` US West (N. California) `arn:aws:controltower:us-west-1::control/YDLIOLKELUTQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/DFEQFDPQBGAA`

CT.ECS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.2	NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YHHQMSOSLWSQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LXJSSCOAPFZV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IUNRXFCQGPRI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LQMMPHYSFREQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/USNBRAEIRTOF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DOAWPTYPTCXV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NUVQPYPCRWRU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FDKSTHVUWWYA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WXYOROQYZPPG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WMYOLPNABXBV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OHUTRXXKJGCQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/SHIXZVMGGYMM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WRZGKFSXXORW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MNKWNXXTMDNM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZUDLVFPNDOIO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DQFKEHKZLQDW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UFMSTKPVLYKF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HFXLZYQMGFRS` Europe (London) `arn:aws:controltower:eu-west-2::control/FOHVPKZVRHPF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OIUCPBXNKYYM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KKQCJKDMOLMW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FUTZCMEOXCYM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GBGHLSBTCWQS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZEHKMMLYIFGJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BYFWXRYSYXBV` US East (Ohio) `arn:aws:controltower:us-east-2::control/KERIBBICUEGG` US West (N. California) `arn:aws:controltower:us-west-1::control/SGZTSNJFPGDX` US West (Oregon) `arn:aws:controltower:us-west-2::control/LBPTWMIHFKYF`

CT.ECS.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.3	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1	Enforce least privilege Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GGZACHVRLUUM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NOIWGZCKJDWV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BKVHTGKQKYEU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YSVBKSPQRORD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HIAVTIWMMCDV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RQJOQNGJDIYW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ACWEVNIMYUCL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UWMACLLLDWQA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LHNFHNNMMIXX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HIVKSROFOHMI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EYTOIVASPVEM` Canada (Central) `arn:aws:controltower:ca-central-1::control/WHBVGSRPVIND` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ICGGLMZIPMAT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AAWOAIJMXLNY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XUQCMRRSTMWQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/REYGPHBQWSGI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PLGSGRFMDMHH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LQBIGKSRNIXX` Europe (London) `arn:aws:controltower:eu-west-2::control/AROELFZBBOTF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EFDXHWMRVIRK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SYGIWESDSEZZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DKIXMNQCFEDO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PXEGBZYRWQRK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RQWURAFSPNKR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GFAVSWYHDTND` US East (Ohio) `arn:aws:controltower:us-east-2::control/QHAHUINVTWCK` US West (N. California) `arn:aws:controltower:us-west-1::control/QIGZSAMESKYV` US West (Oregon) `arn:aws:controltower:us-west-2::control/FCDPZLCZQNUW`

CT.ECS.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.4	NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(5) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DDEZLVOWZIVH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RHQTKXEGVONX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GODEJVZHXFUC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IBTZPTTDYAKT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VAAGGLZEFDKT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZAWNBERLIWEW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DZMBACOEVMXS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DQLFFJBHMJJB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NRNXSUVDQAOK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RVWNBZEIAMPE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YTNYDNTBJROR` Canada (Central) `arn:aws:controltower:ca-central-1::control/IARHPIWNYLNY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NAMUQZRYRJQQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CWHSHXCPXHAN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ETHWPOFJNBHN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NZWWZBPGYEQI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZVTRPSJBSKGG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KOMKXLGQHVZI` Europe (London) `arn:aws:controltower:eu-west-2::control/OJZFAUBEPXZP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NMYHLHTRRSMF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HZKZHFDATHMM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XWNOQNOKXOVF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OZKRBTWBBIQJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DNLNJTIGMMFI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YAGJMMJCIQDQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/MGBLOFCADDWF` US West (N. California) `arn:aws:controltower:us-west-1::control/FMYFLIBUAOQB` US West (Oregon) `arn:aws:controltower:us-west-2::control/NDQWPPNXIKJO`

CT.ECS.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.5	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JLJKXDPIIQQT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AFXFIKNNJTCD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NWTWUHESHFSA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JLPDEEKGFTNS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VUOFRSMBBPCP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AEKSNGNWNYUJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JBHWTYUKEEIO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YAHLRRLBBDTI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OOZUIEFUETGL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NZXRQVWELREZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IAIPQJCUSFGX` Canada (Central) `arn:aws:controltower:ca-central-1::control/MBYLGYRJVDVQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YQOFKKMHUBER` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GVWABBLEXZTU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YAUDJTJJYGTZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MSHUDWEPRDVI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DFBRAWTBZSIF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DEAHTYWKLWPU` Europe (London) `arn:aws:controltower:eu-west-2::control/DSNUNMWDLPJA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XCQQPQZSYJQL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UAKPTHISQKRE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RYPWRZQZPNPV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PTDTTDWPYNID` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NHSQHFUTGCNR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WLNVQYRKIGTC` US East (Ohio) `arn:aws:controltower:us-east-2::control/YIGLAGAFXXJO` US West (N. California) `arn:aws:controltower:us-west-1::control/SEKFMJRLAUDZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/LERIWIHIZLWV`

CT.ECS.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.6	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HORNBWCMJORW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CBOMKCLTZDHU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZXDGEZSOPFCD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AMHLLJICMVIG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DZPUWGAVWHXA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DNUFPJWDBSLZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RYOJTKATLZWB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PEWMZHWHAXNB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ALOSYSCTDXMC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KWSNCTWDCYIA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UWJWVKORWUOI` Canada (Central) `arn:aws:controltower:ca-central-1::control/IFZZOZKBHYXF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XPAYGNHWKPRQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VKEZRNWMAPCG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PWQAQGQMGWXY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ONBILKCURYST` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JIZJUWRJAZLR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KVIHSHXVHFCX` Europe (London) `arn:aws:controltower:eu-west-2::control/OPDRCLSYBLYK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SXGYESZKKJTY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JTYEXQVOZSBN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CLYTXBYEVHWI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GBCMAOMNPVEZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KFTLBREXIINM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JTWWGRQVPNPA` US East (Ohio) `arn:aws:controltower:us-east-2::control/WXRVLDXHYTSD` US West (N. California) `arn:aws:controltower:us-west-1::control/APHTPEHOKCKF` US West (Oregon) `arn:aws:controltower:us-west-2::control/WOJPYBZNHNQO`

CT.ECS.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.7	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SERKYJMNJNYS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DXBQECPIABVE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BSSDTCJTXIDJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZHITNVQDDRNT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QMHMUOSCGEHN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HRFRZYONQAJF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FTVHCALGECKE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/REWMTIUNPNGU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NEZKAVUMHCLM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SZBHNXBFPDGI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PCIZQSTGKQOY` Canada (Central) `arn:aws:controltower:ca-central-1::control/OWWEUIDVOUHP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CSEKQRBEEBHI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DVTKBJDCSCIJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SXCPWIDYPOPO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RSBGFQKAVQFR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ROOABJEGQOBT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SECTLWSVMKFB` Europe (London) `arn:aws:controltower:eu-west-2::control/FSUOYQJVISCW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IMYNHRNBGGDP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PVHIQKXRYMXE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ILMNUQLOTKQF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JUHBTBYAVHAF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RPTFPYNJVRRL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KXUMGTKTEKZR` US East (Ohio) `arn:aws:controltower:us-east-2::control/IPDXJYKWODXA` US West (N. California) `arn:aws:controltower:us-west-1::control/UKIVIVVHEFYM` US West (Oregon) `arn:aws:controltower:us-west-2::control/RYUYZPTAVRFN`

CT.ECS.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.8	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SMFMCNFPQLZO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FRJMQPFLSYSC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KUHUYIYOXNXL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UCEBJDGYKZIW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NBTIIWMCBBVP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IGXZMOGOCQBH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NIRYANSAZIQL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JEGHYZBSMSQE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VAHLXFOOZHSE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CPUSDPMIROHK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SUKOWFYLVDJT` Canada (Central) `arn:aws:controltower:ca-central-1::control/OPJANTDNJXXU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HEKFVPAUPMOV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XRKUTGZUWRQP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NLWRWUMEMNQR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VQYCXJZPSIXD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FXEHEQAFPUSH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DSHJHPGBENNQ` Europe (London) `arn:aws:controltower:eu-west-2::control/LVFACZHPEDFZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YPNPABPWVPNA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TWMXRHDUVWOW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZDNFRDTQKLQS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EBTYHGUHIJME` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GCCOHHGINCEN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KKVIYLEZFGKT` US East (Ohio) `arn:aws:controltower:us-east-2::control/RTPJRDPZWEHJ` US West (N. California) `arn:aws:controltower:us-west-1::control/VYVWURVYUKKH` US West (Oregon) `arn:aws:controltower:us-west-2::control/GIGMOPTTKBKT`

CT.ECS.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ECS.PR.9	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KFPXJHOPUQJK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CIRJDRQJIHRI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UFCFASRBMGGT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FKQYIWLKBLWC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KWFPVPYEUQKJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BVARTMYMOPNP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ETUVKDVBNXWK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BZRONDFGFUHD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YXLNPXSEMFTR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NOCAIXXNKAIJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BNFDUDZYPCFD` Canada (Central) `arn:aws:controltower:ca-central-1::control/QQBFGIYIOMAO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZODTFHONMPAK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PQYTENJTRMQG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JHDQJBIOETHT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VMOPJVSAEBDK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CTEIMJAETBLH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UJIYCPZPSNDW` Europe (London) `arn:aws:controltower:eu-west-2::control/GSVMYFTSGKWB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JDNTXDQRRAGR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VCEDBHTMDGIK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XAJBOXSRLCZS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WJSSIZCTYILH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TIRWNJLSDRJS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ULWRYYUOYETK` US East (Ohio) `arn:aws:controltower:us-east-2::control/EFALHMKKXWXM` US West (N. California) `arn:aws:controltower:us-west-1::control/BNESJVBSJKKM` US West (Oregon) `arn:aws:controltower:us-west-2::control/OJBRRKEONYNH`

CT.EKS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EKS.PR.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GBJGALFTTBMS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LRJDBOEOTGAP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OZXLRJKGCMBS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TGCCACSYPMRO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HSZAZLRVWDLR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YHWWDZFUJRBQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CKECKGIUXTQB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SBDBCVUFDDXN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NJSROBYVJRTO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GTUYCDYBWLHO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PUXOKIJTZOIE` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWMWFFQFZKMX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NOIJYYRQMQEU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SUWYBNUZAMNV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SHJWJBNMDRRG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XJCBPEDKRFOA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VILPLVHUDSIQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MAKASQNHOXIS` Europe (London) `arn:aws:controltower:eu-west-2::control/OGZYDIHGSKFX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VWLNWLZMKRGC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DWOYPXXTGQIS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MTSXRWLZEZIF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LUCIOGEMBOTI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ISUUFPYPTGGN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WBFBYCXMVAQM` US East (Ohio) `arn:aws:controltower:us-east-2::control/DYHEOMIUQFIX` US West (N. California) `arn:aws:controltower:us-west-1::control/ZZKJNURKGFHZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/GSLRTSNFSMMH`

CT.EKS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EKS.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PINKRROCTZKV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WOIYZKWUBDWG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BYEGHPQCYSBN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WYEVJIIZOLIL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RHHGAMNJZHYK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KOPLFFVKEDAB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DHNVBIPNLTTM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RRVFDZMDHUYX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KIPWXYPSTXZU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XCCMMBTOHCIV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KMRGWHJRKITY` Canada (Central) `arn:aws:controltower:ca-central-1::control/NTRRBCOKHJRZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XEMVRMKXIHTJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JVQULLJDBYJM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KMJXNNELYEJC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DFGGQVUCOSMS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GKQONVLDDSFK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PFWXKKGVZUKD` Europe (London) `arn:aws:controltower:eu-west-2::control/XKFIHAWINDZC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YBOFKAFGRJZB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EXKWXWMEDEQA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XDDWTJRHPODP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EPVTQXJKDNAJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OOXJFRUOXIKR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZYMOIFNKNWKL` US East (Ohio) `arn:aws:controltower:us-east-2::control/TINBDMQQLKET` US West (N. California) `arn:aws:controltower:us-west-1::control/AQWSDBJGVPGE` US West (Oregon) `arn:aws:controltower:us-west-2::control/LEPJFJKICJRR`

CT.ELASTICACHE.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.1	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HOQRGAEOFJZL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZKJYXVYSXGIV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IKOCSATHALLQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GCJWCUSXQIGJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LFDJWCRGQXCZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RZRXIXZMAVLI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TRJRZVZCRWLT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MMGPVLCCQDKC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PGZSVHJPXLRN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JBFIPVGUUHGW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FKPZDNGAEMAN` Canada (Central) `arn:aws:controltower:ca-central-1::control/SIDZOIYXVIKC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NUTMZSMQDWKN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DRIXCEWAZKMA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OGAZAAWMPVYP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EWNCZNFJJEHH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KKTMCYDDNQIE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IIYFHPBWXAWV` Europe (London) `arn:aws:controltower:eu-west-2::control/APHCLUJKHADW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XEXHSVEAHLHK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OPJEYWQWCMPZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JWHOBDXLVGHM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IAAWNCQOGKYL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JNMEUSLGWULR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KHOAPVGNWCGL` US East (Ohio) `arn:aws:controltower:us-east-2::control/SZITQJZTSCDZ` US West (N. California) `arn:aws:controltower:us-west-1::control/IGPXRJTANCPW` US West (Oregon) `arn:aws:controltower:us-west-2::control/WAGVKTPUMMVF`

CT.ELASTICACHE.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.2	NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HBFYZGBECJMI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DHPFFGWWJJJU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KZEHHSKPGKCS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QGOJFAEUBQYZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JAYMTBJNCZCX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LFUNGCAFTSLK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FSMTBMPOWFCC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BNZBYWHDDJAS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TIWUDRZWGRHU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QRBXRUFFBUZK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YUWPABBCXFEK` Canada (Central) `arn:aws:controltower:ca-central-1::control/GXKOJVEIZCKJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OWQYYBNTGQLF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TQIZCCRYALKX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WUTMKZYRTHQY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KNYMWNNUOOOU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PNHPEPRKLPUN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TJNEZHVNSIPF` Europe (London) `arn:aws:controltower:eu-west-2::control/LDBLMYQDWYBP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CVPBOKRKCETX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EYEZWOLSCHUC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZPYVCNCKBSHF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KKIELJVUIGMB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XNILTNRZOMAS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PRNLSSJXSYHF` US East (Ohio) `arn:aws:controltower:us-east-2::control/CEUMAASLVCGZ` US West (N. California) `arn:aws:controltower:us-west-1::control/CFBKHWVNORLM` US West (Oregon) `arn:aws:controltower:us-west-2::control/XYPKYXTSZWZY`

CT.ELASTICACHE.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.3	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BVTITOUCJXHE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BVLUZNPVRSMN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MZFHEBYQRUQX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FGFSUSQPLYJZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GMSVMLABMCNO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IYGWAKKVKOAO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JZIUWCPVXPRG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EGNYZBJWMLRF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BPLCSUSNIIYE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BGSOAUDWLHLT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MKKKSJGQGFRS` Canada (Central) `arn:aws:controltower:ca-central-1::control/AGVBFPDHFSFH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YYDSVCJSVRUP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MXKAVOHNDTFJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KITWCDGNIGAB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QIARJESGTXMW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DHONPPSGALEU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GGCXYMJIRASV` Europe (London) `arn:aws:controltower:eu-west-2::control/IPSVUAWSJZKK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MQKWJQJDJDUN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SHIMSNUKBOEK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EZLWWUXADVVZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RXVIDRGOEQSV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HWQTAFCAIEVD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MWVHFZSZZTIM` US East (Ohio) `arn:aws:controltower:us-east-2::control/PYAJVGNSTRBS` US West (N. California) `arn:aws:controltower:us-west-1::control/QZJGKNPODVTR` US West (Oregon) `arn:aws:controltower:us-west-2::control/PWIBHPGBWXYR`

CT.ELASTICACHE.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RGXKTKOYEKBI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AQMSLTABZIJN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ATDPLKOFLVCR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FBOBFTINYNLT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LFQASCUYICHI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EUMQYRAPDFTL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LXXVJGECXCLX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MMZEEFKNSKMU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AYHVEAYSGMHD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KLQYRUHZYFAN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OKLGYXVMGVVV` Canada (Central) `arn:aws:controltower:ca-central-1::control/RWFPWLVDFXEU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CERICEOQBAKR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MTYVBATSPZDM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZRZRXIUBBRWC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GLCJXMIVAWFG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SBCVIFZBXREP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QNKPFQUCXQPE` Europe (London) `arn:aws:controltower:eu-west-2::control/GBGWHHGNPRTQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ABKNGZGLILSP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SQMPAJNFRKMK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FKZCOZBSBMRR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IBSRIWUDBKBP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IGGUQCFBPOOX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LUPKJZXBMHBK` US East (Ohio) `arn:aws:controltower:us-east-2::control/URUJVBVXOUMZ` US West (N. California) `arn:aws:controltower:us-west-1::control/FJOMQPXJSNJQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/BOKFJHSIIIKG`

CT.ELASTICACHE.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.5	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RCTLXAMLCHXC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RTTOLXATLPII` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XAEPCUPNGCNO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PIUNMTKIFFJL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WINOGQJEEOVQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HMBLNJNCTDHZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JKIQQDHMBWJG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DCCIQJOHRVIE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZHSLHILXVOCO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IFMXFKFLEXKP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OGTAAYEZPUMA` Canada (Central) `arn:aws:controltower:ca-central-1::control/DJMUOJNRFWVF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LICKFADISXMU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IYCXHIMVNDRA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MNTKSMSTRMMF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FGZTNSLDXWCI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XKMBREUXJFVN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JFLVEMYTDYRU` Europe (London) `arn:aws:controltower:eu-west-2::control/DZXWKDHYDBNP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ATOCTJSQAZEO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HNFDCNZRXUCD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ECVLLKGJGEKO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UGTZTWBDXCPC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XJOBGXRAPGMF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SJSYMXZGBOAX` US East (Ohio) `arn:aws:controltower:us-east-2::control/VMDJUBBWADIG` US West (N. California) `arn:aws:controltower:us-west-1::control/JVJBKOOYKGQM` US West (Oregon) `arn:aws:controltower:us-west-2::control/JEJMEQFMTEBU`

CT.ELASTICACHE.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.6	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FGNJBRONGTOG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DZEWCFADZWCP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AVPOWAHSUBEB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RDYIPVICGWEI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VFZVDKOUURFD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LJWYGOMFTCTB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KEMJKNUAMINW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/INJGAMRVOAJQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WBJIXMOKJKNB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OMPFCRWUDYXW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FWQDEEYQANGN` Canada (Central) `arn:aws:controltower:ca-central-1::control/VATZKDSWZSOA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BTLRCFRMVAQP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MEJYWIYAMQME` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MCWTNZUDMXPM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BTIKMDWEMMBX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YPGRDMKVVDKS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HOAEBNBZXXMO` Europe (London) `arn:aws:controltower:eu-west-2::control/QCUPCDGPHTUR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CWHXTKAYAXVV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SYOAJQOBJNXH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AUXNYAYPGXCW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EMJLKUDJLHIJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XLKNECMRYIIX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FQLTUDZMHLVZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/QOMUCVTCNKUO` US West (N. California) `arn:aws:controltower:us-west-1::control/RNFHWESIBLOO` US West (Oregon) `arn:aws:controltower:us-west-2::control/NNZFDSJPKDBD`

CT.ELASTICACHE.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.7	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WLPSXAAIVLNT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QHAHUQDYIRIJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LZOPZBLREDVZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NUECFXEMFWTE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MJULTZFOIKMK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EAWBFGLUSNPY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EPMCDGUGOKVQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IWBQQXYWVQGA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HBXNCBGUQCBZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IQDCLULOMHIN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QMVTNDBFTCLC` Canada (Central) `arn:aws:controltower:ca-central-1::control/KBOVLCAXAJEC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FXUKOTDGOINU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SPTKJOPDXWGW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RXEUZUTYLSHW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MKLXFZCODZLQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YELOMVBVITOQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DLTKNKGPIGCN` Europe (London) `arn:aws:controltower:eu-west-2::control/FKXDPENTGVWA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ONHSUTRTTLUN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NWVNCXUTZDKC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JKVIXAUOMYKL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZZUFSTXONGBJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MKBEEQVXZQQV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GHMQDSHZXXZU` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZHDBZRDJKKGN` US West (N. California) `arn:aws:controltower:us-west-1::control/VTCDEGPDTFNK` US West (Oregon) `arn:aws:controltower:us-west-2::control/JESDZQANVQZE`

CT.ELASTICACHE.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICACHE.PR.8	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FKPWLJZCNTEZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OFKHTKWFFWHN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CWFPZBCVSCTD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MXNLNTIYGZQB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GSYRJTGIEWKZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ISMYPOJDEIGK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XAYDSZRNRDCW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FBPMVJXECTIZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VOUKNNRVZUZS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MATYZEIUCDIB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ULKFEDFJABHF` Canada (Central) `arn:aws:controltower:ca-central-1::control/OIUOCGOEQSKS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LUFBBRLHCJKH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TOZERUNNJSSO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BKTJNXQPCEHZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GAJHRSMSQIFV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RBRVWNFADPDD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SAZCOAQIRYWI` Europe (London) `arn:aws:controltower:eu-west-2::control/MTVWWFCXQEBP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GGMNNHMJSPCZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KRCVEOCTLGQH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XAFNVGPJFOQI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MGFNGGEMCGJC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PVPLKTLRTDOJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DJUCYGQVENZF` US East (Ohio) `arn:aws:controltower:us-east-2::control/DKAGZNZTYESP` US West (N. California) `arn:aws:controltower:us-west-1::control/CPIDGETTRKGF` US West (Oregon) `arn:aws:controltower:us-west-2::control/ORABWRKOWXNL`

CT.ELASTICBEANSTALK.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICBEANSTALK.PR.1	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DFPWBGXPAWXB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XOARMTAVRPGI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UPSVYOWFPEJI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BVOHDZJHEJIW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZITTOMDIEKYZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HDYHDDNUEOBS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MRWDNKOKEJVS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EARSTRSLZBZC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YHIWFCYQDARH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CFMVUMABXOQU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LCXDOOJWVVHA` Canada (Central) `arn:aws:controltower:ca-central-1::control/CIETIOVQWORV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HWOODCNIHCJI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OQCJAPPBIIOM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KIOXCGYZAMNP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EXRORZBILXWS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JFCEIPDXBFEQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HBXFJSXSUIMW` Europe (London) `arn:aws:controltower:eu-west-2::control/DIPFBSQQPDGJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WRZBLOAGJNMN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TFDUTDVRWWFJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JPIKQDYSVCAI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CXLWTIKPGOUD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CCZWODZDVSQP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TMNYCDENFCPB` US East (Ohio) `arn:aws:controltower:us-east-2::control/FHWOIKXTZJBA` US West (N. California) `arn:aws:controltower:us-west-1::control/DCSBCUPBYBBU` US West (Oregon) `arn:aws:controltower:us-west-2::control/OTYYYSZCPWOZ`

CT.ELASTICBEANSTALK.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICBEANSTALK.PR.2	NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FRRHEGTSOLMJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AORFBCGNCTRN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VPNEUQLIRQZW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VYCTCSCJQLYE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DNUGEFZVWZLI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QYIYEHUBOJKB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YQWDJDIGFTJI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YIGECEKFFPJW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UOCTRMADKUPW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UFUQHFPHRDMP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UFLZAXAQSXDA` Canada (Central) `arn:aws:controltower:ca-central-1::control/YYHZHDDXKKIA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NRXBKFAZGJEW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SAPBZQTPSCWW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CXIWQGADTQOW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JMINTMKZQZXS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FBQCCIQKUJYH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TXCPEMIATUZF` Europe (London) `arn:aws:controltower:eu-west-2::control/MVTLDACJZJSZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NJTALLLWVREW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WHOFJAIXCLYJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OHOIYXHVYJOK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZBRMIHMFZOKU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AHAMDQSHXPXQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CGCIUYTOZICW` US East (Ohio) `arn:aws:controltower:us-east-2::control/JPTNJBASRLLS` US West (N. California) `arn:aws:controltower:us-west-1::control/WEUXECSSLASH` US West (Oregon) `arn:aws:controltower:us-west-2::control/GFAFGVWBGLKH`

CT.ELASTICBEANSTALK.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICBEANSTALK.PR.3	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WJOMTUOCASVN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BZZGAALQHMGI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VDTCPKAYZEDK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DCJBGPHZTLJW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BIJTQZZCVCXN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CBTNCZSTVKEE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NSKZNAONQADX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SNTAZAYGYTDS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XPBHHEZZNQJS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DCNARSSNDLVD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JRRSPQBKXBIQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/VBLRFNOUJAIX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HTMOVEUJDAMG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LSNMTHBHSXBR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WWECPKUIJHFA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WQQMLOAYAPZQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RGYDIAKRWXNX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TMMCJHMKVLCL` Europe (London) `arn:aws:controltower:eu-west-2::control/YVBNGROYSIQY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GCSYGTPYPSLQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XFHOTKGPELEI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BQOPUWCEPYXY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QLMHISFBBRVH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NUBHZEECDULQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SEQKNDAZBENY` US East (Ohio) `arn:aws:controltower:us-east-2::control/SNODOXMTPKMM` US West (N. California) `arn:aws:controltower:us-west-1::control/TRVEHPGNRZJI` US West (Oregon) `arn:aws:controltower:us-west-2::control/MZZHBWZZVDYM`

CT.ELASTICFILESYSYSTEM.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICFILESYSYSTEM.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LBDEBBXUISHG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FEUCYWWTILFU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HARKDEIGPSTW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ASIKFXCZHAZV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GBVIFTEEMNCI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LJZEHFLGLFSO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MCSQEHQTIYWZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ERMQRACXWHLO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QECOJWZQHMJQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AUBCXBXVTKUT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CKKIPGIOQZLP` Canada (Central) `arn:aws:controltower:ca-central-1::control/JEMASGVKBRQF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CFDLJLDURJFV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YZVALCZXXASS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NZNHLALWUMET` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NHKFJAHAGYJS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JYAVIEWOCBTI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BHMRGDCOJVNB` Europe (London) `arn:aws:controltower:eu-west-2::control/MQVWCUIDHKMT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LWIUILOQALZA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ORYVBIYCBRXI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GEJNURXPVWRG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XRJYNTRNPOQG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YRAICDCVUJOI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DDRMDDRSTNIU` US East (Ohio) `arn:aws:controltower:us-east-2::control/GHUIRLEMFQOA` US West (N. California) `arn:aws:controltower:us-west-1::control/CPMXJILCQZPE` US West (Oregon) `arn:aws:controltower:us-west-2::control/DFNRDMHNGCYN`

CT.ELASTICFILESYSYSTEM.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICFILESYSYSTEM.PR.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SRJVTNOKSKYW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HJBQVLYNJRHH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OYKEDLNZHUMF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YNQIXFRNQWFS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BDDOBOTQFTPN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AKIXEAUEXTWQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ARFSNBUXZZKJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JVOHLVYUHCBK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VXMYEULBUKRK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NUHELTPITCRU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GVPGZWWQFCVZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/SMQITIAHFKPG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TTLCIBPZTALN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BMTJVPKUBGYH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SSHEKLSKMCES` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TLQPHMZPCKTX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KNBTHICPCZAG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EPULSMBTUMFD` Europe (London) `arn:aws:controltower:eu-west-2::control/MGIFGKQENSJD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GGDJKZWMHIKZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YEBOVYOVVRZZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XOSWEMHEKDUL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KZTIQYWBNAQH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FPUGNMHETPYB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AQYLHRCHTYFH` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZHNDMAPIBQBP` US West (N. California) `arn:aws:controltower:us-west-1::control/RNKDEXRBVOON` US West (Oregon) `arn:aws:controltower:us-west-2::control/VEZVVFVGGFDL`

CT.ELASTICFILESYSYSTEM.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICFILESYSYSTEM.PR.3	NIST 800-53 Rev 5 AC-6(10) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QKHCGUWAMJGM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LHFJTXLMREBC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SCENHYSBARYU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FJUCAMQRKDYC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OQUMNMODBGIR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RVTHUVTEDVMP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CWJPIEBEGENM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CPRQIRLLJJZR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FINCEVUKQTHU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RFSAQLSOMRWE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UOGIEQYUBVWF` Canada (Central) `arn:aws:controltower:ca-central-1::control/RSZNNHZMPHGQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TRQSLRYSYASX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VHHDSEWDXCTU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ETAFBHEUSISM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MEGMJYGDZACD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VLWKJNCQRHJV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NVRAHJAKGOWS` Europe (London) `arn:aws:controltower:eu-west-2::control/SBVGEBNOBEWL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VEDDJXMCKQCH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XORRIUNYWEZX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UCZRABGXCLJE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DYITJOJMOCRW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XPLGISTXYPWZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JVOEMQJALNEH` US East (Ohio) `arn:aws:controltower:us-east-2::control/BIBZKVASTJJI` US West (N. California) `arn:aws:controltower:us-west-1::control/IOLOGLDDEUGU` US West (Oregon) `arn:aws:controltower:us-west-2::control/LEXKWFEQKTOK`

CT.ELASTICFILESYSYSTEM.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICFILESYSYSTEM.PR.4	NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BQRKDWSQPQXA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JKBOCKTBFDMS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YSDPCITHZXQI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TRASMSLGPGVZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ERXWWUAEEFID` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XKQWNWPEIRFE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CVGTZDJTZLJI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JBBLWRTYSJII` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/THCBRFJBEVKS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TMVUNWZICUTH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CGNKJZRYHIZJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/AKFECGTIWOJZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HILXUYLMFYBM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XJJFNWYXGEYG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ULQOLKQFXXGO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CUCXNNWYPFJG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EKLTMHHIMJYR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GNOPUCJTOMMM` Europe (London) `arn:aws:controltower:eu-west-2::control/NLNHKPUQRYEU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TOVQIXNDQMXW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LLDNCKCAOXDK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QFIMBHVNTCRP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RBIBSBEJGZCG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HIFLGMRIOCCZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SOCNUAYXONKJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/BWCBIWTTHMBA` US West (N. California) `arn:aws:controltower:us-west-1::control/VMFHHQOZIPJT` US West (Oregon) `arn:aws:controltower:us-west-2::control/WTQPSFJEQBEE`

CT.ELASTICLOADBALANCING.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.1	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-13(5) NIST 800-53 Rev 5 SI-7(6) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WAKLGKTPRGMM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CTXVLAEDJDLJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MAVNERRCDGUI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SOSAAOOKSDIQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MYHWFMEYVGPL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KDCYLSTBLDFE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AQBRQHVHBKKB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NKNJBLFCPCGJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JWBLMBPMKKDD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AXMNAMRZWUHT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BKPDDVHNQLIZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/GYIRQYZQGXOJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TFIXKKSMTKDE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OJZJAEVLVQGT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UKHAMPPHXYFV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CKLWEMXBFSKT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OLSPLUFATRIH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HGMLJLFKUCFW` Europe (London) `arn:aws:controltower:eu-west-2::control/VXIGTPWOJKYZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FBDACBTEASNT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CYGZKWHILPSU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ETLUXEGWKVDH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KBWQZTALIDXV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ODIENAEBQZJM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RZVUTRWTVEUO` US East (Ohio) `arn:aws:controltower:us-east-2::control/XMIEWIVADWDV` US West (N. California) `arn:aws:controltower:us-west-1::control/LEZQMKJXCKRI` US West (Oregon) `arn:aws:controltower:us-west-2::control/BLNOUTJZPLAD`

CT.ELASTICLOADBALANCING.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.10	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YXPXYZWDCGBW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QRJNDNXHWVFN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PBOVNVABHNQW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DIAQAVDUUBSL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MTFUXDNBVIJO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TWJWYQMUZOHV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EFCETYXCCSXQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/STTSKRCGXNOD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BARRVADARLXA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CFXSCVNJURIC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ADHRMNATNDFH` Canada (Central) `arn:aws:controltower:ca-central-1::control/CWGCUTVHELNV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JBPMUDNREFNU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YJRVUXKIUKOK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BYRDSECDQQJP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QBJQWLUTLLXE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZYFULHCEJDYU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VMAQQDYRDSVL` Europe (London) `arn:aws:controltower:eu-west-2::control/PRRDNZJAOLXC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LUVNYZMNOBRU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XSCNLFTCFZKX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HXXFEOBOXYYT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YPFRBCBHBRCT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XBYLAEZTWIQM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HUFENJFLXLUB` US East (Ohio) `arn:aws:controltower:us-east-2::control/LAZXTTJXNZWX` US West (N. California) `arn:aws:controltower:us-west-1::control/VUWZZZGVLHAD` US West (Oregon) `arn:aws:controltower:us-west-2::control/MUNVWQKVNFII`

CT.ELASTICLOADBALANCING.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.11	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BGRUSJXRHMLT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YBRAEMTMLLQO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SMFWPJQCLTTI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HPMPEDWYSHTQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/USVNDLDKAFXE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AMQCTRGHKRTZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JHZCKZSJBDKV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GXOFHFAWFNOD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RFHZPJREXLSE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YBEQEHQUOIBL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZGXGCIGJHYHQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/VGCEFHSLONXT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JQXOGQBYFKFU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PPIGURFCAKXK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TWBYWMNBMPNY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XFJZOLZQSMDV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZGIQCDYVMSJS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OTFLWYTQQQUC` Europe (London) `arn:aws:controltower:eu-west-2::control/LCLXRADMQQGH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TIEXXSPKPJBM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OPKDJCIXNJSZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CLHTLGNOWYCI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JAVEJPSXISVP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VXULPCMAXNLF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/INJPMXMBQMRQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/DOVONHQVOITW` US West (N. California) `arn:aws:controltower:us-west-1::control/ALIDOHBHLSDW` US West (Oregon) `arn:aws:controltower:us-west-2::control/YEHZWEMPWSWH`

CT.ELASTICLOADBALANCING.PR.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.12	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VUSTFQGUNEMP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UDCLCJOOJKFE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EWSEAKUVMBGZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CCBEBBTRLFTN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NSGUUZCKLJMS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JICDLDNZKCWO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CSEUEGCZREOY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CXHKQIPMPPOR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OLUIOTBVOOCS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ASSEXCKVIKWR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LMBAWXBHTSZN` Canada (Central) `arn:aws:controltower:ca-central-1::control/RZQGPORFMUYS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DFPIFORHUVAL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QXAQEWRORJAG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PPZGFKMGRMNY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SNQRKWNNHROR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VYRQOKMPUKEB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZSEFDTLWVOAK` Europe (London) `arn:aws:controltower:eu-west-2::control/JOEBOYAVBHVM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IXOEZMSDXZWD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VYZZGJPFTEIH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XKYXDMSPCZYZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LWBRONIIXUIV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KALMFRNXCPDH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WWSARQYKGSTH` US East (Ohio) `arn:aws:controltower:us-east-2::control/XRLOSBAPFQJX` US West (N. California) `arn:aws:controltower:us-west-1::control/WOMICOLFRYLF` US West (Oregon) `arn:aws:controltower:us-west-2::control/UBFDEGMVDXNI`

CT.ELASTICLOADBALANCING.PR.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.13	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DKSVEZCCPUAO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XNMLHOXTXTYZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KOHVKYUFPXUZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YAKLMULFRDKX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ITCUUSRTKCQP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LHLSDALYHRNL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HFJUUUOGTEPO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WQMJLMPNJRHT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VDPRZIODKYSS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OOROGRUVAYIT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XBBFJWWSALQZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/SHNYFGRZOKNR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PDRQZUMHBWIZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CMQQXVFUWSBZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MXZLYVQILODC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ORVXQIODQZQI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UJHZJDJVEEAZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DWLXBJDQNJFH` Europe (London) `arn:aws:controltower:eu-west-2::control/IEHVGTUSGXGN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GQXWFKUIIYZA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SBLOYCOKSOLC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PBNYGWSPZMDU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VEJXGZNVVZTH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QZHVAVUVBIYQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YYKNHLJGCTZX` US East (Ohio) `arn:aws:controltower:us-east-2::control/ARGINPIXWOQF` US West (N. California) `arn:aws:controltower:us-west-1::control/QDFVSDJSXUNH` US West (Oregon) `arn:aws:controltower:us-west-2::control/ELKXDUVDUCCS`

CT.ELASTICLOADBALANCING.PR.14

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.14	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve resiliency Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NVGZYXILIZLG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LICKEJRYNWTG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KOYYTIUQCFMH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ASEAWQQCERPP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OBHPNWYXELNI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ORKESKWXKFSA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NYLPBEXSGGOW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WMUYGBVGKEVD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RIBTDOHHYUML` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AKZIMZMBHXPK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RADMLMBACOBH` Canada (Central) `arn:aws:controltower:ca-central-1::control/MEFQWCBROONN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MHMICTUWLSON` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SWBFYNAEJPIC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DMQFZJQBAOKW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/REZXCUMITGVU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZVFSRQSYLGXW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WBPOTYBSJLHO` Europe (London) `arn:aws:controltower:eu-west-2::control/NBZVVROENITM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZTOHLMITRHNV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KJCEDHGDVDGV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YGLOIDIHZXEX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DZKOPKXFHNZV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TDECASRAMXGX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VCZFJEAUAWLN` US East (Ohio) `arn:aws:controltower:us-east-2::control/JLZRGIKJAFUW` US West (N. California) `arn:aws:controltower:us-west-1::control/PZTKTHNHYEPU` US West (Oregon) `arn:aws:controltower:us-west-2::control/JAZZWGOBQBZO`

CT.ELASTICLOADBALANCING.PR.15

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.15	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RLHXGPMICHHC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DBLEVFJHLDWB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NCOYGDOCXNGL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QWLTOTPYPBRS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TRVJVOOTGFUQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SFHSNOQTUAHQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IDWCAEQUETLC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RTXCNGWMADBT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WAIVIZIPAGHI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZALYTABUTANC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IISQUFQMIRPH` Canada (Central) `arn:aws:controltower:ca-central-1::control/SFJRXHPEEWFA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NKWJJBUZINNH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZPDHWKNUOHSG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ITVPCOCJZHLR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OCYADTLKTJSO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HASOTQTPCQQB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FGLPHBUZPHIK` Europe (London) `arn:aws:controltower:eu-west-2::control/CLRMSTTALUWI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RQYJFNYNJJUS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OUFVPYRGHTCQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QVHGAYXKBWBE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TRHKGDFOGIQJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YSPLCVCNCDBH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ESMQBBSNPPBL` US East (Ohio) `arn:aws:controltower:us-east-2::control/DWNVOOZNWBZK` US West (N. California) `arn:aws:controltower:us-west-1::control/QNQCBDIMDQUG` US West (Oregon) `arn:aws:controltower:us-west-2::control/OCMRIQBWUSBU`

CT.ELASTICLOADBALANCING.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.2	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-23(5) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OGBTHHEOFJIM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TIKCAYPVLEWI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TNEWNBTNWBOX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NZJCESRAUAKF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YGNXDTEMUSTJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YSAHARNPJCBU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BJCGMXBUQOAS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IBOADPMIQPQQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OPRFIUYZWTCD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FTFRBHJUCHHK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BVFELBGGGJLE` Canada (Central) `arn:aws:controltower:ca-central-1::control/UQPWYSTFWPNX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QGSARYANMWYN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UEYBKXZRGQHS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WIFXFDAZYLAY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TCIAXDVBEICZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IDEVSZEMXXFJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UXJGSEXNOJMU` Europe (London) `arn:aws:controltower:eu-west-2::control/SYMCEHDRDWZX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KZUEDDHYPJAE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WIBUNBPUTHSS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/APWNTETPZCJN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XSAGNUBELYFF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OGNHJFZTHGDA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TWNOUSHMRFWV` US East (Ohio) `arn:aws:controltower:us-east-2::control/XDTTHNUPIHNG` US West (N. California) `arn:aws:controltower:us-west-1::control/HVJNQRHYMBMZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/KPAIALQFVPZD`

CT.ELASTICLOADBALANCING.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.3	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.3 PCI DSS version 3.2.1 6.6	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XFLHCLMJQKNO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CUUDWQGUOMWE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SLYLLBVCPSQB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DZKUXADKBLKO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IYJMHGRXOFTX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UQNSEXWGOAVI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VREWVBQOGOTC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OHOVDEGRDBJY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DTFRJDGWCDVJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BMTMYGWWKGRP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CLBAVIDGQFBI` Canada (Central) `arn:aws:controltower:ca-central-1::control/BLKONTFMJJIM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EBWHWDARURZT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NEOGTBSZEGPQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VMKVMHBXXJXT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OIGJSCKAHJKA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DJOQXYBXRKYD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EDDMFEEESKTR` Europe (London) `arn:aws:controltower:eu-west-2::control/GYLTSXUFSDYJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QRQEUQSJGTQX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WVSNMECYMGBR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ISQZGGMSAPQF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RQNXMRRGGNRC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/INCJOOCTGBSW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VLCKSWJHUUNN` US East (Ohio) `arn:aws:controltower:us-east-2::control/WORKYXIAEEPY` US West (N. California) `arn:aws:controltower:us-west-1::control/RTMVFSWFTQBU` US West (Oregon) `arn:aws:controltower:us-west-2::control/RQXEJKEEBAQR`

CT.ELASTICLOADBALANCING.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.4	NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WDLCZEENWASP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZHTQABLCBMIJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WJEXQWQTKVUN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GMFGDGANQPXL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LSUGITKOSTLF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YXLUVVLYBOMP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GCBLJGHGUUXA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GGMITQUCXRSC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/REBMKCJKOTPA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JLDJRXDZHOCS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MVEJSUXZWCOY` Canada (Central) `arn:aws:controltower:ca-central-1::control/GPGUBQHOYWEA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AHYTFKBZPPNU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TIOETKTMTPUM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HCRXAYUXHXVH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GFUUYAYTPGJL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XVSQHWPOKDLH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/STVTFNNQGFNC` Europe (London) `arn:aws:controltower:eu-west-2::control/TNPIGOQDBEEP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AIVQIYPFVIVA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PDPKRTBURTGG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YMHGHVLFLBBD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YIOIHKYEOXLP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MRCIZCRRAIWL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZVVUGGRKPSNF` US East (Ohio) `arn:aws:controltower:us-east-2::control/GIZOETCRSJGJ` US West (N. California) `arn:aws:controltower:us-west-1::control/UOOYGDJUCEQK` US West (Oregon) `arn:aws:controltower:us-west-2::control/CZGWNMZGUQQG`

CT.ELASTICLOADBALANCING.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.5	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VDOGNTMSUMJG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KLKOLHYUIDKN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JGGUSYGAQEZO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KZPLSIUXHZLU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/REBZVFIVNNZM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NFDTXLIHKABM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KGLLBSPUFJRB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FCBAHAOWAPAG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RNHSNSUAJPAV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PFRMCVVXGCWD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UQJJGFUCDAAL` Canada (Central) `arn:aws:controltower:ca-central-1::control/LZTVNXQBDIDF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LWERVUDADSHP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OUFZBMCIXKSJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TQLTEQMJSACM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HCWIFNJECKZG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EXMPAQITTJVG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HZMWWCHIOPKU` Europe (London) `arn:aws:controltower:eu-west-2::control/CZOZUMCNAXGV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VZJKBZOLBBES` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OQZOZFAIJIDM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DOKSFRMQXWOQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BZCWGRLNALJK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YEXUASWESFBT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XZMJRFQFABFQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/DEDMSNGUSHRU` US West (N. California) `arn:aws:controltower:us-west-1::control/XCFEFIVKEHSY` US West (Oregon) `arn:aws:controltower:us-west-2::control/VMTTTZPRYKXJ`

CT.ELASTICLOADBALANCING.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.6	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LNOAJYUTFFUA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DISFRWVXQRSD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JFIXYOKMRPDZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YQZXXONRYIQK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LHRLWVZAGTIE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FKDCIAVBHALD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NVNLWPUSGHDZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UFTGHAICJBKE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TGXQXNZCCEXR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BCCTQMAXUQOP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IJCGBGKQJXLJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UHSFKNBKXDLE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CXXFUAKPJAFC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IYMNAKMMHPCR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JOHHSDGRJVXT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MRIJZHYGXLTS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YEQCNYPDRFTF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TIGGQHUXHQKW` Europe (London) `arn:aws:controltower:eu-west-2::control/PQECPEVQHHKU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AOXHNCAFXEQZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VYKHSDTEISAB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EECNYLBXKCCV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MQNFQYDACIXF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JTVCDERKCQMB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ACYJDQTSIBRW` US East (Ohio) `arn:aws:controltower:us-east-2::control/FJIEEFHBKMEI` US West (N. California) `arn:aws:controltower:us-west-1::control/IASBZFRYDKTB` US West (Oregon) `arn:aws:controltower:us-west-2::control/KBBOQEOOHYIT`

CT.ELASTICLOADBALANCING.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.7	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CRFNOALWZKJX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JGNRBPRFUJHZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ERFOIJBAKGVW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PNSQXKURZAOO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KEPKXDEDCABZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RSTFVKGDFFVP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KBGGLDWQNUTK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OETUGRLWDUUA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FSRKKRIKNTVD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/INBVXUZPITIY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WPUGUNCMUAKS` Canada (Central) `arn:aws:controltower:ca-central-1::control/RXBCLXMNDYLS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IAJRQALUGLVC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UVVSUVYGXHVB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UNYSAQENBDWH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UVRGEPYISQSR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ERKLVPLKNZVI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PMUEIFETYEVE` Europe (London) `arn:aws:controltower:eu-west-2::control/SEDMCNWATELI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VANTXKGTYIFB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DEAHVSFUVIDI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CRXNJTUUJIOP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DWNCGPHANJWW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YJOPKSHLSHDU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CWXBBUJAKHIY` US East (Ohio) `arn:aws:controltower:us-east-2::control/JQWTMKADKIQM` US West (N. California) `arn:aws:controltower:us-west-1::control/NIYWWGCEVFEP` US West (Oregon) `arn:aws:controltower:us-west-2::control/KRJHNIMJOUVI`

CT.ELASTICLOADBALANCING.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.8	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(5) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TLBPPGCCHPWD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TUAETWCFNPHP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TUPOKAOWCEWX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AEQVLTGJCUVY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QYYUHUZOKXSI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JDAAURPDZMOS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KJLVWZWYXECE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QKOIJAUPECRW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NHXVNOSXDCMQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HLJOXOYOQRWO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JLJILSWJBAWD` Canada (Central) `arn:aws:controltower:ca-central-1::control/HDUQIRHQJHIB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PJGYHTTIKRFD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HCENLRGKUPQG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QBKEGNQIMOWD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BIWEKWOJFQPY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GNGTFFXVJZOQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NSQJFFBDYFJE` Europe (London) `arn:aws:controltower:eu-west-2::control/HQHFHTSBARTW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CRJEOQPBHUYN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XPTUPNEMJDRJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EISTKDGVFVYA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SSKNKDBUWGWG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EEDDEBDDSZHT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OQYKDUWYEOIM` US East (Ohio) `arn:aws:controltower:us-east-2::control/NYJAEPPDXSFP` US West (N. California) `arn:aws:controltower:us-west-1::control/LXKUWICNDPUQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/HDFFHQGMCHAT`

CT.ELASTICLOADBALANCING.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.ELASTICLOADBALANCING.PR.9	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XFQFMXGYKBNP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DLTVTIXROSGT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GKAFFTUBEDGA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LYLRCNQCPNJV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CTMACEMAYWWP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RGANYVCMWFZG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TRLOIHFYIRMI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ONUHDZQBRTPI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XCEABSKXHNEW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FAKSKCVVLGLZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LFVOMXNGCJAX` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZFDYEMUBADTU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EWMJJYUDXREQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XKGBOMUJJQHT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/STGPISYTFYUO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IZWNTXSZPIHY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AMSZOJWMYMVA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WQWNYGWHUHDW` Europe (London) `arn:aws:controltower:eu-west-2::control/VEQTOWINFEKD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TEDBEMVAAJTO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KDVMCUOKDUDK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MZHSLHDOAIME` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XOVPGDIDQDPA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QQZDUTOOGNKG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OJRPUPOEBOGC` US East (Ohio) `arn:aws:controltower:us-east-2::control/BZAIVZYIGBEA` US West (N. California) `arn:aws:controltower:us-west-1::control/BKNZWUBNRNKF` US West (Oregon) `arn:aws:controltower:us-west-2::control/DYNNAOSHIGUA`

CT.EMR.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EMR.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SAPJRYDGPIJG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MBPQYGMWWWUN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CTSXXPDCUEDR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ESGKLHSPODEY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OMAMQJBXCRMU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TVAYHGQUXLPE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LMBWEFMCQIYN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KSGLCSMAEEDA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TFCTANMLNGMR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HGZIJECVJGDL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FBOBOZDTKTRB` Canada (Central) `arn:aws:controltower:ca-central-1::control/INXDKMEOBTFF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MMPGMIGAJQON` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/APMARIGMLCIH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QSKWRYDHXVED` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RJOLQVEUFPWX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HJIMSQRPTZSY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TWSLMQLEOHKS` Europe (London) `arn:aws:controltower:eu-west-2::control/KEGOEDVBGLRF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KTMOCNTSAXOL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SFFDXBDLASOK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ASFOABAEKFKU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BPFAHEYTAYOS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GZCNFBZSQDOQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CGKQCHLVDEIB` US East (Ohio) `arn:aws:controltower:us-east-2::control/YHCUCJSGQFXA` US West (N. California) `arn:aws:controltower:us-west-1::control/UFVDCAJPRVWU` US West (Oregon) `arn:aws:controltower:us-west-2::control/IVSACGXVHRSR`

CT.EMR.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EMR.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MNUYLLRYYTHP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QHFQNHUAJJOS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DDJLGXQNVUUQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NXJYKOBPZCEF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EBFHBZHPBGVB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PHHKZGEWDAZK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FHSOUOJENGFW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PFAXXMHSTOJG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CHDEFRBDBNLC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PIXVJDFYLEEK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EVBCOKHITCAO` Canada (Central) `arn:aws:controltower:ca-central-1::control/QSNQBMVQIOGP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SHPWLBFPMVXD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NVJSHTXUXIJY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VWUFOFVIPEUJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WSQGBUDGZQBD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DANDKACRGHEN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SFHGSRUHYWUR` Europe (London) `arn:aws:controltower:eu-west-2::control/YWOIDYYXVQKE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OPAFIWVUBIIF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JDVJIYRFXULB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JLKIPCOHILYC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FBIJDMIEXCOG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WFNNKLCKRXJE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RBBMAHVKFUYB` US East (Ohio) `arn:aws:controltower:us-east-2::control/UNMATKWGXVEF` US West (N. California) `arn:aws:controltower:us-west-1::control/NPCHIRMOYBBA` US West (Oregon) `arn:aws:controltower:us-west-2::control/TRYHGCGPXQBY`

CT.EMR.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EMR.PR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MVGLRQDIGVKY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QYNTMPMVILFC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PRNNBEUWYTVA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YIITTJQXIPJH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LVBHIHYUITGH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XSTLMPKVVTZP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZESTQVQPLBXW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LJLBKOOJFQZD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PMKIZZXISXGC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GMWRRLUZJKUV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ILISLOWKJIHG` Canada (Central) `arn:aws:controltower:ca-central-1::control/UDKRPGZVFDUE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NUJINJJLQOUN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LIIGCIMSQFLT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OCDDXWMLCWVT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IEISUVEELSRQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GSHIJXLKAMTB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JAHQGPNBHEJI` Europe (London) `arn:aws:controltower:eu-west-2::control/UPFHHKEZYOCC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QVNKNUJGSZID` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CZOVNGPORAHT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BULABYCCCTTY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XGSFHGJQLJUV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SIAVBUUYLWBK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QNPZCJDNGGSI` US East (Ohio) `arn:aws:controltower:us-east-2::control/PILEMYYHTDXA` US West (N. California) `arn:aws:controltower:us-west-1::control/PBZZRBLAUHUO` US West (Oregon) `arn:aws:controltower:us-west-2::control/UDEMBGIGVWRQ`

CT.EMR.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.EMR.PR.4	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WHAGYFSPKXKE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UHPYOGSODQAI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ISRNTOKYVYFL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RDHYEEFAEUMS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VSIOOCSNCCXV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HIZUGNMVVFIV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PRXVTLEHHJRV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IPWAJHVDZLKX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YLGTYOLGXBHH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NWZAQBRTRVWQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GYJLBWGSDIEW` Canada (Central) `arn:aws:controltower:ca-central-1::control/PBXJBZPNELGX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JCKGMJOAJMOP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GUVJOBDBOIBJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OMIMVRHODCMR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GKMOMEBKHZEL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LXJWHUCUNCCF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TETBYMUVVMCK` Europe (London) `arn:aws:controltower:eu-west-2::control/NGFBINLXWMZV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TQDRKJOSTGFE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NHRUSBNKRQBU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XVYHZAEAOUWJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YXZUTBJKJKAI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IWHTELJEWCQS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VKFEQPOWCEQO` US East (Ohio) `arn:aws:controltower:us-east-2::control/EHLZOFIPQELW` US West (N. California) `arn:aws:controltower:us-west-1::control/CRNDYYYDDGZL` US West (Oregon) `arn:aws:controltower:us-west-2::control/GFUOQRPWOJQO`

CT.GLUE.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.GLUE.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JWHFWNFLFRPL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SVYDUSNGTBAO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LZYUTOYMDJEV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FJGIMXRXTUMO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IOYSTBILSAIQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TLZNZDRMXYUD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZNLHBHLAORXT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QQFWDELOYZHJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UETCETTAWIFA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OYFSLJFWANFX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VGEVDHSNVCJN` Canada (Central) `arn:aws:controltower:ca-central-1::control/IEKSUNOKGWLL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZABAPQCMENQX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TTOQOWVNSWRP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LIJZZPPMXINO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FTVODADNCSVE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WQYRTWUZXQCT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GFTITBQSMXZN` Europe (London) `arn:aws:controltower:eu-west-2::control/PADEKLSUDPRA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ULXVMADMBHBW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HTWMRRWAZSHO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PJXYGBKLGVYV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YZYJEVMGPLPZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TLFCNIUBKRAX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WPCRZFUMPUYK` US East (Ohio) `arn:aws:controltower:us-east-2::control/TCWRJOJCLVFQ` US West (N. California) `arn:aws:controltower:us-west-1::control/TTFHKBNXUHRD` US West (Oregon) `arn:aws:controltower:us-west-2::control/SKMTAZQLOSYY`

CT.GUARDDUTY.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.GUARDDUTY.PR.1	NIST 800-53 Rev 5 AC-2(12) NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 RA-3(4) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(13) NIST 800-53 Rev 5 SI-4(2) NIST 800-53 Rev 5 SI-4(4) PCI DSS version 3.2.1 11.4	Protect configurations Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MHNKSDEFFGQL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KUKBAIDPCVEP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SPIMIVFZLKGT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KWNBRWJUUAAK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GATXICTOAKVM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CGJWZYIKSAKC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ONTROZVBXCSH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YTVHWKKJNVVZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CELIJOZUYTCC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OQXJTSRQRSIC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LGYHSJSSFITW` Canada (Central) `arn:aws:controltower:ca-central-1::control/ETRMJIXAELLB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HFQIQZNQEDBF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NVFWCUDSLMOC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WTYFKSYNHCOE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LUCAAVDCOXYJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GLDWZTWHCYIT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QBUMAVYUUWFG` Europe (London) `arn:aws:controltower:eu-west-2::control/EZEFIVKLTUWW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YGKBDKCNXMAS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LZFSULLYFCJZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UEEPBLZVYHWN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BBFSRHLQVQLM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BUDEACEBNFPS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HDYIPPMSWZOU` US East (Ohio) `arn:aws:controltower:us-east-2::control/PYNXRWWBWDCV` US West (N. California) `arn:aws:controltower:us-west-1::control/XGBAGKSFTLVU` US West (Oregon) `arn:aws:controltower:us-west-2::control/AAEWPLCHTLBT`

CT.IAM.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.IAM.PR.1	CIS AWS Benchmark 1.4 1.16 NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NVNHMAJPWYQS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LJCRLJPOVCTC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AZWOFYWOCYFD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AHDCTTXNKGUM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZHHFEZIYPBJK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UTUYMAXJRGID` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VFMZIMKRMWCN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JOYWUUKESSYI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OHTNYZERSTJL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ENDGXUBAFXAJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PULITXEDKEZN` Canada (Central) `arn:aws:controltower:ca-central-1::control/XSODKGTQFXRF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VLBUBGROVKQD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WTZXOEUOAWTJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/STCTJILZFUDN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ETMDQOKWHREI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KKZVOFXRSYJV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OVZGSDCWZLCD` Europe (London) `arn:aws:controltower:eu-west-2::control/GXTMGHVRNDOR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WNQGLXPXUGQT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DZOVLGFMXMIO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RELKEYQVEVJW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WBZTGDFVZTCA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PJBVRJXEOSUF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JMBMAKMUHMKC` US East (Ohio) `arn:aws:controltower:us-east-2::control/VRYGYLBERJDX` US West (N. California) `arn:aws:controltower:us-west-1::control/RKJORUGWSXPC` US West (Oregon) `arn:aws:controltower:us-west-2::control/IEYHGQBFVLSK`

CT.IAM.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.IAM.PR.2	CIS AWS Benchmark 1.4 1.16 NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JQIIUMMBPORM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CPYTOUZUVOMY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HOCOFZGQHTGD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TRWCETXWEOUE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ROHDZMYMPCUO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FEBWNSMFEJIB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YBDTHCCPRLHG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YHMPKYKTCUML` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CAOCWBICFGOB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QJIWSLSIUGXF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HDJTIJYVJZNH` Canada (Central) `arn:aws:controltower:ca-central-1::control/HOKZEQYPEYHL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BVIKMVRHDDMG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SVNXRAXOWYPD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NFGGERHBCZUW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JIBSKFGZPWYZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OZIYLNCGRZXK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ARQSBKHBXQCM` Europe (London) `arn:aws:controltower:eu-west-2::control/ALIYKFTXVNCS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RAYNNMFDYEVC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RFWVZWSWOITC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FDOELRUSKFQZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QQQRCQIQWLSU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RSEEMCFURKTU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PNOCTMYIRAQZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/FOZZURSEEIOC` US West (N. California) `arn:aws:controltower:us-west-1::control/OGSIRAALHWTG` US West (Oregon) `arn:aws:controltower:us-west-2::control/JMOGYFIPAVJA`

CT.IAM.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.IAM.PR.3	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XIIAJQQEISQW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ORPNELRUOFKT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BHIAWWIKNMSH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SEDWSBCCUPUR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CJWYUKYSXKUP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UJVQWOKLAPOA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LSOKRAEVKVHM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RBKJFTDCPGHB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DIYAWISHCSUP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ILMQSXXDTGIW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RLBVVZELHWHT` Canada (Central) `arn:aws:controltower:ca-central-1::control/UVQFBXEVKVGX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IRQIMXUAHHNQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NDAJBJGDIUAH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YAYMMPOICSWS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SRCNCCOVAKTW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HYIHRSXDNOGB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GDTCMKSZZJPE` Europe (London) `arn:aws:controltower:eu-west-2::control/DXWZZJDXVQJB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CXLKIUGCJVBV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FYLKPJZTYMRN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OBJIKKDCCRGV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MBZAIFOCGKFG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YGJVNUUQETCS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XJWBVKPDALLC` US East (Ohio) `arn:aws:controltower:us-east-2::control/UFUIAVAHEMXT` US West (N. California) `arn:aws:controltower:us-west-1::control/RJAICXMTHQFY` US West (Oregon) `arn:aws:controltower:us-west-2::control/TQOQTVTFKYZP`

CT.IAM.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.IAM.PR.4	CIS AWS Benchmark 1.4 1.15 NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CMHCTVLGOAZB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UFHNHLRVIPSM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZTOGOILBNLVZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VPFGSMFPNEDX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SXUORJZQKEPJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CBIVZXRPUAXJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JMWLMQKSOWRB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YXXSRJWMGBGN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NIQNDDIAPPYT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GQDQANYGJAPI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SKIIBUQDKMNX` Canada (Central) `arn:aws:controltower:ca-central-1::control/UEHHSMOZOLIQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ALGNWNDJOHGJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JGDUWOAAFNAN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EYJVADFYATUK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CNVGXHJPQJVE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EHMJZNHWSSNR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HTVEKDWTRMZF` Europe (London) `arn:aws:controltower:eu-west-2::control/KNLJBTRBNYOO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PAUXSALAWTJL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZGSPZACAZKYK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NSSGQMATGMLT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WEIKDIOJBGFU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ESBOQQWFAIJM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BGEGSPWZQGHE` US East (Ohio) `arn:aws:controltower:us-east-2::control/WDSXAJOAVHZA` US West (N. California) `arn:aws:controltower:us-west-1::control/ZCDLCRVFCOTU` US West (Oregon) `arn:aws:controltower:us-west-2::control/XGWPMANHZWZI`

CT.IAM.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.IAM.PR.5	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PYKMSTZYYDBO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IZTCZMFKNCZO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ISCNDUFSMEVM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BXCZTLODJIFG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DOVTCMZPYCON` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JZHXBIKWJJLL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QYFJQEFKXMAE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LZSJWCBDNBCK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PSTEFAEBICWJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HVFUXHSOQXPB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QJVBMTNZMYMH` Canada (Central) `arn:aws:controltower:ca-central-1::control/CXYDXHZWZNXX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NSLUIOJZYNZS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BJKADRCUNYDC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WYOBTTMTGXJG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MISFEMWXCCGG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BGGCAVAUWZNZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IHTJEPIWSWWF` Europe (London) `arn:aws:controltower:eu-west-2::control/TKRBPZKLXSOB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PRBDWMNDXLJU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HGSDAZCXXKQF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XXSXDFHCGMET` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JXNXTZPYOKLI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SUVBXVFLNFMS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CCMOVWIXYLYF` US East (Ohio) `arn:aws:controltower:us-east-2::control/ONHYGFQYMLZS` US West (N. California) `arn:aws:controltower:us-west-1::control/AUPBSLCCXOKW` US West (Oregon) `arn:aws:controltower:us-west-2::control/MCGPCOIVNQGM`

CT.KINESIS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KINESIS.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KIPNHGILDQWA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CPXPGDDIBIQV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/STVPVNWMIFLX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CCUPDGNBQPGW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CXQVUZQZUGDS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QEXYSDBEGDVZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NYCMWPOJWLVZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VPOCRYMNFLHQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KREYISSWDIIL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PSNLRYLRRYHN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MNNUBYJOZSSI` Canada (Central) `arn:aws:controltower:ca-central-1::control/GJHIYBNFTIXA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XCIGQSTRVFAR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MWRDFWNGLTZR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IMXQJNMZJZAO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IJPNWGFQMFNR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OYCWERWIIYAE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TCPBIRILCAQQ` Europe (London) `arn:aws:controltower:eu-west-2::control/CODJWYQCXOXV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YANNDPDJPDKT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HSTFUNSHQGEJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VOYLIBFBKLUN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DASBBTCYBUOF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XRDFTFPDNALI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HUIOKNICCRBB` US East (Ohio) `arn:aws:controltower:us-east-2::control/ULXLVVUVXLRR` US West (N. California) `arn:aws:controltower:us-west-1::control/IQSVGYPCMIQQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/KHBDMVKHOBTL`

CT.KMS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PR.1	CIS AWS Benchmark 1.4 3.8 NIST 800-53 Rev 5 SC-12 NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-28(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.6.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NTIKMXFYUJCH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RBOOWYIGHTIP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KBUBBEPRVJVA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FSQBJXDJBZVU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RWZMAUHNERFS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XHSHCFZKRKSK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DNSQMERTUTYL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FZQEVKYAAZWT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KZDJWGKCNWVI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TLIKROYMIVQB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GSGZPJGXAWVS` Canada (Central) `arn:aws:controltower:ca-central-1::control/TDLOCMNRYDEW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JKUXPIAYFKSK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CSEQKCWKHJUU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YVFYIEHQZEWW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IQJLHCNTBZQA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NRBBZHZCNZIO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VHIEQHFPSHXY` Europe (London) `arn:aws:controltower:eu-west-2::control/DEPFJLBPJFHZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AOQXVQUAUJRV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LKJHKSFLIYWN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OVBQLZJGMNSJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZZCIURLITMQF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SROYFMNTJWNJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VULBAJMYDWHA` US East (Ohio) `arn:aws:controltower:us-east-2::control/JDPLYYQWRCOA` US West (N. California) `arn:aws:controltower:us-west-1::control/QZRDNMPHLQSS` US West (Oregon) `arn:aws:controltower:us-west-2::control/IJHOOMRUOCFD`

CT.KMS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PR.2	NIST 800-53 Rev 5 CM-8 NIST 800-53 Rev 5 SC-13 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UWOYYBYLAJQS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JKLJQLGQGVPY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OWTLNREXRIMN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HANQYUPDQHSI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MYGXAKQZZKAU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IQOKDDFQVULP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RIKLHWLBSCOP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CWZNIGTYZZAG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NBBUFFKZOIWG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KVIRUTURJNHT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VIADYMCEWUAQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UTUHYVIWSZJG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BSVBULVSURII` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ADCWXSHRSAWJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GKRBFPIQRMTC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IOUXAVZFJDAK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DICUTESJCXRB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SGDBXEOLRRUY` Europe (London) `arn:aws:controltower:eu-west-2::control/BICLJDRGFNKI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QASOHPDRFTMQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TYGLPCXHNFSC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CSXMSFJQHGCY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RMEBEBCQJNGW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/REZTDFNCTEQQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IIDRQWFYOWSP` US East (Ohio) `arn:aws:controltower:us-east-2::control/HNCWLRMVGELD` US West (N. California) `arn:aws:controltower:us-west-1::control/IRNOVPOTKTKX` US West (Oregon) `arn:aws:controltower:us-west-2::control/AAYBIOQSHZST`

CT.KMS.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PR.3	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OXTCGXKLYMEW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CTNRPSCIMTII` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WQMVYTCUAPHO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SDHRAOXPCXDR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CDAWCXVACTRP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VEZBRKXRLKAT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BOMFYPZAQNZU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XTNLHQDKVOZW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GCUYVYGOGBEF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HXBWEHKKWQBM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZFKVOWDNEYFB` Canada (Central) `arn:aws:controltower:ca-central-1::control/OGEDACIRUOBW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UYOKYCLBTZQR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WFZWBBMWQINE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FWPBETJPERDF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QLCVBYTAQKNZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MMQQTMXFBQCL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KSSFTGALEFZC` Europe (London) `arn:aws:controltower:eu-west-2::control/FSWTXZUNYYSF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NXGJVOLKXVTZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HRHMVKZKYDBE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WHNUPUROUPZJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LGIMTVXMONZD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YYGKNXYYZMUT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SILIQXPGEMKZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/GNVSURRRJVKK` US West (N. California) `arn:aws:controltower:us-west-1::control/VJFECXNNFSLK` US West (Oregon) `arn:aws:controltower:us-west-2::control/MXVGDDITBSPU`

CT.KMS.PV.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PV.1	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OWHAMAXNYXUK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PTWPVUKBHYDM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OUZRLATRKXPP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CAEURXKPVZIX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VEZVGZFSMURA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AXYYODJFUXQQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZFSNCEDHSQJZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ERXHYQNEVRYZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QOSMISZNLZHS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WEFPAMOTWMDM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CHYBYDLZLYCY` Canada (Central) `arn:aws:controltower:ca-central-1::control/TUWDPWLYPABH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VBRXIJJYIJCF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KYXCYMGLOSLD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WGGZMZPDCVQQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ARHZRQJRNAXN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HYYSJTSIIYLW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MYIDTBEDJJMR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WFPVSUNMFJXD` Europe (London) `arn:aws:controltower:eu-west-2::control/DRNWPQVBTZDZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HMSAACTPKBQL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SQRLWUSUKAQA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PXOZEFZHZRKW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EKXJCUTTRNRJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IOELHUOFDDQK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AYTIGCDZPGRX` US East (Ohio) `arn:aws:controltower:us-east-2::control/MDJDOZYAMSKL` US West (N. California) `arn:aws:controltower:us-west-1::control/QCWTSSYVFTOH` US West (Oregon) `arn:aws:controltower:us-west-2::control/PVMTUFCQTSCQ`

CT.KMS.PV.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PV.2	NIST 800-53 Rev 5 CM-8 NIST 800-53 Rev 5 SC-13 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.6.1	Encrypt data at rest Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QCNPNCYCKWOG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PHOKVWOWYWTB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GMSMKRASUFKN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ICJZCOYEOISC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DJFGEKHRJHSR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HVPBYISBZGOC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VNTGRHVAOAZP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NCZDNQRKDYMA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MJQBPFOKAHLQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FXOKBDKDCRRN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VNJTGWIULHAC` Canada (Central) `arn:aws:controltower:ca-central-1::control/VUUVMKZDXTGU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HOVHVVGCZYCA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WHWUQTVOTHTA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MBFSDIMFTZKH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NIXEMBLQGRBX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DZQYUVLQCHYN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XGWMRWRXQRID` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NSNQFZKPOPGV` Europe (London) `arn:aws:controltower:eu-west-2::control/IGOEDZWDKOJY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OYJNXIWXWRIF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DBTIVTIRFNIY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RSVWGHFXEWNB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FNHMUDTXAGBW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KMWYGHZEOQNZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EDFRUURKIQUB` US East (Ohio) `arn:aws:controltower:us-east-2::control/PIMGRCBQFIYG` US West (N. California) `arn:aws:controltower:us-west-1::control/YAWIAYXXDMGM` US West (Oregon) `arn:aws:controltower:us-west-2::control/GYCBXHNJQGSY`

CT.KMS.PV.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PV.3	NIST 800-53 Rev 5 SC-12 PCI DSS version 3.2.1 2.2	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FAXVINUGMYKC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LLAZYPBBZYUB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CXRZGJFNHKHG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HBYZHPNOKDNQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SRLJJFKOCPJZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VIYXFDTJFTOV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/REDXLSFTOGWE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KKRPFQTHVVNF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LAQDBVGBZTNN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PMNICKKUUEAE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UCYPTHSTGDBY` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZQZJXLLWIWOJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VSXHZVEACEGO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KKGZONAWPTZQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OLUYXYOWEIVP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NMWKOFNNPCAF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UXZIDZHPWQQC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JAKFHFSUCQJN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ISSVLWAHPUKY` Europe (London) `arn:aws:controltower:eu-west-2::control/KXDLPZNODJLD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NTDOXXVROYNA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NLBYTRXZLVBJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OCCDVOTWDUOI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SNHKSKSCJOBM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WRTSPXIRYBDO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XBWZIXUBHKFI` US East (Ohio) `arn:aws:controltower:us-east-2::control/YAVUHKMTPUVH` US West (N. California) `arn:aws:controltower:us-west-1::control/ZKOCPCBEQKOW` US West (Oregon) `arn:aws:controltower:us-west-2::control/UBRZJERMAFCD`

CT.KMS.PV.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PV.4	NIST 800-53 Rev 5 SC-12(2)	Encrypt data at rest Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OISQVDWKRRCE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QYFKEOYNZBIW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IODDJWMRKXYZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ODIIBHMXITOT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JQSIEDUWSFYP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XVUJXMNUJKRH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZLVEAYEBGQYZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XCURERQKNGZA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DRLHYGNQFBCK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TBECJBYQNBXC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ETWPTXVQZWNZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/VYDRIMVKDWQP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YNQTMWHSOISZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZOVQFVWYWTHK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JANQXGXQTNGQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YFYXMUCFEQJR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EYTERDXVHXQV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DRPFZFQUQQHG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MTOAKBAUUKKZ` Europe (London) `arn:aws:controltower:eu-west-2::control/BLBBPTZAIQJX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZBASIZLEUIXT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LDCDJUSVTKXB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AARPXKLLOIUC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MVKAEZVXTTBB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EGLYADUUTVIC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EBMKZKSDVMWL` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZZHXODITMASY` US West (N. California) `arn:aws:controltower:us-west-1::control/IUWYPQTCMVJX` US West (Oregon) `arn:aws:controltower:us-west-2::control/GAWXDJGYAKFT`

CT.KMS.PV.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PV.5	NIST 800-53 Rev 5 SA-9(6)	Encrypt data at rest Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RNVMMPNXUUHE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LARQJQCTXLKN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NATXYLWHLDDY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AVZBAPUJNOPY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AIURGKGHIPSD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BIVKYUJTTVXY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DCTJVTIEGIZC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NJSILJCBKKDX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LRZPJJXMTXYJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OMHRJDQOQRNT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HXQVWADEFLZB` Canada (Central) `arn:aws:controltower:ca-central-1::control/HIQDPZTWODIP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MCPEZMHEWPHP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ETXNAUTWPEDI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XRNJTYFLZJTM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UADDUJMWUMFI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FAGTWHNUTYVN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PHQDHCSBPSUO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LCGFHZWLQHQL` Europe (London) `arn:aws:controltower:eu-west-2::control/CZEKUUDDWAOC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KDMSLNRTXCVE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OQBQQOZGWDSN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HDNDESSZBKHM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TCCEMCESVPGV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UOVVTTUXXEQE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YTRCMNLDOMIG` US East (Ohio) `arn:aws:controltower:us-east-2::control/FMPHLDLKZSVT` US West (N. California) `arn:aws:controltower:us-west-1::control/WAPKSUOSFZCN` US West (Oregon) `arn:aws:controltower:us-west-2::control/NYXTFGMOQSVF`

CT.KMS.PV.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.KMS.PV.6	NIST 800-53 Rev 5 SA-9(6)	Encrypt data at rest Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IOAEQLAJYOJX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VQNIDIRZNPXO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HKDZIXZVNQIQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KXELCKQIWMYL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GLKJUHBWIGYR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FBTMEVIZDZXV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JURDOMCLQETM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XPQJDEJNQREA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XDCHZDYYYBWQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XQKLXTJSCQKU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CKHYAGZGEYNQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DVFENXUYBYML` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WAJUBQFSPIOC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AXVNMAYTCTON` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IWAMOSCHKKOH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ONPVYLTFRZHK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZMAGGOBXQDLS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KVSWABXWGVDW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TQQKEWSBWODP` Europe (London) `arn:aws:controltower:eu-west-2::control/XQERZWTPUQEC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PHUVLDSBUNVE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZEAWJURGDKTF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LODSFBKGRMCB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NIMLBTLNZRTN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BWONYXHSENHW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QRQARDFSDXIL` US East (Ohio) `arn:aws:controltower:us-east-2::control/LWZCUGNXNQEI` US West (N. California) `arn:aws:controltower:us-west-1::control/GSSEWCWPUIKS` US West (Oregon) `arn:aws:controltower:us-west-2::control/KRHABHPITGXA`

CT.LAMBDA.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PR.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UIBDVHMMVAUF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JVMXSVKDKFOU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PUXILAKLQQYU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LNBOCFPQISPJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VYEPJCYALYAK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YMYWZTVHNPMQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XWZGMYTSSZAC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LDXUXPGTHFTM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BAGTSQZJEERJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UXZDCQJYOSNC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XFYXVAYPOGYG` Canada (Central) `arn:aws:controltower:ca-central-1::control/FXFPBXFQPQWW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HLIQPFVKCLVE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XLAKVGWNSZVU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UILFBLLIQABG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BORKYWUAXJKK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LPJIPJVEVHOK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MJBVVBICLFWM` Europe (London) `arn:aws:controltower:eu-west-2::control/MKFONGAVAWNY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IRVLXVEJRTUD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XJMPXBDGZYCY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YSKEYEFCQHZP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RMYYTDRBRHYM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MKVUCRWVYEWG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GFCPWDHPFTHD` US East (Ohio) `arn:aws:controltower:us-east-2::control/COUMHGZRQFCF` US West (N. California) `arn:aws:controltower:us-west-1::control/YSIDNPMMYOON` US West (Oregon) `arn:aws:controltower:us-west-2::control/VJIRQWYHYDXV`

CT.LAMBDA.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PR.3	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QRUBHQKOLDEO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PZWTIELYIZTE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WOQSTHULHXBB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WHXWCLBQBWBC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MWERAVUHAGVJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OYLHPRXKQADB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OUAKOUKARUHA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZHVUGGWVVIBX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ORTKUZLIVKOW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CLTIPWNNUWFU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RPXKXCXYTLEA` Canada (Central) `arn:aws:controltower:ca-central-1::control/FELBWGXPFUJB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TEBUKOZUOMUU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WKGMNYMTIOUY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AQDRYJFPHMSW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OUQCUUFMLXQY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YVGINZGKBDRB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BVYPROWTAFIV` Europe (London) `arn:aws:controltower:eu-west-2::control/HBVCDXCMWQXG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IJVOXESXUCQJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XVIHEYZMIVPD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MSMKHOTQFYUP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZQNEWWQNHOCA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ANRAIFWUPJNN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BVIJMEJXIWAP` US East (Ohio) `arn:aws:controltower:us-east-2::control/HEQUKYBHEVKM` US West (N. California) `arn:aws:controltower:us-west-1::control/GPNJQIYPIURY` US West (Oregon) `arn:aws:controltower:us-west-2::control/UZZBQASAXGUJ`

CT.LAMBDA.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PR.4	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JREQFLRKPLTJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GMZAGJHNXSKP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UKOEKFDBEQKA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JFSZBXDKTWKB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PJENJYVYITLK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BZXKMLBAUXJY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VJSWZAQROIJF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JRQNMMQUXFVX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DFIQWZHSSNZY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZGTSAFJLTNER` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HOCXBBCNZLKK` Canada (Central) `arn:aws:controltower:ca-central-1::control/PMHQAFGLASNE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PACONHNZQYAF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WWDZVOAOVTRP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IIPLOXPQWIWC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YYQIXBRIPJHJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DTWYWLVUTWGK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MYNQPUTAPPHV` Europe (London) `arn:aws:controltower:eu-west-2::control/QLUVOLECEOBI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UUIQOLJJWCSO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UMCFTGGINALH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TOIDRTXYMDBV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZRACMNDXAWNY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QFUSEDARBJFK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XOXGPFEWMXYQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/RNARZBOWKHIP` US West (N. California) `arn:aws:controltower:us-west-1::control/OQKNXSQRWEEO` US West (Oregon) `arn:aws:controltower:us-west-2::control/PAVLGMUCWQJJ`

CT.LAMBDA.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PR.5	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UDPWLFKXATVG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TOUJWQCHMRTH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BEAYVEJMKAZH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YLLDFQWUTMOQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RQSBSQZIJMEB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PCXKSOQRFOJG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PECEAWGHZUHR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VWPMCLITUBNJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QZPPEVMDCAYU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PMHEGULRZVPO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UEECKADLRWFR` Canada (Central) `arn:aws:controltower:ca-central-1::control/AWZAQJTRTTFM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ARMTHJNNVDCD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SELWUJIJATDK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SYNFEUHOJIFI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZLFYYHFZKLJK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/REZQWRYAQMTV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MDQQQEWXASLO` Europe (London) `arn:aws:controltower:eu-west-2::control/YLQGBZFVJHHF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GIJHAEAJFHIV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WXUDGXVLZMCM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CFKCOTSVGFOL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/COSBEYHKJWRD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DNBATCDTCWHT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KHFBNSFLXLFU` US East (Ohio) `arn:aws:controltower:us-east-2::control/KLURUNQRSOTC` US West (N. California) `arn:aws:controltower:us-west-1::control/OFUJNIZKUUTH` US West (Oregon) `arn:aws:controltower:us-west-2::control/NGOSLUFFFKZU`

CT.LAMBDA.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PR.6	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DEWAWZECDNWD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DMNSQNCZNIVC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KGDGFDZTQXAD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NFIDIZDUGHTE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QIZTBZNUZBKX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XORGKKZRAMGT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HAUILIYSYSQR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VITKCWEDWFWW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DOXCJUNEAQCI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LVDYJRBNZIDJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KLZCJQZASASQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DIYTGMGAPPGV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DEFEEGBBWNMG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WIIRWSRTEYBB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CHNMHTENMIPB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QAMSLUZWJHTS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AZADVQDRVPAL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QXXQDGAQAXXW` Europe (London) `arn:aws:controltower:eu-west-2::control/JZTICQHAKTAT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BGUYYODQXMJF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FSOFPVGUVXHI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IFTPIUVRSPPU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KHSGXAHNQPIF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NECDSRJUJGJP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UZMMJBJQMQZK` US East (Ohio) `arn:aws:controltower:us-east-2::control/KOWWBEWWDHEQ` US West (N. California) `arn:aws:controltower:us-west-1::control/OLJVZHFTBBQX` US West (Oregon) `arn:aws:controltower:us-west-2::control/SRWDRZQEYMCW`

CT.LAMBDA.PV.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PV.1	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PSYZRCXFCVTV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SPMKGJCCJOPN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BMICNUYEFUYP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WCLDUBRECNQB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WKRQCRPWLTIQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BFBVYIEXHBJM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SLMBVWJDNKMX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GQHTNZUZUNGF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LLYURTIBPPYU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QZPCHXXRSNQQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TEVRXVTDQJPB` Canada (Central) `arn:aws:controltower:ca-central-1::control/NZLDFSAFRBWL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/RFVELQCJCHDB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FFTEZONPHDUJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EZDDUOQUXMKK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PXBKWTAFSWHJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HZNFIYMPMBMR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VPCHUDLKOFXZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BRGLCIPEZUAS` Europe (London) `arn:aws:controltower:eu-west-2::control/XNQVYLKQAQHJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SIUALBLGDTMO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KCCLIDVTAYFJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KGBMFJEROMKE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/REBDTZYVQTHS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CHPCWCOGYSCZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DHHUNDPLAEDH` US East (Ohio) `arn:aws:controltower:us-east-2::control/AEVUGRANQIIR` US West (N. California) `arn:aws:controltower:us-west-1::control/UQSFXDRYFMHT` US West (Oregon) `arn:aws:controltower:us-west-2::control/VBCTZJHNUNDG`

CT.LAMBDA.PV.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.LAMBDA.PV.2	PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OESCSLVHVSLE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DMQNSKCJEMGE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CKUNXXZIGPCO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QZRXZBUCTPUU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NQDLCWOTTWYE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GVZQJUVYWDCB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TJFQQZICEGUH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XIGDWYXFDNYI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DLCEGPCZVKVR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YBOGPLNVDMJY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JMFYXCOPFTXD` Canada (Central) `arn:aws:controltower:ca-central-1::control/AMWDCROIIEIR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AZIVQXZBQTMI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GPJAJNASBGWV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ETIFLDQRNDGM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SMCUFBYWBNYT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XKHRNISMIPCD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PTQGPZHVIZYL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OWRKZHZGUVYV` Europe (London) `arn:aws:controltower:eu-west-2::control/PYKTKPURQELQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MJDNUHXZAXBB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RDHGXRNYWRGS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LHDBIAJHZPLA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WWCFPCARGEZV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BPKXRBEKVJQT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZODWNFXUUYOO` US East (Ohio) `arn:aws:controltower:us-east-2::control/KFAOIVPALKDH` US West (N. California) `arn:aws:controltower:us-west-1::control/FEMIYYGGMEFS` US West (Oregon) `arn:aws:controltower:us-west-2::control/JGPQDZGKSFMU`

CT.MQ.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.MQ.PR.1	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve resiliency Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WSJWKPYQTTNU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VTBBZHEVNVOI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UCILLEAJEUIJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RJIZKYGOAOPQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UYXVFZSKTUBK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KBSAGXSAADUW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WTWVLYJWRKSB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YSERPGVIVTQY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FFGVHTGZXPEZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IXDXNGQKEAPR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YWVSXWGEFXUC` Canada (Central) `arn:aws:controltower:ca-central-1::control/SFQDJVTLHWNL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ECCIYSNDAQTE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QNZQMPOVQBVF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AEBZTYVZDNRC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HBCOAJEAFXDU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JQCZITBAJQHZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KJXYKUOPPURV` Europe (London) `arn:aws:controltower:eu-west-2::control/LZZVHLDPXFPK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZHDMQVITAJUY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DTYFZYAVIEEX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FLOCYUQEBTGA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TBBQFXAWASFY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CTBROZHZFSHH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MQQZTEMPUGWI` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZTCMAABBQGAV` US West (N. California) `arn:aws:controltower:us-west-1::control/PTWZVCAADPQK` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZFWMKYOIAGSE`

CT.MQ.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.MQ.PR.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve resiliency Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KJEUGEKUNLZZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DXJDWWZOTRYO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CKSKRIHJFKXX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QJHCRLOLAACU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CXVLQMRMZNCA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OYDKTPAMRYBE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AVWBMTCGEFMZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UXKPREDRSLDK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SWVPVFANFTMW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NHVOAEYKAXPI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EZYJLTELGEJZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/LUZXHFYGBRHQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XMKXPSLJXIZG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VHBKUESUPAPS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SMHUJLYTMHMQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KZIMAUHEPZMR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AUWZOWMMLNBO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JYTBUICKDUSX` Europe (London) `arn:aws:controltower:eu-west-2::control/AEXPYFQBEDBN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WBVREAMAQFHU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MDLSDLWZVZRU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/APUBWCZATBZK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LAHFJWQEUILJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CRLRJHOTNOHP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VHAFXJTXTQMY` US East (Ohio) `arn:aws:controltower:us-east-2::control/SBNYXMCPJYYF` US West (N. California) `arn:aws:controltower:us-west-1::control/BFHEAUBRZHYC` US West (Oregon) `arn:aws:controltower:us-west-2::control/OMCJZWMYHEVZ`

CT.MSK.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.MSK.PR.1	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BAHWMNPELSAS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VJKSJUWKZGRN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UQTBILPKYTBY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AGCJFRAOJAQH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GRETECLSQPSI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BTWMDHYZHDAI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TWCRBSOGZPFF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RDGYYRDGSFHX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BNIVUZKPMVQN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WCDCFFYFYMDE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OULBRFIHYTNN` Canada (Central) `arn:aws:controltower:ca-central-1::control/MNIRMHULKCQS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NRGTNOBYFTGX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KILOKNWJSYZQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XOXTXFXPXMEA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HUKYWXEGZLOQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TJYPFSDYTZKS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UWBXKPTYRJSZ` Europe (London) `arn:aws:controltower:eu-west-2::control/KVVDEADXQKNC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IUSVKEKARNAG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XVCSKWQARZXH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RDNFSPNYDEYE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LPZMRIAFLVYV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YUFFNEEGMKJB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SQQDZTSFFFIB` US East (Ohio) `arn:aws:controltower:us-east-2::control/NVDOZWNUFIAS` US West (N. California) `arn:aws:controltower:us-west-1::control/LEYMWRQCEHWC` US West (Oregon) `arn:aws:controltower:us-west-2::control/MVIJOZVGIEAO`

CT.MSK.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.MSK.PR.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YXNJQQTVFNIS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WNVHOCPCOTRR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PQSCRPWAIGSI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KGTZSYXABUIQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GOPUMVIQUABN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XAWVJZRSTADX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SBETCCVKPNIU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KDUGEVWDHRHO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EHTOBZTBSZXK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OJFGSQYYLTTD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MEFCJWCHCRQA` Canada (Central) `arn:aws:controltower:ca-central-1::control/MUNQHOJYUZAJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SKRZGWYWSIPS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SQBOPTGLLENJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FEGVRWHEVDRB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SWIAIGYRDQCA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LGRHBZUSXUXO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TACKPJYYNVWA` Europe (London) `arn:aws:controltower:eu-west-2::control/KSSKNNHQHEXB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LQDETGYRPNBE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CDZVSZMWQBHP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AKSHVXVBYCWH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QKQNQZXTIKKH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MSCNWGCTYWAG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PZUJVIDWDHOM` US East (Ohio) `arn:aws:controltower:us-east-2::control/XVUHNEQBVNVW` US West (N. California) `arn:aws:controltower:us-west-1::control/MBUHFHUIBMAP` US West (Oregon) `arn:aws:controltower:us-west-2::control/LRMSVVUASUPE`

CT.MULTISERVICE.PV.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.MULTISERVICE.PV.1	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 7.2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VXHNRWGNCBCI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CWTMVEHXOTNW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MPJQGLAIIZEM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BLXDPWEXTKRA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NSDDZGMMKNER` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OLQBAKMRJYXE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QOUYADIVTWNB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LSENANGXZUZZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TKFQGXOBPOPS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MYZWLUGJMTLG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JUMCMTEBPIHO` Canada (Central) `arn:aws:controltower:ca-central-1::control/CUMNVXPZBGRY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PXEQTTSHITFZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TXGPJWIFOIGP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XYEOCXGQGPIL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FEJANOLACBIZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TFIGQZAEMVUX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DUBESZEORFLO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LGTPYJYCCRAP` Europe (London) `arn:aws:controltower:eu-west-2::control/PFPYSCVEVJTP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GGAWFNTSDAEQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TNPYPLHKBYQN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FYHDZNZGYHGG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UOJZHKRFGHPV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XTXHSACQYKWD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JBVFPCBYGPJM` US East (Ohio) `arn:aws:controltower:us-east-2::control/TIXURCHHVCLB` US West (N. California) `arn:aws:controltower:us-west-1::control/KXUQFQQTDUTR` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZTCMZTIAOUEX`

CT.NEPTUNE.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NEPTUNE.PR.1	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.7	Enforce least privilege Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ERYIKQHLGOSR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BQEHCQGVUZAL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WMPRSCMJEQPR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FIHJPXZCWDUV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VRVLPEXHUHRR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HKUTEITUOURQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GCIDLPUWZZSC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UKYLCMUZFQMF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZBNZCKKEFZPZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZCYILJXNYJPS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EMRQQNEEYXAN` Canada (Central) `arn:aws:controltower:ca-central-1::control/IMAPSYUKKCBZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TOIBCMWTQULC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XYVGUQMPBHLO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JCSHAIJVQJPN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VSKCNZBJMSDL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EDCFDZFLSLTE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QBMPFYNYANKO` Europe (London) `arn:aws:controltower:eu-west-2::control/TQGVMTLQCLVJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XPUCIKNRWZQY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XNEQNATMDCOH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DMMWWJNLMZZA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JAEBJWGZUZIK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BIMAERWOCWOC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VVYTTDIRYZIC` US East (Ohio) `arn:aws:controltower:us-east-2::control/HHYQQNQRWPTR` US West (N. California) `arn:aws:controltower:us-west-1::control/AGSWUBESEOXW` US West (Oregon) `arn:aws:controltower:us-west-2::control/OIAIWVBPDRZL`

CT.NEPTUNE.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NEPTUNE.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) PCI DSS version 3.2.1 2.2	Improve availability Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NCHILLHMRKWV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MNXLYFLERVOH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NACPTUROMGYT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WBFRUHNLHDQY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RBZJYTJVKEHN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/USKYFIQHPSRG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ALDJGKDLKYSD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MKEKOWUXVHEC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EPHJMXQEYSVC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MQCMSSWZMSNP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IJPZWNXPUXES` Canada (Central) `arn:aws:controltower:ca-central-1::control/VFQOGQVHFGGE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BFOILRCAVCCO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JPOGMCFZRQDK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LZEHPWYXYBNV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CPEMPXZLTSTB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JHJZOWOQKSQQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WXRTDNJWPQOX` Europe (London) `arn:aws:controltower:eu-west-2::control/OCSPXMPOABNK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ILBYOEBHNJPW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TYXJKFWHUHHA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PAKICJQWADVT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CITQXSOCSZKP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VHPBMTMAGERS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AULKJOKXSVDI` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZHXCJVNWNCCQ` US West (N. California) `arn:aws:controltower:us-west-1::control/YSOAFXOUVDMZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/GPMNZXUWJXSR`

CT.NEPTUNE.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NEPTUNE.PR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MAJYUEOFRPCV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/THFQXQZMWHWZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LPFIVZUROOJJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MPXCNSRKMDRF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MEYIGJFZNYVR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DSCGRLDBSTVB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AUXNHIKWYWOM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HXRJRJSRDQBB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GQZRECITMLZC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WUVFSNJYPXZY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NXKULGHRFXPV` Canada (Central) `arn:aws:controltower:ca-central-1::control/BONSNYFHTQYM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GQXVHTLKFULO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DATHNOLBMKAS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RGGBNARHYLPC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VELCDMBUYSDH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UMJFXSSLQXOZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GFECITKOJIDB` Europe (London) `arn:aws:controltower:eu-west-2::control/VRONLZOJVXSF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EEFOBFRQOZLO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TGFIVIAQMYYH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XVYPSSGWQEMK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/POYFLOMZJKGT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PHRBYWIDRHTW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZVGXWMKLNOCT` US East (Ohio) `arn:aws:controltower:us-east-2::control/DUNNSUBEGAMH` US West (N. California) `arn:aws:controltower:us-west-1::control/CZOYFPWHMMZD` US West (Oregon) `arn:aws:controltower:us-west-2::control/CKBZYEFYGFQG`

CT.NEPTUNE.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NEPTUNE.PR.4	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 AU-7(1) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-4(5) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QXMAAXPCKZFS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CVRZOMASWHHH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TTUQITYQNLQX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GJEVNGPGKXIW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CETXVRVGQUKY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EKPWQJMYXYJC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SQJJLQFWDYLT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WNMAYPTTNDEJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ICNUQORDNDTA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IOWUKZDWGONS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EKFELZAAQZPG` Canada (Central) `arn:aws:controltower:ca-central-1::control/OBNEBUDNRRQH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZLNXPZLYQOKG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XKPKBPMMDZKQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CQKTUQPFGNZN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OLIYTOIMRZCM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JOVZFQYFBTRR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XWJIDBFMFSIU` Europe (London) `arn:aws:controltower:eu-west-2::control/ROEMRZGOKQFG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KMOMZHHLSJWK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZHQJPXBOEXCR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PHQRDGGBMYVR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PGRATNEIHKBS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LAOWKRUXEWCI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ONFZFWFIMSQN` US East (Ohio) `arn:aws:controltower:us-east-2::control/JDYGXWIKJYDZ` US West (N. California) `arn:aws:controltower:us-west-1::control/ZAHCCDVLHWGD` US West (Oregon) `arn:aws:controltower:us-west-2::control/JSFACLSPAAKM`

CT.NEPTUNE.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NEPTUNE.PR.5	NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RBOCORVIYGTI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VGEOCPJNBAUE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ILVYLTZPOHWB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FZTDZJZCFWIV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AFEXSGMDSATC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VFHGVCTVPMQF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GUZDYGGUCQEF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LFORACIZCHRB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HNYWAXKKADCC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OTVNXEOUUPBR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OURFPROLDKAV` Canada (Central) `arn:aws:controltower:ca-central-1::control/VRSCWUWXSKOO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HJZPJJVXQESR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NELJWTJJPTYO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IBHWTDKBHOQR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KAONKKJAVXIY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EIEQGAVIHYZT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DGTIMIBUIKZV` Europe (London) `arn:aws:controltower:eu-west-2::control/WXGMITOBWCMX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QFWSBPVIHIIC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UEFOVDHBPYOP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LVFHIRHHXDNP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FHDEQVJNEKKO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KAOCDXVZVGYR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NRKJRTZHJLPU` US East (Ohio) `arn:aws:controltower:us-east-2::control/GGCHHGUQKXAE` US West (N. California) `arn:aws:controltower:us-west-1::control/IXTSKMKZWHMG` US West (Oregon) `arn:aws:controltower:us-west-2::control/IIJZNAMPKSOS`

CT.NETWORK-FIREWALL.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NETWORK-FIREWALL.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 11.4	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IUMIPAUHWACS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CEMWKHOGONEX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MKTMBJSACTFI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VTAPSFMTMEPO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KFPGHTQXQZEY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SEWCMVQOWXZF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UTNKNMWKYEBF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VALVPGBFFRBG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ITJWVPIYBVEB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ETUWZLERTVQI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OUYOBZFVVXCW` Canada (Central) `arn:aws:controltower:ca-central-1::control/SIIOUKQWZSFK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JOWPYQPSKHFY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FKDEUTBSPQQZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HUIWIDBGYYJB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HOIEWDTLWCMZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ALCDFJHBSWUF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JCRWUNVVLOXY` Europe (London) `arn:aws:controltower:eu-west-2::control/ISNZYDYDKGKX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VOSZJFYQWKNN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UNRUVNFQMQTS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YMXZYJKHEXNW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RRRVPETQNOYN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XAHWAUUTZFGI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MOWFCDWVPVGY` US East (Ohio) `arn:aws:controltower:us-east-2::control/GGCHBPSTREXK` US West (N. California) `arn:aws:controltower:us-west-1::control/RSWJSOQSPLGG` US West (Oregon) `arn:aws:controltower:us-west-2::control/AHRCABRNZNQM`

CT.NETWORK-FIREWALL.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NETWORK-FIREWALL.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RSVJLVHYRQNL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IGGMCFBBHYCG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SDCRNFKTGMMD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XXDJJPDXVVTT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VUNCRJLJDFIO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZJXSBKPNKOSO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HYPTJDAYXNHH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IZHFDRGPHJYF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JTCRHWTVYTMB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MTPRETPWRQNM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IPVFMIRAPIGA` Canada (Central) `arn:aws:controltower:ca-central-1::control/GTFHCKELKRXJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GTUXAMBREPYK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZLWUEANEGUKI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZLXEYHKEBBOW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ERYDUHMYMURH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BUMCKVFUMSZX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HOVYKEEFTIGU` Europe (London) `arn:aws:controltower:eu-west-2::control/KDGIPSOLEUPZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TMFXXPMEJCKA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TKQZNLWJYRZK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QQCXXWJNOWEB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FOETEMTZEZFR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ERXMHKYKAWSC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SXRZLKJBMDWS` US East (Ohio) `arn:aws:controltower:us-east-2::control/IWTSVOSLDTBS` US West (N. California) `arn:aws:controltower:us-west-1::control/NKALWPJQEMGP` US West (Oregon) `arn:aws:controltower:us-west-2::control/DBQINFJQURTI`

CT.NETWORK-FIREWALL.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NETWORK-FIREWALL.PR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AUWSQHUOWBSO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CWCHPODDCPBB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XFESNQJWYRZV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NPXRMXOWRHBB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VCMKHWLPDXBS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VBXMAKCXQCPJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RFDNTHGJELTR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TKVYXDHYRAET` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JFLLDLXJUPDD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ISPNAEMQQYUG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PIPCLZWMAQUL` Canada (Central) `arn:aws:controltower:ca-central-1::control/YZYEDZMRQLKG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EUXJZRQMLYNG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MDVWFMYJKBVA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IXIEKMHOPXSA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XRAFMHDNTZXJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VETVANXGMHXZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WQSZOXOJGABB` Europe (London) `arn:aws:controltower:eu-west-2::control/RLWYKMFOMTHK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LAGHSXBMEPCR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YGKFLCKHIGYS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DJCDHEBKQHFM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NAVPEPWJBYWC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HGQPODHBJRUD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PQSYWADLSXIQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/QCOLRTHQOZKD` US West (N. California) `arn:aws:controltower:us-west-1::control/HWHGLJZTLCGZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/CBTUDPFAKVKC`

CT.NETWORK-FIREWALL.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NETWORK-FIREWALL.PR.4	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QPYERNZEOVFW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OXBWNYZSDNXJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ETWPTTQYSUZG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NVRIPMNHUXMS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TXSZCXGXZSSN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VZAFYQVTASYJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KTZYTMWBDRHP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AFHBFGRQFBMV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BOZPZUYFXHUQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PGEABSLQNWSZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EAMNVEPGNHRA` Canada (Central) `arn:aws:controltower:ca-central-1::control/QBORBGFWFGIX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TYHKWOJMOLGM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HYYFUKRTDISL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CSIFNPQGKXWV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VFJYJRIWCXTJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YTUWMVCGZMBR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GPDNDENLPHWN` Europe (London) `arn:aws:controltower:eu-west-2::control/QCBVHDIASDKR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PSXIXHKFMZYD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ITFUJRZDNXBC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QEGKHNAVRPTN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VAMNEBFICAGE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TQEZIBLEAPLP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OFYAEXYSCBOV` US East (Ohio) `arn:aws:controltower:us-east-2::control/KMIMXOHJDVNW` US West (N. California) `arn:aws:controltower:us-west-1::control/CWUANEFBSYHT` US West (Oregon) `arn:aws:controltower:us-west-2::control/VOEDRZGRSHEV`

CT.NETWORK-FIREWALL.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.NETWORK-FIREWALL.PR.5	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YRIOWAKIKPBI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LQTKGHEVEHHB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AYSFSPBIZDPJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LUKCMXOPMMCE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JVTNUXCWXDNN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DOJBIXUZZFQD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AOIKXRLDQGDB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JIUDDMVXUNTX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WBWNIXYIRGJG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PZZQCSEITCRL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ECKHABEFONXL` Canada (Central) `arn:aws:controltower:ca-central-1::control/JNLBIPKXYYSI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PPRQOFYBMLWE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OOYQFEWCJLCI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MIVMBADGFITX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AMRIRKFDCRQQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XXAIDIGBWOYG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YJUCHDZFHZCE` Europe (London) `arn:aws:controltower:eu-west-2::control/KQASVJWTIWQW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YHGHTNJVIFPU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XWLUUAZOREAS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ORXIGVIYIKIK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VVEZIUOYBNTX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZIOGNBGBLKOT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YDTWTSMHHQET` US East (Ohio) `arn:aws:controltower:us-east-2::control/BYVZATKHREIJ` US West (N. California) `arn:aws:controltower:us-west-1::control/RGETFSGBKEHF` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZDGARGCZBRFO`

CT.OPENSEARCH.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.1	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-13(5) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(6) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SQGKFIPVDSTL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TNDQHFJXDBPS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XFOEOJKEETKE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FGYTCVPCXEGE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TEXJPFYIYIRT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZBDNHDIOZEMY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/STQLABAVRXQO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VIMTCPWLJSNN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZKCZQKAZSTAI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BZMOURJQBWKA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QGIEHLWASGGX` Canada (Central) `arn:aws:controltower:ca-central-1::control/DYHUHTZMANYT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KYNVRIQMLTBN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YKSFVHHVWRUZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LFGRNFRJMKXE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BIKTRNYRJZOC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RQXYFZTDBGCS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MUMEKFGKATWE` Europe (London) `arn:aws:controltower:eu-west-2::control/RYGXUZLZWLSW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QUXXZODONXRY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OSIPIFATXXHO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TBXMTAFVCDWJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HGHTOHZXLQHR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PHABICPTLMTC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RIIBJUAGRIHM` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZKJKSTRBBZVZ` US West (N. California) `arn:aws:controltower:us-west-1::control/DZKPTXADQBLK` US West (Oregon) `arn:aws:controltower:us-west-2::control/LIWOVOJLBRAX`

CT.OPENSEARCH.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.10	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GAEROJSFBVFU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BHBQIYXUEQMK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YTWEMPALPIMN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XRNYJUFPDRET` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PGHNZNEDFFYC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VOXPJBUXXXSH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KJPZFVGAXUSQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LLKOQRPPPWTV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JUUVIFSWJWIT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WTKHFUNAHSRC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EVJTHCMSEQQX` Canada (Central) `arn:aws:controltower:ca-central-1::control/CUKNPGFNVIVZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CYKUSFNSTJZZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VULXBGHMFRCG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FOCMHCPHMGIA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OOWBBDUGZXPK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LSFHGNPMFOHV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TJZKDXZQBHAF` Europe (London) `arn:aws:controltower:eu-west-2::control/VYKPKMDZGQIW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KGQIMWODUHUH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QCKSAFPOOKQD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YFGVTIUSFTEA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CDQCCVMOQIDD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UCCGQWSINGEF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AASJRFPGBVMO` US East (Ohio) `arn:aws:controltower:us-east-2::control/QZXAALUVUXXP` US West (N. California) `arn:aws:controltower:us-west-1::control/EKMQUDHBJGTX` US West (Oregon) `arn:aws:controltower:us-west-2::control/SMJAAEIMFEDL`

CT.OPENSEARCH.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.11	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LEHJKCAWOHPJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XIKCXGOTLKEJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BBXSREYFFRMS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SHXZHXDYIIEM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VZMEQZKMKZTD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BPRGFRVWRLYQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XOAOJPZFFESJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NRCZHBGZPNFI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YBEBQCIZYYLW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SVWDDTCGVTOR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LUZFSXFQSKRQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/JJJBKFBKOIFL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RYUKNMPZHEOE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NZUIIJPXVQDJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AMIYCNJHXFZG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KZQCIJBAVBFU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TZUJHBAATELA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DDNSAGXFVZYE` Europe (London) `arn:aws:controltower:eu-west-2::control/RBAIGZPHECPA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IYYIWMLMYEGN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SKZXZATSLYXJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NXTCIITQHWKW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YAZJCIWWHQLN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CSBQQWECHTXL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LSGSWJZPSQLN` US East (Ohio) `arn:aws:controltower:us-east-2::control/XEOVAXSGANOW` US West (N. California) `arn:aws:controltower:us-west-1::control/ITXUJRWDZCIN` US West (Oregon) `arn:aws:controltower:us-west-2::control/PRTVHUYCEBIA`

CT.OPENSEARCH.PR.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.12	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SNIFQJTWZTDE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MTPHRGYMTXNZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FLPLZPRKQSRW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LXMWYMCWWQDQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PFESRXEPJLXF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AADYUONVCYLF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GAEKXUENNOTD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ABSANFLGUHSE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GIVZCHZYHVFF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GXDBIGPNJLKC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EIGXMDVSHDTY` Canada (Central) `arn:aws:controltower:ca-central-1::control/GBORBUKXVXWV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BPDFIRXUUCOO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QKHWLPCVKOEF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UIQWGZTLAHXU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YZFSNBZYNGBN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ITLJTQKWUNYO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YHCHFBWNQKEM` Europe (London) `arn:aws:controltower:eu-west-2::control/ABQEJNCVZNTT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HIGDEERKYHKS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FEJRRCAXKHDZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DDLIELBIQHXT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JEYPGHUYMGGL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VCPRGZXWFHWH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GDSONMYFZRLF` US East (Ohio) `arn:aws:controltower:us-east-2::control/JXKVVKUICIVI` US West (N. California) `arn:aws:controltower:us-west-1::control/TJDUFYTASRZU` US West (Oregon) `arn:aws:controltower:us-west-2::control/AOMKMLLKIJHL`

CT.OPENSEARCH.PR.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.13	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IIUIGPGDAKKS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DRJJPMHHMDLX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IHQJBYGOYRNJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BOWBHCDYIKIV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OCIFQRYXYVRZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XRXYSFHHVRGW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FNRIXBVIOTIF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MSQLWOZPLNJR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LIQKLRNJWVLN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CRYYGMVAJETX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QAAEWIBSKHVB` Canada (Central) `arn:aws:controltower:ca-central-1::control/MHOCPNBLGBET` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZSJSCMIFQYHQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XMZAQADYESGL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SLMGZLLTGPDT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SIJLMHUMIBEA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EEOMDYLLXXFF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZOCELNRKWSQC` Europe (London) `arn:aws:controltower:eu-west-2::control/EGIAPDZCHMOG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WWWKEBANHSYO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AFCGOVQGNLBG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XDVWRCLWBTPB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZABURMYUXTCP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CTHVPVEZJBDJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SFXALXZDGECS` US East (Ohio) `arn:aws:controltower:us-east-2::control/USTIOXRNYFAV` US West (N. California) `arn:aws:controltower:us-west-1::control/PMWAYPJMSHES` US West (Oregon) `arn:aws:controltower:us-west-2::control/XUNNABZCEQYZ`

CT.OPENSEARCH.PR.14

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.14	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/COTPYWONNCWV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UBVVZQBVUCCN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OOELHVJWNSQU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AVEPZTWUQOHV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VXVTTKVHAVTX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/POFYFDIMHQKH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZRBRJYCVYSIG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XBNRHLHSYAQW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HYENHQKNDJCT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DSVSBRMWZIKQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WAZDZCMZOCTV` Canada (Central) `arn:aws:controltower:ca-central-1::control/BHKRHJKOIARA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SBAGREZDUTQH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DFGBJORYMMNY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BAKGLCSOQAJV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HZEGOTZOHZQB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PWCYCKZXADUQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OMMRADBYMVNJ` Europe (London) `arn:aws:controltower:eu-west-2::control/LLSYOVEGXGCJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GVQQKJDZIBUM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GPETDJRRCPRN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HFXEUEXQDHRR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZDYNQADBTKIZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FCOHMGYYZGMQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GXAUYPCLBCBS` US East (Ohio) `arn:aws:controltower:us-east-2::control/JKMVKOYUMAPQ` US West (N. California) `arn:aws:controltower:us-west-1::control/ERMHCHCHXXQM` US West (Oregon) `arn:aws:controltower:us-west-2::control/CFWVMYGFBCAX`

CT.OPENSEARCH.PR.15

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.15	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GRUCGLOHAAOD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OHTDBHWVHJKO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NCZOCAQXAZCZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CSJDXWLKOSQP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VOMVAUOIUNDR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TJJENZZFEAXL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PXJLLPJDADLP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ORFJWTUPGSZY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GTQNOHLWVMVH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RUVAAYRTPBWD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CNZPTJJRWSNX` Canada (Central) `arn:aws:controltower:ca-central-1::control/AXPLMDKRPSRX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CYLADYNNHZZX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PDUHLZPPTVRK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XMRBSJAKYPQW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/USTZBJHMMNPB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QHOQNFCCSYHJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SXSLJJAOTGMY` Europe (London) `arn:aws:controltower:eu-west-2::control/SRFWZJMTQRZZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EFHXQGWQSZEK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PQKDYUOLRRFL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HCBWBPCVNPPE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ESPWZZWLPWYN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CFZPGDJXQJGW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QFQQFHUFYOKF` US East (Ohio) `arn:aws:controltower:us-east-2::control/DYLEDFCOIYCR` US West (N. California) `arn:aws:controltower:us-west-1::control/EBPSQUNFBDRL` US West (Oregon) `arn:aws:controltower:us-west-2::control/JIEHZXZFREPA`

CT.OPENSEARCH.PR.16

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.16	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UYWBKVDKLLPS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HQXCYQUHXDGA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UYTWQUJJSXPK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QUFLTZGKIHYN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PKHUQJEJCLWS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KZTACTIDLFAB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CINYSCTVZMHX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RZZWLHNJDKWW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SUIONSKYSCOB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BCISWMGTUIEK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LAPLGFTJAXIB` Canada (Central) `arn:aws:controltower:ca-central-1::control/BYMWNEKJVBPA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RFZMHDDCATDV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WTOJCTPLOFOI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YUIUSCIOMUDH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JSJWBUBPJFBG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JRBKUHRGFZJN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VTQFJKCNUPTA` Europe (London) `arn:aws:controltower:eu-west-2::control/QMPILNQUJKOC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RHPSFIDONVGY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UFFPOLWQQNMA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XCNNRCPBPQXB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IWUPTYIRKSTI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OHTIGEPUEYQN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ULWLGPROCXUE` US East (Ohio) `arn:aws:controltower:us-east-2::control/WICEUAFLUNHP` US West (N. California) `arn:aws:controltower:us-west-1::control/AKOKGMZDNDBH` US West (Oregon) `arn:aws:controltower:us-west-2::control/SAWLZWOPSRIB`

CT.OPENSEARCH.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WVGIWATQSXNV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BXKDBCNEKUKQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TJJGFRBZRZSV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UCLVYXAVOAHM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CQLGRRFXIEID` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TSAAUQSILYSH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VOYUOLERDHMA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NXUQGVFMOHAG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GYGEIIYYZNLM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YCCNRZZHQRAU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NLYEGMAOFTAD` Canada (Central) `arn:aws:controltower:ca-central-1::control/XMRAHLUXZRVT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ACUNINHQNGLI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OWMJYWQWWHVL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QLSJKVLPLMMO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NPLWOOSVWQNS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CERUJQSWOLEG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LPUSJOMLHGCV` Europe (London) `arn:aws:controltower:eu-west-2::control/WEYQXRFHOQCU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NEEJCATZEIMW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TSMMXHLKSOGU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OZVVNVIANAQY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ODWPJGSCURQW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BGWSRBPMDSUR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VTLIUXDAVRDR` US East (Ohio) `arn:aws:controltower:us-east-2::control/XEVFCYEQTVVZ` US West (N. California) `arn:aws:controltower:us-west-1::control/IFNDKBNUSCKD` US West (Oregon) `arn:aws:controltower:us-west-2::control/IHEMPFCKBBEK`

CT.OPENSEARCH.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.3	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VHMQVLVZKWNO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GZFIOCNJXQLT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WZFMVXTTCMFR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UGGNPNQICGZQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RAGNOCSYSIJR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OGZKUCPQNZAZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HFBWABBDQUGE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RMNNULZXVFFO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QQBYBBDRDPJS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QLYZGPDANYDA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GRSDIFUYIMFN` Canada (Central) `arn:aws:controltower:ca-central-1::control/QUIKFRDEFZBK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NGSGMLMBVFOK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HOWAJKATTUKZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QRGSGEZFDHUI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HQFAQRQRCIYS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AFJCHTBCRUSW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CAZKXJYXMWBL` Europe (London) `arn:aws:controltower:eu-west-2::control/HXLIHVMXMHFS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MTARCONVTLOX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WBHFYKPZUPQU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FPCUMXNOKTVA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PTVICLGFUIPU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JFSVGFJCHFQZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HLPMHXZUFAMP` US East (Ohio) `arn:aws:controltower:us-east-2::control/UTXSXANDROVO` US West (N. California) `arn:aws:controltower:us-west-1::control/PUPHHEVPARPK` US West (Oregon) `arn:aws:controltower:us-west-2::control/QSBSQHVLFWYO`

CT.OPENSEARCH.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.4	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JCZCTQBRLIFS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DJVTCGPZYSLR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NEMEBLSVQDQW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZYBIFAAQOQZB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZVKTNWLSWKUC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EJLRJLUVBNHN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RHZECQRAAAZW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NOEXBYDHYFLN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UYAXZWGNSLOM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TOLOKFEEGTJH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IPQWJIRBIWGQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DOPPXRIVAYVN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QWERPPLZPCHT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LZHEPFFMOGFV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KLCYSVFSKGBO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BQZZSSJVRNHD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZKDDJNJNGEET` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VPWHXJISTFOH` Europe (London) `arn:aws:controltower:eu-west-2::control/YZZBKRFXBVMZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UHBZCFPBQDRL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GFKZAMSBYHGQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PGSJHVIOVEJV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WZCAZXFJWWFV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AJUFPFJHAONT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JSTNMTMFRKGO` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZJCUTJIJOESN` US West (N. California) `arn:aws:controltower:us-west-1::control/EWSFLJITRUHU` US West (Oregon) `arn:aws:controltower:us-west-2::control/AKGAYTZTWFZI`

CT.OPENSEARCH.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.5	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IBPRSOCDFQRG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DNGAAKXQFDQV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZBUOYIWGUJZP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JCCUGYQNCITY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VXAOMOWSCIBP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FRHDOEXXBOWQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XJXEZTTHXKQF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SVOHVKTULZGK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ORIKZBBNSZRB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PWUNDFXSUYAY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JYWSHGENXKTO` Canada (Central) `arn:aws:controltower:ca-central-1::control/WZANTGTEGLMA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TWQSZLVIYAVG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IFNTITBLCTPB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GLKQJFWSKVCH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JVKVVHVYGEXB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WLQZFLEVVVGW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QEEZPBMZYQFN` Europe (London) `arn:aws:controltower:eu-west-2::control/YCOUGYAZOQNA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/USWETIYXXFTH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WZSBECYYSBSU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TIUSBCXCBQNY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QAYJNRWJQYBO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZJMOCDQOAMSQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KYAFRIXOLJCM` US East (Ohio) `arn:aws:controltower:us-east-2::control/LVNKFQFKMTWR` US West (N. California) `arn:aws:controltower:us-west-1::control/EIHWFSQEDMQS` US West (Oregon) `arn:aws:controltower:us-west-2::control/CNSIZGNVLCLN`

CT.OPENSEARCH.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ARTUADLEDUAQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NHTZGOYISWAH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ULUJPIODNXMQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BQNHZOCGNLIA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WFTCZPQQJGQN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HKMNHQCBPFBI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OCLOCVAYTOOI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VJKQXGBOJPYX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UTDGLWWSQDEU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HIZSJVEOIWXP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YPZCLPKBNGIA` Canada (Central) `arn:aws:controltower:ca-central-1::control/ATEKPCKHHHYQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EMJYVYYDOQRX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VPIIPJOBXEET` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WSBITCGHGEDK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PYSBFVWYCMAU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FECUISCKYVVV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QMIRWQGLWTKC` Europe (London) `arn:aws:controltower:eu-west-2::control/EREYWUMMXCYD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HRQELGWRNOFE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XKCISKPFWCSK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GRIXGVMZZGTT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JVWSMFEROGHX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LIRWXACRJOHY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AIBFRQCHGJOO` US East (Ohio) `arn:aws:controltower:us-east-2::control/LXDACFXTMIOS` US West (N. California) `arn:aws:controltower:us-west-1::control/DNMZNOAPKWKO` US West (Oregon) `arn:aws:controltower:us-west-2::control/ENATZEFXPYYM`

CT.OPENSEARCH.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.7	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WZHBBVAEUBFF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OJFEGCMAQKJO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GKHBCXGNPZMK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LDJIZXCULADJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BAKHBHLOYKAA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SJEVTRVISWQO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TTPHKLHOVRAJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YXTTBALIVPSX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BEKZJRWESGED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BQWPTLYFLVJT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YCWSPDDLEEDG` Canada (Central) `arn:aws:controltower:ca-central-1::control/MDJZFKJKKFMG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/INNDAQGPPHVC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BQNTMFNFOIRL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GFZRKVAQNTNM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ASNSDRVZSYXT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GUCQQGCDGDNS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UHQGAJJBQDDJ` Europe (London) `arn:aws:controltower:eu-west-2::control/CGYOVDBJAZLY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/THXOAXRJOLPA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HOJNWTFCAPQJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SHJFWLCQMAPH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HILHCIVHZRUJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ITGIWIHHKFYG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YZEZWADHNHLT` US East (Ohio) `arn:aws:controltower:us-east-2::control/AIOOYWFODGTZ` US West (N. California) `arn:aws:controltower:us-west-1::control/CACOFIMRPBKI` US West (Oregon) `arn:aws:controltower:us-west-2::control/WKDTZIOQBFDF`

CT.OPENSEARCH.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.8	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VVGOWQKFJVYY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AJFWGMGACTIU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AJMLARVDOFYW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ALICRWQMXIKK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MDWFWNZOUXSM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EJEEGAXFUIUQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AVGVRWYMXRRX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CLXJODNHERHU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RUFEVUMSOQXR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WHKQJXKELYJR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CJKLXUEJMVCJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/PKOEOZEUJQMU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZZTFUHNJWNBG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZJNZNJLFXDSR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XUOYURYPSGTI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NSOLJEXJZYNL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GTNCYQERTNUR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YYKVYXHEMUIB` Europe (London) `arn:aws:controltower:eu-west-2::control/NOACZITNOFIL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RTMLTTPISDQU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XUZUWYWQFJFI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EDRAKQMAORKE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YVHFPLXVZJFJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SKGWRFAEEAUZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OHXMUXUWTJTT` US East (Ohio) `arn:aws:controltower:us-east-2::control/WJYDNSSTJUZJ` US West (N. California) `arn:aws:controltower:us-west-1::control/UMATVVTIVRDT` US West (Oregon) `arn:aws:controltower:us-west-2::control/BAGLUYVGLRFN`

CT.OPENSEARCH.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.OPENSEARCH.PR.9	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CQEEKOEIBBIV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AASYBLNJTFYE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QXOGTDBDLUJI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LITFPWDCFWMO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZQAMBSNTXDIJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GWVTUMUOXNCX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TAOGFQGDMGOD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UCOLFZDGGJJQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GLPWOLQVEQJQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LYXBCHEEZPVN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZFTZSJUIUYUR` Canada (Central) `arn:aws:controltower:ca-central-1::control/IXYPCNJPAVYP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MGUGUPHVHUUC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EJVVGUIBRFZO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GKDVQZTOHFQG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VRDRYTJLTAWF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NPIGGPFBLBTJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ICDKMTFLINVG` Europe (London) `arn:aws:controltower:eu-west-2::control/NUKBIYHBXOKQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CUUDCPZYQEDD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MVYIGHIVSXCC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ENOKJPRMLWYP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SNXVGVARRXYR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DBOUBKGZADQE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KHZCMYXGFVCV` US East (Ohio) `arn:aws:controltower:us-east-2::control/CZMXNAENBDTR` US West (N. California) `arn:aws:controltower:us-west-1::control/PHDGPGPDNLRZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZIBAOFHKZHQY`

CT.RDS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.1	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 CM-8(1) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-13(5) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(6) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 2.4 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YDIFCPCASQLB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PHKJMGXZWMWH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GYEHZOAWYUUR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IQZLHKCZPRDQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ACFMYSTVSRBK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HZBEHSXYTYJP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JEHZOTCTRSDL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PBWERHRRPVKE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XFYDDJQMPBSV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HUPJOPPYSUGA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BPVKEWVTUWLR` Canada (Central) `arn:aws:controltower:ca-central-1::control/QFAFUIKDIHXA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NGZCEDHORKNM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZRDOEHVIOCLY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DQYDQALNZIZZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GICLLRYRAVTC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UMPYPULZBKMV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ISZORRYWJRHN` Europe (London) `arn:aws:controltower:eu-west-2::control/DKTUUXJADDDB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RAGAKMUCIMRJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YLJBMFWYQGIP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YGNVONVKFHAA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UUBOTNXZHMLG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TNHSQNYQQZFT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CIPCPCUPIFSX` US East (Ohio) `arn:aws:controltower:us-east-2::control/CPBJPVIEHMMU` US West (N. California) `arn:aws:controltower:us-west-1::control/RAXPKGFBBHIP` US West (Oregon) `arn:aws:controltower:us-west-2::control/BXNPKKKAPUL`

CT.RDS.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.10	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LBQMOFWQPXZS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZNKDVOVBDAVE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LXVULOYZQAOH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SECLZXZVIEZO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UXAVTPDBVFPF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CGCCLNZVZFEY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XKOPEZHNRZWX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QESQSXDHEYUX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OVTFQMGWPNHM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UZRSPFWZQTYU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ELLZCEANXPRO` Canada (Central) `arn:aws:controltower:ca-central-1::control/DVXCTDPQANLR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ONNOHNALHBAH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TVWGQAXDABKP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OLNLHXEKJZGE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CKJESAIGJNTU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WKXDONNKFYZU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LYZSDLIUYNXH` Europe (London) `arn:aws:controltower:eu-west-2::control/EAHGNZJQRUJY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IXRCLTJDINER` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LXDGZHIMLLKF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YCHMJPARDTMD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QFKZNHJKTIYZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NNOKBENVMLPI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TDLAWEVSVJFW` US East (Ohio) `arn:aws:controltower:us-east-2::control/MIIGPMTVJKED` US West (N. California) `arn:aws:controltower:us-west-1::control/NZKBJFTZDXTE` US West (Oregon) `arn:aws:controltower:us-west-2::control/YISDVYQBVSTR`

CT.RDS.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.11	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DIVKMUVKJCWC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FXBSIFWKQXOD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BLRCFNBJELWJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IFJMWZQBHUIV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HRHVBEGGVKUN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZZRRQNGFFMLK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JOXYQPQMCAXO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RLRMHNPBZWMZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OXXJQNOBPMSW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NHKXBYQLKDDS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZFNHHDPYTJBL` Canada (Central) `arn:aws:controltower:ca-central-1::control/HTVHIQWPULEZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QGPYEJMHJHPN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XBPNREGMWEXZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EOHTLNPNLAHI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NBWURONLVXRT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AHXQJSVNVUIS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QLIQBXFPMWQG` Europe (London) `arn:aws:controltower:eu-west-2::control/QPIWXZNGMGLE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OCJRITLFYKTI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KZYGQTBLAIMC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JNEGMIOFANOA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NWDRVUJIWSMZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FLMYCPVPBXRI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SBVAEBQZFXKJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/QPGIONOVKEPL` US West (N. California) `arn:aws:controltower:us-west-1::control/NAWSDEKFNZXA` US West (Oregon) `arn:aws:controltower:us-west-2::control/SAVOXDMXWEWV`

CT.RDS.PR.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.12	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NMXEXSCYFMNR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ECVBIUCVKDHD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WIIXHZHCCJRQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LXSLBPHQTPFE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FILLVTGDMVAK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SKNYYPGEGZZE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SKKORLKAZAOP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ILUJFEPHTBGC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VQTXJCSDCVNL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GBNYUHASXVMY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SZBDICZIVCPS` Canada (Central) `arn:aws:controltower:ca-central-1::control/RVAPYALZJHLY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ORSIZKYRNJQK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SIIEASJGDLTH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XLUMDEETUGPN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GVLKLASFFMRA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SSMTAROOYQXY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XSWQZJIDXEXX` Europe (London) `arn:aws:controltower:eu-west-2::control/WVSJOPRGOHET` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BEHCRCBSQEYV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UECQPAZMNEAM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GYCLJLXZUCKP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CNDUIYYWVZYV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZHQOPQLAGHIW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UDBQCAZJXEAD` US East (Ohio) `arn:aws:controltower:us-east-2::control/WGTGNSNVQASQ` US West (N. California) `arn:aws:controltower:us-west-1::control/XINXZMQZMGBS` US West (Oregon) `arn:aws:controltower:us-west-2::control/SHDPEBVLNYBQ`

CT.RDS.PR.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.13	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WQOZJPDGWHXW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OPTPMAIZQHQV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ANNPBISWZVNU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BFSGZKNINMRH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CEVYQIDVTPJR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PKVINHPDQTMI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BIZBTULXELSX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZQVRGYMNSXHA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CWTDAVDXUYNS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TCPYXNOZETYP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JLSRQQSUNNSY` Canada (Central) `arn:aws:controltower:ca-central-1::control/WAJLGTNLDLJS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XVPZAGNVDDKT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OXHETOCAIGYR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IIMGJHZTBAFN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UPMYISEYCNAV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PXZORCGCQERT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZTKNQGKSPGTR` Europe (London) `arn:aws:controltower:eu-west-2::control/VSSGLBOZRHRD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UFCJQENIQMLM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WWCJGJPMADDZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZHHLWPFNMOOS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RWYLYEFWQHCJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XVXISEOGBUFM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YPJCCMKZJPTP` US East (Ohio) `arn:aws:controltower:us-east-2::control/LMAWCCZTMZMW` US West (N. California) `arn:aws:controltower:us-west-1::control/DOGCTOSZOKKF` US West (Oregon) `arn:aws:controltower:us-west-2::control/MZGZCGGQSWRE`

CT.RDS.PR.14

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.14	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GHXHZGKQCISF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SAQBRAUEMBWQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BMFDQZNVAVYO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XEFJXADORGJR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DHBPZUFKFKMP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NVAQMMWPIIPQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QEDAEPENJIPG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DLUNYVZCXARR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HSIZECNPMUMR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IGMNPKJRFZMT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KHJNQZHZNMBY` Canada (Central) `arn:aws:controltower:ca-central-1::control/AUSMNRMJJUFG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FWIYAMLIPWZL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XSUJHOIXWMWV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RMQBHTEVKHEX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KCPAXGBPPFCI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MLNEONXEGJIQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UHEVILPYODIR` Europe (London) `arn:aws:controltower:eu-west-2::control/DMXHIYJDVVWS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ADDPNHNPIOYV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZQZLAOUGWCLA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SMTJTNSFDIOV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CJFLOCVDNWPP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RBLXDVVKFFTW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WHWIIFCOKJQR` US East (Ohio) `arn:aws:controltower:us-east-2::control/LMBFAGECJTQZ` US West (N. California) `arn:aws:controltower:us-west-1::control/PIPVMVSYYOSQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/FGOSLUOXFYBB`

CT.RDS.PR.15

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.15	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CM-8(1) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TCJCRQSDCNJK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZATLSZLRTTSE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YLCLBFJJGFDZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QJOODGPKZYCB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YZEEBZWVNKYW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KTCRRGSRUWGR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FCTFOQPGTEYV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IYNQLANVHZKU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RZHJAVYJQGUI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DAKSTNVIEZPX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CRDTQDJYSRKA` Canada (Central) `arn:aws:controltower:ca-central-1::control/KYNERGDEMOGQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NNIILIDPTJRP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DUOALUMXEYPE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OZJOBRGREXZT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EXOHLMGVBSIW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IZYWOFWEAIVN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HJRGQTAYQARY` Europe (London) `arn:aws:controltower:eu-west-2::control/OCSRNEWRPYWN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NJJLPGDHHZWO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MSITXUPZCMQA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QGBYVDCJSOMV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BJSYMTKHMSPE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BZCJRGOKMRDB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BIMBKOKMEZXP` US East (Ohio) `arn:aws:controltower:us-east-2::control/BRRGKLOMCWFQ` US West (N. California) `arn:aws:controltower:us-west-1::control/MOKLHGMPEKSI` US West (Oregon) `arn:aws:controltower:us-west-2::control/NUDJWWFBHWYF`

CT.RDS.PR.16

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.16	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZDPIPPFFBMJA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NPBHBWQUQZGY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZNEMLOPSODLT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JPOWMFDTTQPT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OVSTMOQMNPMI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FWAZWNKRMETW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DITSZVHZLYOM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CFYQQQEJAFFV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JCCMUPZAXMMW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VKMGPRNMLCBY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QYJMTCCOYDNG` Canada (Central) `arn:aws:controltower:ca-central-1::control/ANFLBGZRYMCQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NEUJCNUIDIOU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IUFBLXGRTWQL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MALKWFCLFDSJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JCRHCVJEBEBF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YLBWSAETGREA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WLPOBBCCAWEG` Europe (London) `arn:aws:controltower:eu-west-2::control/WUYFXYDNPAJI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ODZOBMQWAVBS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HJKGUNVPDRFG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TDMDJTUKFLVN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DWHYDBFVSUUJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TADJJIKRHQAR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FYVNKTVAUTPK` US East (Ohio) `arn:aws:controltower:us-east-2::control/DBQOQVLCRDJL` US West (N. California) `arn:aws:controltower:us-west-1::control/MZZNTZGDUSZJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/XRFPHUIOBFJD`

CT.RDS.PR.17

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.17	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GZZZWRTEHCNU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EQZLUZVLFBMG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QOUOAILPPGLH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OUWNJTTOMXIL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MPZBVXOJLRKF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UBRPEHEOKHPO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/USENKGRNCKYN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ODRTWYAHZKPB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TKAIVNUOZEOP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WUFEZOIZMXBA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BGJEHLNQLZEX` Canada (Central) `arn:aws:controltower:ca-central-1::control/CBUKUNUOEILM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ASUNKGVVFPXY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BEOEOCVQSEYO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PBDUVVQCOKDV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EQURNFTUNIJC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UKQUAWKOJNPA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IRQZDEJQMXLG` Europe (London) `arn:aws:controltower:eu-west-2::control/QAJWDRVODFWX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WECTXDDEGGMV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WFCMRGLIGBCW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JZYIMKHAWARU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BUPIBJRNVOLH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VIYXJSVPVORD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SHNJOPQEZHOH` US East (Ohio) `arn:aws:controltower:us-east-2::control/XKWPQGYZXAMK` US West (N. California) `arn:aws:controltower:us-west-1::control/IZDMIZEKSPDS` US West (Oregon) `arn:aws:controltower:us-west-2::control/YHBMVYOGUEDD`

CT.RDS.PR.18

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.18	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CWZDRBGTMCFC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/THYPQJUMLHKT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PFPVEOVUMUUT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YHSXDDXXWITQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GXNWDDJVUIVA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YKUELCLADAOM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BAFZPQAZNEZZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KOPCQNKSYEUZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TXDOPOOEFOGJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QNTSSYLVYSBR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AMLFAOVWRYRF` Canada (Central) `arn:aws:controltower:ca-central-1::control/MKVLLPSIEPIO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HTOVAPFGMPCJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SQATJDIQJNBP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QZFGDRVZILTN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DKDJTNLQAPPR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EAEIEZEIHAFS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RQCDURNMVVTS` Europe (London) `arn:aws:controltower:eu-west-2::control/KMKTHWDXNXIM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GFMLOENIRNTC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YEZGGAFXIYJM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CBBGRMVCOBGK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DUKUHXPYNTTR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GLYKLGYIXELE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HMGIGLGDRMZO` US East (Ohio) `arn:aws:controltower:us-east-2::control/KRKPUXQSNVYD` US West (N. California) `arn:aws:controltower:us-west-1::control/SAJRANHECEJB` US West (Oregon) `arn:aws:controltower:us-west-2::control/GGCJMMPCKNQG`

CT.RDS.PR.19

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.19	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WKBAYNVADIUJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LNRLBVGINMLU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KZPGJXHLYHQI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZPVWJRXNPQEV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KZEWMMUENGWQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TQMKLIDIAQMF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ERNAIMFFVIWZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LYWQAOJFKFQC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AKURSKMXIRNZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BXCUKDZSYLOG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BRIRJRUIOZMF` Canada (Central) `arn:aws:controltower:ca-central-1::control/PJXOOIPSMNDA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XZSPKESDKKWI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IJRUYUBPGLLE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YBVHYRANLTFI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VJKMQYKKNXFJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YFBPWSKFZXSI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZSLSJYMDJBAL` Europe (London) `arn:aws:controltower:eu-west-2::control/OYIGFYNODQCL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YXSNOECRRPCO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NLBLQIJTVACH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IVRSSKGVLLGF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZMSKYBINPWUQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SCWLPXFLQOLI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OURUAERHLOFJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/QWXNKLRWSHXQ` US West (N. California) `arn:aws:controltower:us-west-1::control/TGIEXSEQNZVU` US West (Oregon) `arn:aws:controltower:us-west-2::control/XUPYDDLWHDCG`

CT.RDS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.2	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(6) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SIATJXQTJBLB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EENMWZAMRYDX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GHYSHEHSCDNB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TCGIZHXWOEHQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZNQTIVZBEPPV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YEQRARYEJPWA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XROOMLOUYAFE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KOSPQCBQOVFN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LNDHGBLTEXAL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SPKTRDUPPMSL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BKSOTGWHUEPF` Canada (Central) `arn:aws:controltower:ca-central-1::control/OHBBTGZTMHOB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PRGUXERBXDAQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KIUDKGOCBCKH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TKPUTYVVQYZJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DJNVNBXZYBEQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JFVJGUVNPUJF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YVRQVGLIXYVC` Europe (London) `arn:aws:controltower:eu-west-2::control/VVIDHBCRCKCU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HRRACFGWIYQK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JWACQDFHVGTZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UTWCWVNIJWHV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PKEZXVUBPQNX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TRBXUMZVTQAJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MQISZILRTSFB` US East (Ohio) `arn:aws:controltower:us-east-2::control/UPOYGSXRLXUQ` US West (N. California) `arn:aws:controltower:us-west-1::control/ELDGFUEABECL` US West (Oregon) `arn:aws:controltower:us-west-2::control/SWFLJNEBRLPT`

CT.RDS.PR.20

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.20	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZNDMTUXUOQZX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KTYTTDOYXIMZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UFTOXCOOXJTV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JLKKRIKEPPCY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CBIDNXQGCCKR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PJNMBTVRXJJA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QRJPDJCXMZTC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QKDQFKMGVHSO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RKTXRGUXFWXY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AZTJJPGJOFEO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BHRDIKZLQNSU` Canada (Central) `arn:aws:controltower:ca-central-1::control/RZBFFTPJOGCG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NLIBRFKTPNGZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PIDUQUOPTVRY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FGJJSXEZBZCC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XISVVPFGPUOP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IOPGZLIWNWGE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SMMMDVYGDPEN` Europe (London) `arn:aws:controltower:eu-west-2::control/JCFELHAYCQWT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QOQDDPHNUIBX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UWGFBJXQKIZI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UJIXWOPDCJHE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CSVHKEOUFHDG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PYAFZHZVXJDW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MDWFCNUYEZKH` US East (Ohio) `arn:aws:controltower:us-east-2::control/HRHVMSEIAPUA` US West (N. California) `arn:aws:controltower:us-west-1::control/JPCMKZJLBQDX` US West (Oregon) `arn:aws:controltower:us-west-2::control/DCGLYOBFHDPL`

CT.RDS.PR.21

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.21	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PLHGNFBDWEBP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DHSGTIVFXFLI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XJJPKIGGEEXG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TJWPIOJAICUN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HFOWJUBMOZXB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AONMPRGSRMUB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HPXNNRRQXNXI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EIXIRAFPVPAO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GOGYCLISXJIE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CFRTFTJOZPRW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GABVUUUQLSDB` Canada (Central) `arn:aws:controltower:ca-central-1::control/EHEHUGUMGNMM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AMPSQVWJUTPB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GFJCUGIOTNUX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EMHUDINOARAM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JWDRULGYQLUL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CSKCEKSCEMJZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RORRJYOCKMFU` Europe (London) `arn:aws:controltower:eu-west-2::control/UUOVCRJHMURS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RUOZMJSADVLM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KALBIBZRIQMT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TRHZBDVQRBFC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RGFWRMBSGIJA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ANABXNFAQOIG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EITXJLKFTQDP` US East (Ohio) `arn:aws:controltower:us-east-2::control/IPSTNJIEWMCJ` US West (N. California) `arn:aws:controltower:us-west-1::control/KVUPQJROGLHO` US West (Oregon) `arn:aws:controltower:us-west-2::control/VPLSUHTSSKVN`

CT.RDS.PR.22

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.22	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MZRAJDTDFGWC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PNYCUZBPTAYS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OPPFSUXBZGNN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BEJUKSCJOYQQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SWNLNNMLXINQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HYNXJZMOFCXV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KAYUBUDGENWW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QQNXZYQVNBCA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SIJETKICNYSA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YZCWKMNAUEXZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AKPEAYGURAXN` Canada (Central) `arn:aws:controltower:ca-central-1::control/NIABCZCSXRUW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EEZWQXHRKSYG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QORNHGGYQQUS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WCAPGBYZBASC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UGDMTHYBNQGN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LWXPNTJGDTSG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VCVBYURVMJWL` Europe (London) `arn:aws:controltower:eu-west-2::control/LUZHXFABWGPZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UNHYCCAWPERQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PFAKFIEKPAUL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XMFPDXVIZDTX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OWPJIIXMSYXL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BOBJFVMQPNFA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RPMTGTPXFHVA` US East (Ohio) `arn:aws:controltower:us-east-2::control/SUICXVEFWGTF` US West (N. California) `arn:aws:controltower:us-west-1::control/ZGRERLGFHIXR` US West (Oregon) `arn:aws:controltower:us-west-2::control/IGEKWWYBNQPL`

CT.RDS.PR.23

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.23	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OJJPXBDLLIVT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WHLMOZJDXYGQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FTLPOWEBBBYY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NNNWMZYHHRLE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AVEIAINBMSJA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BCJOWGCTPYMI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YAQQWPIJLYKN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VDMHBDVTTKRC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ODZTKLOPEVYA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OXCYOZPUWJYP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/COUBETKLZEDR` Canada (Central) `arn:aws:controltower:ca-central-1::control/SMCLOXFTGGJR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DVYHJPOGZNBF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FRXXRRKGQQKV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AROTJYKQNBWL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GGFMCMFBGGYK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NDCXNZRTTIHH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TRIXKGVKMLDO` Europe (London) `arn:aws:controltower:eu-west-2::control/YVLLDDQUZNZT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AQYGAZWHDBUS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FFIYPSNWVNNZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WQOLEVYCLUFN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NGMGOKDLFZIX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VADBVPKHYESM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PWBOAFLALALP` US East (Ohio) `arn:aws:controltower:us-east-2::control/OULNFNUJHYOY` US West (N. California) `arn:aws:controltower:us-west-1::control/AMIKEWYRCSQD` US West (Oregon) `arn:aws:controltower:us-west-2::control/BSINZXEGCDDE`

CT.RDS.PR.24

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.24	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PINCLJDJZDRE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NDNGNJIYVJRO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HNUUDLAMFESZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SBVCZOZVTNSM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GCOSKKLRMNIA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VXFCDUYXIIEX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IYWXHEMRRBHL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SUXNKMQDMQML` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UGDACEBUCTME` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OTPOYEIELITW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YRBXFHAZOBDB` Canada (Central) `arn:aws:controltower:ca-central-1::control/VIDEBVCBMMHE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ULFMTWYBJBHT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OXPVBOGEOCBY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JZPWXKOZQLJD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OKHIGZARDBVN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TKHIAGEFUESQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KCHAUDQMSCNA` Europe (London) `arn:aws:controltower:eu-west-2::control/DELGUCWUVHUC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZIGYAICEYDYE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MWZFGWBFEMJH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YPTCDXVCWKKT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OAEXNGTGWQQZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MZOWKNBAGWMM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GFMSMJAELTVU` US East (Ohio) `arn:aws:controltower:us-east-2::control/TENQAWFTXMFK` US West (N. California) `arn:aws:controltower:us-west-1::control/OZIQMHPFNUDD` US West (Oregon) `arn:aws:controltower:us-west-2::control/GWMSFQBJQUIL`

CT.RDS.PR.25

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.25	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JMCDFXUFTOUV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GAGQXONTSUSO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RTJTUOJNOFCR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JBPGIHOLPQAK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PUEKRODEBBUP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IZGPUABATWSO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SLXKVCLUFUOS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YZYQYLIOHQYM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BLFCABKJKCSA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RJUTOOZNCKEA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NLPDDLRTCAKP` Canada (Central) `arn:aws:controltower:ca-central-1::control/LOBRESBCCMGM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LBAOBDKAGHAF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VUIXASYJJRGW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GOGLMDRACQCK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UWTYXFPZQYBR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NOYMFJNNHNHI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JGEKIJTIJOSK` Europe (London) `arn:aws:controltower:eu-west-2::control/ZWYUQWFMKUZL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YRAESYFGCCEX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GJBEJJCSWGUS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VEFXXOGWBCVW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CVFIBPQFEOQP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AQDTQRHKAVWU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JURZAEDZNDKU` US East (Ohio) `arn:aws:controltower:us-east-2::control/MAIRETSDAVZB` US West (N. California) `arn:aws:controltower:us-west-1::control/OYUJHWHZRFAZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/MMEIVHRLITAO`

CT.RDS.PR.26

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.26	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VWVTYKUVAGHJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KVYNPGJBLXLU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FKSFASOSTXNY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BZFWVEHFCCFU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UQKHNVHGPOWR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ORBPVZYSXABE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MITOITKKODEW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OJDUBGHKGQQB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BVKOXCFDOIKD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MJPFJBRIDKHB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RBQVQFLWMKBY` Canada (Central) `arn:aws:controltower:ca-central-1::control/TRIRJEYQDGYM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CXDSOVCFVFYX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JLVSIDEJQRID` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EFVUBBUPADGH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AKZHYZVLMTUU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VLQTLOMEXGXO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LBDIIENDYYKE` Europe (London) `arn:aws:controltower:eu-west-2::control/JWQUNIZDMKFN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KBIHFZMXXLDB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WKKZTYFCSHZQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SKZUDJFZFFJH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CKZDUOFIWTSH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NVXFZNYAZAUC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EKWKLGPDQJLB` US East (Ohio) `arn:aws:controltower:us-east-2::control/UOTNWAOXMKFV` US West (N. California) `arn:aws:controltower:us-west-1::control/LHYRJFVNLWQQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/LJHTUFUWMNSD`

CT.RDS.PR.27

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.27	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HUBALWDIIVQS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BEGEWHWLTLQX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MWMICZOCTCUU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DLNNZRJFAVUQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XVQBQYGEVFTF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GOZZPVLEFGZW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DYGITQIOGDAU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PUUJCQPUHPFB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MXUIEHDNELEL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OFCALLEOFMGC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BZJJFMUTKLAJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/IJDHMCUQRDCK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GLCRCNWFYCTG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TKODCROLVQJJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BRBGLNWYTWVK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZTUGXIGBTLID` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WZXNLDNKNLVX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LINDXCLKUMKB` Europe (London) `arn:aws:controltower:eu-west-2::control/MNVMJRNLXCYQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NRCURWPDRVCJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DYMVWNFMADTP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OFJTXHNEACQL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GMRDOFQMQSNF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BYDWLWNZTZXK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OJOUVLIKPVKB` US East (Ohio) `arn:aws:controltower:us-east-2::control/DFWHSEDVILEK` US West (N. California) `arn:aws:controltower:us-west-1::control/SLQVRYTYXRQB` US West (Oregon) `arn:aws:controltower:us-west-2::control/MRKXJWFJJRQL`

CT.RDS.PR.28

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.28	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FBUWPGBDNDMW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GJSTALHQPHWY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NSXQRRSJUTDV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YBAVATEFAYXD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SFUVHQQVEFDL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UZSJIYMNZODO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FEZBSKMFNMGO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HXFCVUHPMAEZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YWVWIGXDKBQC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IDDASOINPLGV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XQNYXEKDZIGQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/MCAZDRFZDIGR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FDPOTDSWRYOB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DTZFNFQEZOHT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KSZOILIVLSSP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OWTKAQNKCQAC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZNYYUQNRWHZU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KUPNXNDKDFSW` Europe (London) `arn:aws:controltower:eu-west-2::control/BGUABLZKUWCW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JPHFKUYPIXOQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HOCGBEZAWUUG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MNPNMYCBTFHJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PFKXLVTVJXHF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LOYWKHZHISMP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CLDYWYXSBRPJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/DWDVZTVDTCHU` US West (N. California) `arn:aws:controltower:us-west-1::control/BCSWJPXDTOAY` US West (Oregon) `arn:aws:controltower:us-west-2::control/SRHWCAMZVXEP`

CT.RDS.PR.29

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.29	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VQDVPQMKBQQG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IUQCAALGVVOT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KXQTVNUROGBG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ONGMKQSWCAUO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KCZWZONUSFOV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EZDGZGLBTFVT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NTTOSKRXZHSW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CYHFJUMZYCFE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YXBEPOZGPCVV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MBCMHNLEZLER` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PPQBRTYVMGRF` Canada (Central) `arn:aws:controltower:ca-central-1::control/VNOLGBJQURAH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ILPIBPLOXEMP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QSHFIWJPAOIR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WNQWKSITAWHV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FWTKLSNLBFIW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NVHELPSPKUIW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EJFHDHQIXJPH` Europe (London) `arn:aws:controltower:eu-west-2::control/CTJWZOHSYKQF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LYJNHZCJMWWU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RSDNCWHZUOJM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LCBKQQDNBZRN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QLEEMHZERMPN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FLUUFKKXRUXQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TPFQEAXLBPUP` US East (Ohio) `arn:aws:controltower:us-east-2::control/HPWWSBOVPXCJ` US West (N. California) `arn:aws:controltower:us-west-1::control/HDFIQVVMWIKD` US West (Oregon) `arn:aws:controltower:us-west-2::control/EJOWBXOSYQBZ`

CT.RDS.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.3	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TGAKQPBVZILV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MPNWLSENZAYK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZTRXNVYWDDKT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WECZXRHVKCNL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EDXDFSJCWFCR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VFYDRPBPNNBT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BKRLOXVTVPME` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BLXJDLBAERSW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KGVGCJNUMNIY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DHDWZPYMBDIM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZUSHTBGQWBDP` Canada (Central) `arn:aws:controltower:ca-central-1::control/CKRDGQKNEBYT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GFFRRVSFMQUD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YDKULBFMYXBM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XBFXYKVROTZV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EYGXDYJGBYNQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AOUESOKIFERI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NOCXMVOIKGCV` Europe (London) `arn:aws:controltower:eu-west-2::control/IHCWENDKGMLN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XDFKDLURAACK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CUMZYTYFVSMQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CMCSHPTESJDL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WJHSOFNUAKYU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OFANCHVHOJOV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BOMCHCSYCWLF` US East (Ohio) `arn:aws:controltower:us-east-2::control/AHXQWQFGSIMC` US West (N. California) `arn:aws:controltower:us-west-1::control/HBIGKZQQALFO` US West (Oregon) `arn:aws:controltower:us-west-2::control/FUPEXQIQKQBN`

CT.RDS.PR.30

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.30	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZAIUJQNIGHIX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LFXMNOXDXAIJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PXFZMHXIYFXO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KXUYYQUYMDED` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MSKZVZDUYTGJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SAPCIDKSBCGK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QTULDYFDWYKD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RQLVEWDZZPYI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NQDURRVJLGNP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZERCEPRQWWGJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OIFDZPETJXOW` Canada (Central) `arn:aws:controltower:ca-central-1::control/SBRVREBPUTAB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OPDYHNDKSQWG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YAECKWZFOOZJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LNYHPQCLRBMX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YEHOOVMSRITJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TEINIMWOQEPH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TFADKFDLROQJ` Europe (London) `arn:aws:controltower:eu-west-2::control/KTIRNVTYTTDV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HVEMRBONMUAE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WVVDSQJZQIHS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JFWYTTFPFPHH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ADPDNJOLNHMG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LSPMJUWETEWN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HTFNRVTOKZFX` US East (Ohio) `arn:aws:controltower:us-east-2::control/LYXIMVCMGVYH` US West (N. California) `arn:aws:controltower:us-west-1::control/UKCFVLHLBNOD` US West (Oregon) `arn:aws:controltower:us-west-2::control/LBWJETISFWXS`

CT.RDS.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.4	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.7	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FUZQRLUKMSLX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QNCIRBGCPRTM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KNMITJGFKRMB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MCPSKMJZQIMN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TQTYWXQTGLKU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MZCFSYUEMWCM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KROECLWFGBSA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NYTWXXKQNPYV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VGJJUWDNFDIK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PDCYLHOTAIMM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PDNOCLDCOFWK` Canada (Central) `arn:aws:controltower:ca-central-1::control/OMCIGOBMPXNW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SJFWAJASSZNA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VFCIZSFITDKR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HIBKFWHCHZZB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QRLJHHAXNPNO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OGXVZKVWCSZQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UGLMTCZXLMRP` Europe (London) `arn:aws:controltower:eu-west-2::control/TBMMMCCSZFKR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NVTALRUXITEZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TWMLGZJPMUQV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BIZEYWPAADCF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FUOEEGGFJKSE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BXTYCUJTDLQW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QWKDSRVLGQJM` US East (Ohio) `arn:aws:controltower:us-east-2::control/ERWYFDVEMQSK` US West (N. California) `arn:aws:controltower:us-west-1::control/HTMSOGEZDTJN` US West (Oregon) `arn:aws:controltower:us-west-2::control/LNVGZGRHGCBU`

CT.RDS.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.5	NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WHRJIORZFXIL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XSRLBIOJYKOP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NXKKTRZGYRZU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JEXJDXDQQRFV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BEBKSCLLCLJN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NJPGNYPGHMDZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RMEBOYADJYHO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VDGRXWMZIRCD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VTWUXLYFANSP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MREYKJJSEDQR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UAZNUSWPRZEL` Canada (Central) `arn:aws:controltower:ca-central-1::control/AORICFZECLOS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BPSCCXVAHRQW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FEDUDFHBPLRA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TBCPKYPZUHEB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TTGUYMVAMNNN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CBPIFXGZJJNU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JPXAHNOKHUZP` Europe (London) `arn:aws:controltower:eu-west-2::control/DOWVUJVPLQQT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IUDQBUPOZZDC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XQNBEQGNVQWD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BHBFDGUIOXCD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ODOFJMTXGTYJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UJWRDMFPBFQR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UNSIZPXYZKNF` US East (Ohio) `arn:aws:controltower:us-east-2::control/IPSVYZXQYJLE` US West (N. California) `arn:aws:controltower:us-west-1::control/WRUFJIMHOAGF` US West (Oregon) `arn:aws:controltower:us-west-2::control/ADSPCSQCOOJB`

CT.RDS.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EHAIRIIGWOHC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UUNYJSTQKTKJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SAJABIITSFKW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AUDENQFLMRAQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/THYQNOGWGHDY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GFPESZSMOHKB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NIOPCRPPKCLH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BKETESOGWHJT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MKNYWNVXKUKG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AWIDKJQLXFPB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NCROQKSZJXGB` Canada (Central) `arn:aws:controltower:ca-central-1::control/BPTUKBOEYVEC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YUYGWYRMEUFS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZTPWDSBGJDAX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PQYEUKWXZFFK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EUQFJEGDJXIV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YRALCCMNWDHT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LZHVTNVJQMRF` Europe (London) `arn:aws:controltower:eu-west-2::control/IWNFMALKADEV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MLKHAVAVKXZM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FZYLTFYIKQMW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ORKATQKFXFVA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZIERFRYDTVUX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SKHLGRRUWSCQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HQQCINNCIEGJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/WKLWHFDYGDIM` US West (N. California) `arn:aws:controltower:us-west-1::control/SWMFSRJRGPJD` US West (Oregon) `arn:aws:controltower:us-west-2::control/JPFWRQLJMFBF`

CT.RDS.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.7	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.7	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PZZASLHINUOG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DQCWDYIPYKCU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EGQHMBKZVKBO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZEUMSSLIZDTU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RXRBKIOMOQMD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BFMJVHXZBFLS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MXFSCTLATSLV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GUBOIKVNFYHI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BVMANNHHVIJJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VBTYNZMZDTYX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LFKKWGDLREGN` Canada (Central) `arn:aws:controltower:ca-central-1::control/OPZBMSCIYMQF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RVULDNZJGTET` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KCOHVMJASNKK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BUGVOINBXVCD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YVBIFQKSPPZS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CXYFUXAJHPQB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LHNLJBQEXQKS` Europe (London) `arn:aws:controltower:eu-west-2::control/RNNKLRXFOADP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UNIXACIXZYGS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RPAEKITMRPNP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XXPPJUVQZLJF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JOFZXRMJAVNR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YPOIUGJSDKUC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EFJRJBUAWLRY` US East (Ohio) `arn:aws:controltower:us-east-2::control/GPJEVOVWCHSF` US West (N. California) `arn:aws:controltower:us-west-1::control/PHVHLAPJJQGY` US West (Oregon) `arn:aws:controltower:us-west-2::control/JVVEOIUQBJOL`

CT.RDS.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.8	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HBYTLQZEWBJU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IMAZHUOGWZDJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DOHISTPWUUOA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HODAQWGBTRMP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AZHRBFNVKFNO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UZSCDCCOFFDX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QPZXSLCTJRTB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/COJXSEKFZEKX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GJKUHDAQKCNH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UKEUAXDWKKOV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ISLVBOAJZVEO` Canada (Central) `arn:aws:controltower:ca-central-1::control/LOKAOGKSIRIC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XJUSTKGWBGZE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EVZULDEEAKNA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DTQGIURTBPQD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YBNFFKWIEBFT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NDEWGWUPTERC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RKNKNLPLALQZ` Europe (London) `arn:aws:controltower:eu-west-2::control/XXUEQVOEMTBR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CUKMUVUZEYMY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RKBUVYZJMOTF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JAHDSPUAMNCH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CQKACFXDBNPO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GMWCTVXRUZFJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QETNOOVEKOPL` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZFQDCNLBJOYT` US West (N. California) `arn:aws:controltower:us-west-1::control/DHYENBVXUTBF` US West (Oregon) `arn:aws:controltower:us-west-2::control/DJXFRUONYPSS`

CT.RDS.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.RDS.PR.9	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XNLOIHBXMWEG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XOJJRCDGSROH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DUHRNEVTDQKM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PPBGZVGLKLZM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NHSQTNZHEZZM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LWNVYRAQEITA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CBIQOKTFVUYG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YKDWRIDUGSBS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TBPEWWYHECGP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WZXMVXZMJQSE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XXMTCRFOUHKV` Canada (Central) `arn:aws:controltower:ca-central-1::control/RGEVPCAEAOUT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NCDQFSWPREWO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RPARTQJEXFFY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UVODEWUUJGCL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BDWHSYNRGSRD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UNAQZKVPTXJA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MHMKSJQAYVLS` Europe (London) `arn:aws:controltower:eu-west-2::control/JQYWTSKVECRE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RWJVBPHGKPEJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ULJWZCETBUSG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UUCKIWMNBHJH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KXFJPHMTSFCI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UPFHHERCEHQP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RDSPGIJXTCPR` US East (Ohio) `arn:aws:controltower:us-east-2::control/LUAEZZMOLTOL` US West (N. California) `arn:aws:controltower:us-west-1::control/DUDBSXSHNGZK` US West (Oregon) `arn:aws:controltower:us-west-2::control/QQXOAGHMUVGH`

CT.REDSHIFT.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UMIHKTZTAPAV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KTGZUACWNWFG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XWIEKIDJYHHM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XOLIHOFJYQAC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NYNGHXGLPTOR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GAHFLNXXDQAI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZNGCFWPHZZZI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GFDVQJMASRCB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QUVPAAZPCFDZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CXPPSTSYRQSR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WXBAEMGBNRWL` Canada (Central) `arn:aws:controltower:ca-central-1::control/YTYJJRRXOEZW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YGJYWZCMOADX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BDLGAVEPWIGV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HOLURSRFKYOJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OPDYRIMRTAUP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YDWWSCRJBNCT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EIYJRPVVJYQZ` Europe (London) `arn:aws:controltower:eu-west-2::control/GYTCMRRVKDHE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YSTTBPHVAIZB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LNLXEWTLDPFS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/THILQHSAMURX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DIMRCSYAFFJX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TPIGKZDHGROC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YKEAYOGIETJW` US East (Ohio) `arn:aws:controltower:us-east-2::control/RRSNGKZVNEYF` US West (N. California) `arn:aws:controltower:us-west-1::control/VLKCIDKWSEGH` US West (Oregon) `arn:aws:controltower:us-west-2::control/UJZASVUBHZTV`

CT.REDSHIFT.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AIZBOYVPCGKE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QZYFQVJMMFFG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VJQIDPSRYYRH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZQKOUCATIZVK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/AWOJXMBCSBDF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CUMXJYSQUGQJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NQJJKYHZHLFG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KGGVMOPMMNLR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CMTVPJTIHQTJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IVYOUWQFCUYQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MZVFTANPECPP` Canada (Central) `arn:aws:controltower:ca-central-1::control/CXVHRDCRTVRV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CDAXWWXQMPDQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UKMXNAGLWZPR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WLAMYNHXYYHV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ESNVKLAVFXDT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JREFGBNJXLVP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XYBNZEOWJKVT` Europe (London) `arn:aws:controltower:eu-west-2::control/YYWXMDUAJRMJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BMHVJQCPZYCS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PWAHNLTYVHXO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NWNIKXIDOVHQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IBCJZFVMRGAI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TABJCEBJRTAX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VVOXNJWWCUTZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/LGKVXBCGWVHZ` US West (N. California) `arn:aws:controltower:us-west-1::control/AADIBNWLNLVR` US West (Oregon) `arn:aws:controltower:us-west-2::control/JWHYTRNOCADA`

CT.REDSHIFT.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.3	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UCTWBOSNRLBI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LTBATEGEWNMS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JTZSPKUCZEQP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OCMBDMYSNHXV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SXXALIODJECC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UJYYBSZJHUBP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GNWMBRYBYGUG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NHBUDLMZCDGY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TZMQFTLFIYII` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XNBKEABVQQNA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZXYQNPTGYKQK` Canada (Central) `arn:aws:controltower:ca-central-1::control/XBMWWNUQRGVG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DZIEVGGPLAKY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZLLOCCPTQIAA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LLXYEQNHCCLQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SYWHYDTEGYGB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SEJVFMINHDOC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YTMBWVLJKBOM` Europe (London) `arn:aws:controltower:eu-west-2::control/BYITFEKIBLPM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OFQPEFLHYEMQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PRSABXVVQPVT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YYYLKDSNYUDI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QUMOAIIVCBRD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AVOAYSYOEDSH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TIGRGIIZLNWY` US East (Ohio) `arn:aws:controltower:us-east-2::control/BUXRPTPENLDJ` US West (N. California) `arn:aws:controltower:us-west-1::control/FCEWLKLDUMMV` US West (Oregon) `arn:aws:controltower:us-west-2::control/MPMZYZBUMBNY`

CT.REDSHIFT.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VIBECVZYWWSO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MKNPMKKEUYRW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SHAQANKLSRUD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PLWSDPNGNCXK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DDJAPOKCNVKJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JJYKTICMBNII` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GOOMDZFIUXFU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CVUXESSIFPVI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DJJVYZTHHNQU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OCSPCZDHKDRV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IKCXEHXYJRVE` Canada (Central) `arn:aws:controltower:ca-central-1::control/NHAZVUYWKCGM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZZCSSWYJZRNT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IGBVEZKDDPSK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NHBHTNDISQFC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QZFMVCTTFKUN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UJAYQIWWPSSB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DZFJXHWGWBCZ` Europe (London) `arn:aws:controltower:eu-west-2::control/KZSEIOFDFFYQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EAQFEOAZNUWH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SKQGXVYSUDGZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MTESQPEDNIXA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SQIZKBESVMUI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RYCBSKQCSOSH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RSYQCHSJXMVQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/XXNRIFUPYIEH` US West (N. California) `arn:aws:controltower:us-west-1::control/FLUEZVKKTETL` US West (Oregon) `arn:aws:controltower:us-west-2::control/TIIOZLVHWXUZ`

CT.REDSHIFT.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.5	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YHKYPMKIWUZD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MRBTRPXKSMJJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DWDPLRTCTQRK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DMBWTCJTWZZK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XGNNEXTHJQXK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JVRPBPFUFXUO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WBHCBQEKKHKE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VEVOVFZBXPGU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ICXWYEEBLZWH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TAQKKKFUBKOK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZPHIEJALWKIB` Canada (Central) `arn:aws:controltower:ca-central-1::control/JNUTHIPQTKAP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XZUANQNWMUNB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EULMTTKSTDRK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TZHUCKEGTHPU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FWZBXDSFUZQJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KRAGXMCVHQPN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BVBKQCZDVESL` Europe (London) `arn:aws:controltower:eu-west-2::control/JDKXPTYUTQNJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OKSRLWUXPPFR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZDTMVVHBNUXJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MLKXPOPMOFWL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LXLIAICWIGFD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RSKDADCBGTGR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MVWDSPIZQQOJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/GNIRCUDXTGIB` US West (N. California) `arn:aws:controltower:us-west-1::control/OUGVPYTMYFZA` US West (Oregon) `arn:aws:controltower:us-west-2::control/KXJMDJMVXXWA`

CT.REDSHIFT.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.6	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KSKJRCBRSNUY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EPJUXEYJYXRT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KWCQMVWGTOPI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CYDYXNVPIZPG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XKEHDXOAJSOF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IQZBJZUENUEF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PQYAZYVNBWKB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OWUUGCUQFZTV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KCSAGKLDYNMB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DUBPDVDVASSS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BGMYCCKJSXSJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/LXRTGBKAVZRM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IZQOHUIEKSPL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UDPJFGOSUOGB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GGTQQVUSXOOX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IOUDDDYHBUYE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VKKSWSROCOHY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RQFUXCXKBWOY` Europe (London) `arn:aws:controltower:eu-west-2::control/REMWHXAQOGLG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YGXMJYPAWNUP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NFCFLXUIDXUY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TKWVUVUVFRVV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ITWHNJQRRKHM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BBVVBFHIHERG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XSJEOQVHQNRS` US East (Ohio) `arn:aws:controltower:us-east-2::control/QLHEQGBWIYUX` US West (N. California) `arn:aws:controltower:us-west-1::control/GUDFCNXFHQRC` US West (Oregon) `arn:aws:controltower:us-west-2::control/ESTXKKJJOWTE`

CT.REDSHIFT.PR.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.7	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PHPNUHCYJIVE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FQVGIHDKJGRS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VURRKCWICXXJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IDYGEAGGLAKL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QPKHXJWAXBEC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WPOFSGASMAFH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MBZBYWQHWYYA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FFXXGIYUCWRF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IJMLIAVPGIOI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MGZSFFRPJXNJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HDAJOFBSCAZC` Canada (Central) `arn:aws:controltower:ca-central-1::control/QJZMCJVYCOGM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XDROKAROOZXV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RLOOAQWWOHBT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LHKEIALJJGLM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZSFLWFHDEDNW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PVWOHRPFVQOI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BDXFKXOPITMD` Europe (London) `arn:aws:controltower:eu-west-2::control/QHWQGOVEKIMH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QPDQNIGEIGEQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VLLTDCCBFDKE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XIOAMLVHEFKA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TYRAJFRQSVFZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GOVQURJVCYFX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XTYTGDHUVKCR` US East (Ohio) `arn:aws:controltower:us-east-2::control/KEUUEIKIJQLO` US West (N. California) `arn:aws:controltower:us-west-1::control/NHUXUYYFUUYB` US West (Oregon) `arn:aws:controltower:us-west-2::control/QIVJIJPOKQWA`

CT.REDSHIFT.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.8	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NHQCIPXIUDQD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GZGTVBEKIPRM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HIUBOYXXZOJV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DHAUGOPSEXMD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EZYWKAOZZJCS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WIWQCADWSSNJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FWDUXFDXQCQQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VUQFIBCPLZJU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KLGGBJEKOFDX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LLUVKHVOTYKB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/USTDDCUNOJVF` Canada (Central) `arn:aws:controltower:ca-central-1::control/XQGTRHZSJLAS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EDEMXYSBXDNA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BLZOVYUTPRKW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TNFUUZTWVOQS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TJTGHSRKCADO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NOLKAZJRJDVU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DXPHOEZMTCQV` Europe (London) `arn:aws:controltower:eu-west-2::control/LQVZJBEEQCJF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KCHBFRLLRIXU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RSVAKLQRLQXN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MFRBWMZTPOZX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GACOYCVFQSZR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WUMVGWBHXOSQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EXRBSBIPFHWH` US East (Ohio) `arn:aws:controltower:us-east-2::control/ALDUSRLWSQYM` US West (N. California) `arn:aws:controltower:us-west-1::control/BMSSGAJEZHXB` US West (Oregon) `arn:aws:controltower:us-west-2::control/WIYETXTZFNNA`

CT.REDSHIFT.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.REDSHIFT.PR.9	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DJABACHZCYDN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QWLIPUMZTIWB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NSOMCBUHYDTR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FGEPIZCARZGW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WMHZVKNJBHHH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VAKAVHVBZRLT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NXYUJNVDTBZP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VLSFPDQGTLEZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QEUHIRFGEYFM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BEDTSJXBPYRQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MEFKMQGDLMBW` Canada (Central) `arn:aws:controltower:ca-central-1::control/JTOTPCSGXPIF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KRQCDKYDLPLN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KCIJAYENPABP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CHKKYPAFDIGQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ERJCSGIBWPXF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KZEYENTRZSQB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AYLFLQSRCCSQ` Europe (London) `arn:aws:controltower:eu-west-2::control/SOXMPAPMUVYA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MPEDXGCIBIPD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XIYTJTWXILFJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZVIYJKXRKFLQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CKWTJOGCULKB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BETZTXCWFTGS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YRDLVNFRHKTV` US East (Ohio) `arn:aws:controltower:us-east-2::control/AOSGZRUCDETW` US West (N. California) `arn:aws:controltower:us-west-1::control/FPGMPJBMHZJM` US West (Oregon) `arn:aws:controltower:us-west-2::control/UHRGJXFBHKWG`

CT.S3.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.1	CIS AWS Benchmark 1.4 2.1.3 CIS AWS Benchmark 1.4 2.1.5 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 10.5.5 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LRNINXJVLTOI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HUGVRCBOTHNS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HCYQILOQAJGP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YKBYYOORVYDQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BTKLXPIPPGWE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DVQUCYQSSVYJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QNVOFWQBEIMN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OQJNJIJYYDVN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WRGFYNFNMLEH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RDNVZKOXQRBS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VMUQKKURTFQH` Canada (Central) `arn:aws:controltower:ca-central-1::control/SDAWDCRWPYAZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KXJQNRHPLFXJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HYLHRTALKCXA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WRHSEHIGMPNL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FAKNTWCVJBBQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MKKRYHXWDZFZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/INPHVGNNYWHE` Europe (London) `arn:aws:controltower:eu-west-2::control/TGRGAWCJGDOT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LHQHRBBJLOGX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YUWCIXIDGEIX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LUNHKATYXLDY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RYKIJHRMZVMS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GZSJPOJMETOS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HOHCXWHXKJEM` US East (Ohio) `arn:aws:controltower:us-east-2::control/FKMTMPNCBGTR` US West (N. California) `arn:aws:controltower:us-west-1::control/UQDZOYXHSTJV` US West (Oregon) `arn:aws:controltower:us-west-2::control/BAGVBAYKIDPQ`

CT.S3.PR.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.10	NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NPHPUZYHVOIY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UNAIRGRMSYDE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SDKAAURVKROM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AJZIPUOMEHPW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IGACBRUIDHRL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZVWFNYUTBJQX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HWTOUVQXQKRI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XOELWGITRRJP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XUAWJGYLSKOU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SZTUWIPCDHJA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UZNLVDVSMHZC` Canada (Central) `arn:aws:controltower:ca-central-1::control/KLKYRVHDTSNQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HWUKCNBPQJPH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZQTNVAGIGWJJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IXTXSHXVNUZM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TRPKHIGMYXAO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SKGFYRDINXPI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WHMUOFUNYXLE` Europe (London) `arn:aws:controltower:eu-west-2::control/YJTFSUPUCWSG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LOBZZYSXKUEK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RZGKGHPDNNWZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QZDCTXCJVTPY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EXSNHHJHWXIO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PJFOMSANLDYK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AZDYETJYRMPN` US East (Ohio) `arn:aws:controltower:us-east-2::control/WOZMWZTCVLIG` US West (N. California) `arn:aws:controltower:us-west-1::control/QVGKLBYATRGP` US West (Oregon) `arn:aws:controltower:us-west-2::control/NAJMVANQPXLA`

CT.S3.PR.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.11	CIS AWS Benchmark 1.4 2.1.3 NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.5.5	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IXZSFQFPXBPB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VYSILMRAEEXW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AQQOPEFIXRLY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CCSEYYSAWFKX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CICQLRNYABRT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YRTTYKIGHXEJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JAQQLPHVMOTH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NFQVYRNQZULR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EUTFKNVDBWID` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TISETCEVQBZY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ERNMVMJMMUCD` Canada (Central) `arn:aws:controltower:ca-central-1::control/CRTXZSITMULU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KYZJOMCMHGSG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WNGIRGIYRUQC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DEHWLVENFBQF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AOJRFFGDXYLF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AGJXNIDFTLTH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OUGCAQGTCCFY` Europe (London) `arn:aws:controltower:eu-west-2::control/IHLVKARQYKMH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LGLAYYIEOEEN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CXDTNMKWUDQA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YJTKDVALYOKX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CCLRZDGTBJQX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QMKXNBUDMJAF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EUDRJBCNBNSX` US East (Ohio) `arn:aws:controltower:us-east-2::control/QTKNBUWIZPYQ` US West (N. California) `arn:aws:controltower:us-west-1::control/UHIVEVHOTRUS` US West (Oregon) `arn:aws:controltower:us-west-2::control/YMXFKEAZKVCS`

CT.S3.PR.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.12	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CTUTTRYQQDKZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JIPOQDUYUWIY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HVOIYQGUXWZA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KBDEDURVZELG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZNLHSTMRAXLF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YAWOMMVYLVVM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZBROMCCSOOFU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EPLOMJJLWCUG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OVQWGRGYNWTK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YNGEMLONSHEF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GSOHGIFWYQYG` Canada (Central) `arn:aws:controltower:ca-central-1::control/DKCURRUTBBZV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RZOOIFZZQPXT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UWNPYFLXEDJR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YZVBRUKJWFNH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VIENQADPDJBG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KETGOTTIJKZN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UQEOCKFZKPPV` Europe (London) `arn:aws:controltower:eu-west-2::control/OKIBGUFCIMGS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QXHDSSDRZJGE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HWBNGRAMKESL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LVEWHJAZVKYQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UYAPTSOOUMSX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YLNFGYIJAWEV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KQMZJOTZIIXZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/REMJCAKGXTVB` US West (N. California) `arn:aws:controltower:us-west-1::control/ZOMFZREHPSFB` US West (Oregon) `arn:aws:controltower:us-west-2::control/FQJPZRMZNTWE`

CT.S3.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.2	CIS AWS Benchmark 1.4 3.6 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HIPGBZKDQSKN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OXUZJOSNXUGV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EEJURBQMFYKX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UTCUYXQMQXRC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PAAXMDTZLCSW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FQXYYRCXLSVY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DJANZMGCQEVC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BPVHEZBCMBZH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MSRDMFGAVCXV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/USOLSRKTDAXD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HUJNXXTHLDBM` Canada (Central) `arn:aws:controltower:ca-central-1::control/FGDZHXUFRPHF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LMPLBWVGMUCW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UEZMQHOAKJKC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QIGDYVQVHTOY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RPRQAYKWHKVE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZDEKKVEJKNZR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NCKAFXMYIELC` Europe (London) `arn:aws:controltower:eu-west-2::control/DLJVQIJWPVWK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EHHLHRKQKEDX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XNQIIMLEGLWO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TQKVAEGMISUA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FIUQQJAZYWBP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QODILHSQEUDJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QUYPCYYEALDZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/FHMUCMMRQQOS` US West (N. California) `arn:aws:controltower:us-west-1::control/WTJNFTFPDVEU` US West (Oregon) `arn:aws:controltower:us-west-2::control/LWFWEJSLVKVV`

CT.S3.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.3	NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Optimize costs Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BHNCVZBGRDSF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JWYSSJGWQIQI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZZWZQEUOXAHO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZXKHHALOBMMC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GDPYJXJBMBRS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OGNPSHWCNUXG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MEPSJMORAQQD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MGLDCUIJSXOP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RRBBSRTVOULJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TRWWVPDNBLSG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WUBXNLCMSYUW` Canada (Central) `arn:aws:controltower:ca-central-1::control/TWVWTNVBNUJI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BGAFYFTRFRWB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RRNBHHGJPSLY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VKFFQEXOWYRO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UBEKETDJHQDK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WTJTRXBVKECG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PPCZRHIWWDCO` Europe (London) `arn:aws:controltower:eu-west-2::control/UYIJGHTLYXYJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KEOGAUVAGIWC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HAIHUHROMERP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GOIDWKLVOXEO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HOYKRAYORWNL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AKENCMOJFZIY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WNDCHAPIOWPX` US East (Ohio) `arn:aws:controltower:us-east-2::control/NMQZFXOBMETI` US West (N. California) `arn:aws:controltower:us-west-1::control/PMCZHCYFLDME` US West (Oregon) `arn:aws:controltower:us-west-2::control/GGFPMXFOJMKL`

CT.S3.PR.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.4	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(4) PCI DSS version 3.2.1 11.5	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ATMHOATOZICQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RKMCRSKNQDMF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JIKPKVBCQTZZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NGFEGYCAZMOQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QPOADHZNFITP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HDFMAXJXVUNX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HPSJSQXKSZHV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CQYPJBFGNVRN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TJVPIRLFQNJU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XWCENVGPFKVP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VHKXDIWZQDSN` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZEZHYRLECUPJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GVTLGKIYRXAE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TGVKWKNMHKGV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JRZYMZVVABUE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RQQQDSQMSXSE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OWRWJJMCRCQQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HMPQSWNZRQVD` Europe (London) `arn:aws:controltower:eu-west-2::control/ODQFNKZAVERW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FWDLBIIQYIXW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NKSQUEXXOXSL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LELWUYTFETVV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HZZGGKDJSMKW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BLCIONDMMXME` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YBVXNKBMJYZO` US East (Ohio) `arn:aws:controltower:us-east-2::control/NBXPLAFUPVPO` US West (N. California) `arn:aws:controltower:us-west-1::control/AKPXSEGLBYYY` US West (Oregon) `arn:aws:controltower:us-west-2::control/OQTGURFVOIFX`

CT.S3.PR.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.5	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.3	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QGMBAEOHJWGP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ONLMVXNYTOQO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SKXEZLRKRIFO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OUJUGYPGPBTR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HCNPCYDQYBTR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KYICILZPASAZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FIHXYREBYHQG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IKFLVYCSQUUW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XBIANCENZNPT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NKZLNBHHNYWR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NMAAILPGVXAN` Canada (Central) `arn:aws:controltower:ca-central-1::control/RZFOSHDJDWQR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QDUMVVXOVRJU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UGOFNNRHFKRL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QTKVXJRHKVVN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GXPXMXODYBYO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NZFRDTFZPLNO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZQNUYRNLELMH` Europe (London) `arn:aws:controltower:eu-west-2::control/KLPNFIYSSKEX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UHGKAZQPWHYD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZHBXBCQPAMAO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YMIRPBUXDGVZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HLIDPMXKIOFH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EIXEGSOMQYMS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IIICSISZKWBP` US East (Ohio) `arn:aws:controltower:us-east-2::control/QOSGJSIWYQBY` US West (N. California) `arn:aws:controltower:us-west-1::control/LQTJJUFUBRCL` US West (Oregon) `arn:aws:controltower:us-west-2::control/OGTDJUZQBTOQ`

CT.S3.PR.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.6	NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Optimize costs Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XBKZPYOKFUZT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WPJQQRRMWAVW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/URWGYOBMHNOV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RPCLZYKICEAM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UIWWHNMZAHUB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IJYFTUFPBGPV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SCSYAFKBKFET` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SIFXKRHFTFJV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WVHLLZEVRMCQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MENFCLCEHUMV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JJROZZPYLDSV` Canada (Central) `arn:aws:controltower:ca-central-1::control/JVKPEBOPGEKW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HYKSATXAETXB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GKFFPPVNGUOY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZDOZUWMODNSH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CTTWTIWREUJJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FAAEXSNAJBGJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PTGEBDEGHRPD` Europe (London) `arn:aws:controltower:eu-west-2::control/FABQOCRPITAI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SUHIETMCJFVC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IDZZGOPLRKFC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FOVYOXRGRRDS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WMOZGCWHFQPY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IHGNYILKIJRJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EXSYSTLXGVRE` US East (Ohio) `arn:aws:controltower:us-east-2::control/SPSBPNJTBZZK` US West (N. California) `arn:aws:controltower:us-west-1::control/PCNZKGERWRYG` US West (Oregon) `arn:aws:controltower:us-west-2::control/WIBGVDNRDWQR`

CT.S3.PR.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.8	CIS AWS Benchmark 1.4 2.1.2 NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/STVAPGCPQSUT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QFTBTLBFFQSQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QWXAZRHGAPOF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KTRFCYEXSTXR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RVFBVPTCPJHI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZWZWDEMHXOHI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XQMJUIQTGZYX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EVSHZCEOCLDQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BYKXCKKRYVIV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KZHGCHWLWFGO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QPPBAOJDQLFG` Canada (Central) `arn:aws:controltower:ca-central-1::control/GIQAEXYNYBIQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RRMXKKLSMMCO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FXNNHXMTPWOB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VXOWMBPGJWWG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BCLBADAGFADV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EGTVZTLAIMXV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WWINGKFVKVZX` Europe (London) `arn:aws:controltower:eu-west-2::control/VMEGHEZKVRHV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JSFWYVSJEBLH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TAZUUWKEQXPV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ASXITBMOMFBS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BDABORJSMRZI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DMPZVJVZMWZN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KQIDXVAURPNL` US East (Ohio) `arn:aws:controltower:us-east-2::control/XACDBPRGTLYA` US West (N. California) `arn:aws:controltower:us-west-1::control/HXTNWGMJJZGM` US West (Oregon) `arn:aws:controltower:us-west-2::control/MPNBMXJVAAWW`

CT.S3.PR.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.S3.PR.9	NIST 800-53 Rev 5 CP-6(2)	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MCGZBCKMXTXN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KQCIATXNKEVO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HSMBYWLJEVPN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GEANURJHOSJU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DARIPVIIRWUC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YDWMXGHWKJDO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WVTLJTCJUFXM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HHIBSFXWAOFQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MOCNFRGVJQIQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KMRGDQJCVIKH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MNQSVFBXEKDQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DKOVKUNLSMJU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DOSCMGGEBQUB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CBYRCOKJUEIW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NMEVAZFEZWLD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QUSGEFKIGLXK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HPMQGMDDKGSQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XXUOTYAXZIOM` Europe (London) `arn:aws:controltower:eu-west-2::control/KTUXUGJYXVEO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EQCSOZEMFEOS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AKLAOZHIFAHX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QWHWEDAKJQJE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XDMGVMGSZSXJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HXMAUGJKIZZI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YCXCEZLFPPEZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/EQNXZOTUEHEL` US West (N. California) `arn:aws:controltower:us-west-1::control/MMPITMGATTGG` US West (Oregon) `arn:aws:controltower:us-west-2::control/CHIOVWNEUBWJ`

CT.SAGEMAKER.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.SAGEMAKER.PR.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QMVMRDVZDKWA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UOYFCMRGSGQX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KABHYKBSJCDD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IHHCXMIJDPUY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GLVFJPOFPXNJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EOQDTUMRBXGY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WXNSWEWICMMI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HLYGAUWTYVRB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KJAHYCKSSRAA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/POCEBHMEGHXJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QNAPKIUXFEPP` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZXUCDQEYSHPT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FSUJOVACPHJM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XZRBQVWNHOOL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EECQVSZWLOXW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XBMHGBXUTPTS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FFOCTNBPTMAL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XRTOTOYPMYBC` Europe (London) `arn:aws:controltower:eu-west-2::control/NFMRNEASBICM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KVUSHDIZGCFC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GUOCCAAHNGEK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QVLCYLNWCVQZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SQBNRAQIOBDV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PKJBXQYFTRYT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NXBXUFEBMYSV` US East (Ohio) `arn:aws:controltower:us-east-2::control/BILKEGTPYTLO` US West (N. California) `arn:aws:controltower:us-west-1::control/XKYIJGULCHJI` US West (Oregon) `arn:aws:controltower:us-west-2::control/BAYFKDFICPXR`

CT.SAGEMAKER.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.SAGEMAKER.PR.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ACIICOUHVBVV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NYSYXCRATNBX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XRQNSQZACILS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AJUBXQWZCNZA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WLJGIWFSJQDK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZTZRIMHDVQSR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FWLXIOSGXLZD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FTKAONSNGNFD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WHZCFXEMTXVF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PYUYQRAJTEYR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PZIBDNEVGZNV` Canada (Central) `arn:aws:controltower:ca-central-1::control/MCLENUGHMFXO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SSAOHZOHNKPC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ORWQSQDZDZFL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SCTOGVXJHSTW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FQOCOBHBFWNB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DFQMNGMINELE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YEXOMFQQIRQX` Europe (London) `arn:aws:controltower:eu-west-2::control/BCODMJVNRAYE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TETZPAGYDAJQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RBCEKQMEPPSR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BPGXJEPKEMPW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EFQSDWADDOVT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YDBJTBBNNIMH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BFRWUSCUMZGR` US East (Ohio) `arn:aws:controltower:us-east-2::control/GJVQQNCVKMEK` US West (N. California) `arn:aws:controltower:us-west-1::control/XGNLGNXPWUFA` US West (Oregon) `arn:aws:controltower:us-west-2::control/OXZGZLYYZZDX`

CT.SAGEMAKER.PR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.SAGEMAKER.PR.3	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.1.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HRMNWAHHHTFT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MAMFMPGXSSSQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HCJSGYPXGJZD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YKZDBOCKKZBP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ODRNGAVPVJLJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MWSRFJCKCMYZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RYVXFMPGIYGK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BORBTTFXSVMR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WFSJGEHTGUJD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JGRCEFMTNSLL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NOZHICOKJIJR` Canada (Central) `arn:aws:controltower:ca-central-1::control/PFWXJZLGHZHS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XGSJWJUCDSDD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OYPVSQELUEML` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VECRJWSQKKJX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YIEFICYWYZLU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TVCLBFAMYSLY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QUAMXLGBEEBM` Europe (London) `arn:aws:controltower:eu-west-2::control/FFLFBLHYHRKH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NRPXZDRCFVEM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JMEFHEDAXBAE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JJNUJERNVMJV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KNZFXFKXDIKD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YHWVCTSCOZPQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HOQUZBNWPSKO` US East (Ohio) `arn:aws:controltower:us-east-2::control/MDQQIVONAGJQ` US West (N. California) `arn:aws:controltower:us-west-1::control/JLDGSDBFPEIG` US West (Oregon) `arn:aws:controltower:us-west-2::control/PGQSNZZVPTNP`

CT.SQS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.SQS.PR.1	None	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OHHOHNXKODUA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SBDRRPRISVPY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JHJLYBFELNSZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HBILQHCZJFAW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YWVNSHOTESWX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WBEXRWIRFKJL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IMICLTIIQHXY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OCQCVFYIRMUH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RBKKATWLGQVS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BVGSHIGLNFAP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DGEFIBBKNNAY` Canada (Central) `arn:aws:controltower:ca-central-1::control/SCSCEOQLMMEP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OYPHJPNFBWWN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CSMGZDWGUJGL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DALEUNIJKTHY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GMPKONEBTSAP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UEYNXEJBYMSM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WQDIIQGFBSCM` Europe (London) `arn:aws:controltower:eu-west-2::control/YGMMIMFHGIHD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ITBUKBXKLPRH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CAMCCUUHVPFM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IOBECTBBGGEI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HTWJNZMMPUNH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BUBHNTXSNVHH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WHMAMEUKIFGE` US East (Ohio) `arn:aws:controltower:us-east-2::control/LSZZWCFWWEBV` US West (N. California) `arn:aws:controltower:us-west-1::control/PYPJCABAISCE` US West (Oregon) `arn:aws:controltower:us-west-2::control/LIUFDWXIUWLF`

CT.SQS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.SQS.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AWUNOCUECLQA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HGMWZIVVMLXP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XDDGSSVPQAVQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DTARWAFQDLEJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HYGNOVUHPJWO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JAGVXXXLXSRF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LQQXTJHPPSCL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LLQBEYVBONPS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NWPVCUCMYWJV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ERHGIIDRLPCS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TCOMVFDNXJHQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/OQPVUZBBDOKR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DNDLXKJDBGSF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RCDCYANDWUAI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZIGSJHHCJDFF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MLKLUIARVDHN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BAJGOTFZUYNO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VIRICUDUZRHZ` Europe (London) `arn:aws:controltower:eu-west-2::control/MPPVBHPMBSNZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UWKPBOGUMVAX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PZGOUGUCUHIE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LICZJVRRYWOS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RUAWNTLATCEP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DCLDBWPADGYE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JBIFAREFXJYH` US East (Ohio) `arn:aws:controltower:us-east-2::control/RXJEPAOSCUYZ` US West (N. California) `arn:aws:controltower:us-west-1::control/VLTWPSHSLAKQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/AQUJFJQURUFV`

CT.STEPFUNCTIONS.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.STEPFUNCTIONS.PR.1	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WJFYNIIKQSEC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QIWXQALPOWVN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ERZIMFMFCIVL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BSARINIRFYGL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ITIIXOXNEGVY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FKXONMCUFEDB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LJSINXGHBENY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CWLRWPTPGQVD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HYFUIUJOXQNV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OUZWAONSGGYA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QNCUBTYVDMNK` Canada (Central) `arn:aws:controltower:ca-central-1::control/RJCWEUDWEBLJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NAMQPORQVXQM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MNYFKBIEUNXE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CGAFSUBVZBJH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YVHXPCMYPLFP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CMAQXQSALRDW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SBVYLFYIIXPP` Europe (London) `arn:aws:controltower:eu-west-2::control/KDFTTNMHFBLL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JGQQRQVFLGDJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FPNHTOWNICVK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PJTDUVKFZBWR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PHYYVEOKRMOA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RILHLBPKXUXU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RARWRIGRBHPM` US East (Ohio) `arn:aws:controltower:us-east-2::control/CUOQMOAQVWNG` US West (N. California) `arn:aws:controltower:us-west-1::control/ASZQNSJURJXR` US West (Oregon) `arn:aws:controltower:us-west-2::control/OFRNXQNITJES`

CT.STEPFUNCTIONS.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.STEPFUNCTIONS.PR.2	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TYPGEIBRQHQW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MWCJKKKFLGQI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IXMAHHUSDUVR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FLVJBWFDWHDJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TVTNAPHRDRZU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YHNWBNXVKOZP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FXOEUGCCOWIH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JHBUWWHFLVYG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BUACWBSQOPNW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MXXULKHAVUNN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VUVJNJRXBZAV` Canada (Central) `arn:aws:controltower:ca-central-1::control/BZAERZJTDTLU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JKUFUGHYKGWF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RMLLZIIHUNYX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FLMFYWQVJDZX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ULPOIYIDRFWE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WTJHRSSHPAKK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MUNRXYWSIOUS` Europe (London) `arn:aws:controltower:eu-west-2::control/HMTTWOFYBDUQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GCMXGSVVIEUT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EEKQLYFIYRRG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KYZJXVQAORYF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LRDZXXUZTAVN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IBZBYQWSSFBM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BHEGKQAMVASL` US East (Ohio) `arn:aws:controltower:us-east-2::control/VXVKISEMRURZ` US West (N. California) `arn:aws:controltower:us-west-1::control/YANYRDEXXDEH` US West (Oregon) `arn:aws:controltower:us-west-2::control/MSXYLKDPWZRN`

CT.WAF-REGIONAL.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.WAF-REGIONAL.PR.1	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LXWHHALWLTCF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VVYKYKULBINF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GBLQKIZJUWLI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GMIRRPOYKDSI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZJLIMDYSNJVA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PWYDDDJMHVKA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GMCXXVDXPPHH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MBRMIDDGSBSB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JGWGMJBHDRUF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ADCMSRCCWZPA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IZBRUNFKGILL` Canada (Central) `arn:aws:controltower:ca-central-1::control/TLTACWUKOMHH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XHVSSBIHIROY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JLHUAWBNDBHN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AYNFYQXOVCGW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PWKKZXICJEGW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DQMONWOSDETX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KTKPKIVBNQDE` Europe (London) `arn:aws:controltower:eu-west-2::control/CAGANIVPBXCM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PLLMIJKTGYDC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GEDNQOQRUGPJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TMFZMHPVGXBH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MVZLKKWDHKMA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FWZWRHWINCPZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DIPWBOCJUTTO` US East (Ohio) `arn:aws:controltower:us-east-2::control/UYFKJEOQVEWH` US West (N. California) `arn:aws:controltower:us-west-1::control/BODSSYLZFBOR` US West (Oregon) `arn:aws:controltower:us-west-2::control/TEMUMMEADETS`

CT.WAF-REGIONAL.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.WAF-REGIONAL.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PLBWFTQGUYPO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OCLEQHMCFSEV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SNJTGWLCRZLW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KOGUYYCCSEJB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QYJWCLEEOXNL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TKFTXHEZWGTF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RWNPUZWYHNMY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QOMUGMEGSIHK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QWRJQUNFEALJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HHXUYSUFAFPI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/THIHAAMWYOLM` Canada (Central) `arn:aws:controltower:ca-central-1::control/TYQHRXOLTMRT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RMIXORRPHOQD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OJMMCNHJKKIC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IRXUIROUYYYS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KMLHOMCISOOF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZEYPELWNMQGB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DLVXAPJNGYIP` Europe (London) `arn:aws:controltower:eu-west-2::control/ECJHXMXRZBVQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TRZOIIDYBNNA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MQXFOURKKFIZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NCJSSEWLAPCP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DMWNVMCVVLCU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XEDCRXBBIYWT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FQEZXYFKDEXW` US East (Ohio) `arn:aws:controltower:us-east-2::control/BOCYBRNEMMGS` US West (N. California) `arn:aws:controltower:us-west-1::control/YYCBBISOPTCI` US West (Oregon) `arn:aws:controltower:us-west-2::control/EQMCVOTIUSBY`

CT.WAF.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.WAF.PR.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GQFGYLKZJIDA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NCRRNMOLKHQE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TXHPCTJXMEXT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PLNVFAREKZXP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XKVNIOEEWELE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XANETJVAEOSW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZFNFRZNGHWKO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AKUBJOAGFDTU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LBEBQHSFDADD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KCRFFFCEBPEA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CMRLLTLXFKCK` Canada (Central) `arn:aws:controltower:ca-central-1::control/SEFPFJCQOYKK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XVRZCGVSPYIL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EUOUIEIKSRQK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IRRDWBVEEVZR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZDJOMTGOHOJR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OVMOWJDWSHZX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ELFPBLOGRZYE` Europe (London) `arn:aws:controltower:eu-west-2::control/LSGSHIHBLVLX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JSPZJEWVUVFA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BLSNAPKCBEBR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BHBCIBBWQQLS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GPIOUFKAZYRX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZVSTKBQVFFMQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UNASESNVHVZY` US East (Ohio) `arn:aws:controltower:us-east-2::control/VDXLZKVLPFSH` US West (N. California) `arn:aws:controltower:us-west-1::control/SVRRGEYNFUOM` US West (Oregon) `arn:aws:controltower:us-west-2::control/RVKEXLTMXJVJ`

CT.WAF.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.WAF.PR.2	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OXORBSCQFWTQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WVKFSXCMOAFB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WGLOYXOZAYLU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HWDELIBEBVFK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TLGQQBOREOSV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TZFBNAETOMJR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TFNTAHCAFOHL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VULAATRXMKNA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZWQCPIXANTTE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BWSNHISVRCNV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ENLMLRVXKUMB` Canada (Central) `arn:aws:controltower:ca-central-1::control/WKAOAEEFQEGB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QVEBBPUQHHTP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KGUPKWOEJMQL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HAFOBOPSXWQF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JNFJCDGBQAQJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HSIXLKCRSNKW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LAPESUGIQGRW` Europe (London) `arn:aws:controltower:eu-west-2::control/FHTQFTBMJHIC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XQQXGFIHZHQZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WMOWJPCZJWTO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WIBXCFGXLPLE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IQGCTIQOKDWL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GHWIKZXTBTPW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EVTLDFVJREHX` US East (Ohio) `arn:aws:controltower:us-east-2::control/TESBXHDTYCVR` US West (N. California) `arn:aws:controltower:us-west-1::control/NSQKESMWRPRQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/WHEYGYOKBFEE`

CT.WAFV2.PR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.WAFV2.PR.1	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AFMIFZSFCJAM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ALLKEZAETGXV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QPSONUAQWAOR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FLFTSMDKQPGA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ATYEMLPACRYL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZJTWMPTTRZRR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HHWUXJHWSTHW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GXKAGSHEBLQA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ITRZPFPNHOVU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WRSGKTAMFUNN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GMGTDMVFMMIX` Canada (Central) `arn:aws:controltower:ca-central-1::control/NPVKWMPNGNPQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TJZLGRPBEFZZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CRGWQEGNYRWJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PQBMKWIWABGD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JUDFDFZUPGDV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/THNACPIXQEGW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ACZQQJXMSSKX` Europe (London) `arn:aws:controltower:eu-west-2::control/WNZNWBPTAQGS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RQXLAXERBFAH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DWWMENQHGMKJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LSQMTYNBDGHH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UGZFHMKFGWPJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OBDIKEAZGTAV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XEONMNFZMEEF` US East (Ohio) `arn:aws:controltower:us-east-2::control/JWKJRMTPQGYL` US West (N. California) `arn:aws:controltower:us-west-1::control/NIGBBACJPCNN` US West (Oregon) `arn:aws:controltower:us-west-2::control/KYOLAPACMMCW`

CT.WAFV2.PR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
CT.WAFV2.PR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FACNTUGQMNFD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OLRFCEMWLWYF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UKLHGBFDOUPK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YUWWRBUJCKWS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EVFGOLAANCYD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FQITWYCBKFGZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EBHCUTSNUBCE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GITZQTTINVIH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HGYKZRUFIFSG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UFZYEEYHGRGQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AUFYBCLSXDIR` Canada (Central) `arn:aws:controltower:ca-central-1::control/LZIRXMIWBDLY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VDAEUHLAPSJA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SSUYGEFIPPHT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CXJMVDJZHUAL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RBGKCDWRDJOS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WYZTRLBPOGAB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FBEJWAWHUGHF` Europe (London) `arn:aws:controltower:eu-west-2::control/JEGHUQJDAJPX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KJZYDZBLLWOQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KBPYZPMGKBZM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OCOJDDRHFTCD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SLSRAIGXMUXQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WKXZFSDZWWOS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BUWSNZUCOYKV` US East (Ohio) `arn:aws:controltower:us-east-2::control/JLKGLZGUQJYB` US West (N. California) `arn:aws:controltower:us-west-1::control/CPNWTODASNRJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/TMEPJGMZTEOI`

SH.ACM.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ACM.1	NIST 800-53 Rev 5 SC-28(3) NIST 800-53 Rev 5 SC-7(16) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RHAKXDBTIEGT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ILINKJZAUBAT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EYLAEGFQRCWO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TFNTUZCUNKTO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NOVKVGSZUZMF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VPNPOEIIUSHA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BLEYPKDZJBGG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MSYJENQMUXJK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PKBECMZKORWL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RADTNGUVDCKG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XBWNMHLTVUXT` Canada (Central) `arn:aws:controltower:ca-central-1::control/BUYCUYITYPVG` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PTEIFDJIFUXA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VYLDSKRLKKOA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GRIHKVQHKWEB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QPVAASCUWYZA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HQMXHNDIDVDE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QUAUNJRCXGAX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZKVPMZUWFGJF` Europe (London) `arn:aws:controltower:eu-west-2::control/BKDZMYWHGSGH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EJGKLXXBAEET` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BHVVGMTCSCKK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LKRUDMCVSJWM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NLXYKLWAAWFR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OWLPOEUWSXFB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MBCMJMZJGPLS` US East (Ohio) `arn:aws:controltower:us-east-2::control/WXFMEFMVTLUM` US West (N. California) `arn:aws:controltower:us-west-1::control/WRLVGHVNTPDD` US West (Oregon) `arn:aws:controltower:us-west-2::control/ANXKMBZMHTME`

SH.ACM.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ACM.2	NIST 800-53 Rev 5 CM-8 PCI DSS version 3.2.1 2.2	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UYGYKEFSXKND` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KIRVIUNSQKAB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KBBAURDMUTKQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DZVWVPKKLYFW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NBVQLJGTCYXX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QGYUUHWATOQJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RIOZXOSFCWCQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JSIQTGMCBGSA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DDIXKRVKEQEL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QFVKUTAKRLGM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UIGSGHMWFEOG` Canada (Central) `arn:aws:controltower:ca-central-1::control/RPNDGPPSHSBC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AJEZZNVQOBHQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HSNWRETFPGVZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FEWXJGEFMQQI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RWLRYADXZPUG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CAPLCOSPIOMV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DOJMEBDUFBEQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PISVJSLLVEXN` Europe (London) `arn:aws:controltower:eu-west-2::control/UYLGMFYYLOTX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RLNQFIYBCUMK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JCJLCWMGKJHI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DTWRFDEYUWQM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VFGSUSTSNDGV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TZVKBKLRCSAO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OESYMJROOXEJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/NJCVUUULHBNH` US West (N. California) `arn:aws:controltower:us-west-1::control/TEJMSFNDHODY` US West (Oregon) `arn:aws:controltower:us-west-2::control/DAMNUGWIKMAB`

SH.APIGateway.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.1	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/URKKEQPNLRRK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MJRQBRULAJOD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XGFCWUSCPWBT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NWUHBVMJFVWU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XCHBDMXPJEER` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YLBGCOIJCWCO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XMRFZWNVYVML` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AGUZTOXVATMM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PWJUGOAFXGNW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AXKWGZOPXOSS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IRMHSGLIRWFP` Canada (Central) `arn:aws:controltower:ca-central-1::control/DHNKNPSWPETE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MHYVKCAWKHUA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UEDENVOMHGZD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BGGGFHIQMWSR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FVIRYJHPLBKR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OJWYTWCZCHUK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YOPBOPOJACLU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CBNMUENGDKVZ` Europe (London) `arn:aws:controltower:eu-west-2::control/LPNUKHXMNIFL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OUDKZHUFMKXZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CGELUPPGBTFN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KFKVXJAADXJK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XTDXJSCDBAHK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LKWQTCVNHFYV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OOTDCUSIKIZZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/YJANVDFZSBQJ` US West (N. California) `arn:aws:controltower:us-west-1::control/QVXVDPINRLPY` US West (Oregon) `arn:aws:controltower:us-west-2::control/TBTRTAXTTOFK`

SH.APIGateway.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.2	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FVNCGDJDHKPX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WLAZWIJKUHLS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AZWAXOWQMANJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RDMVJESGQCRW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NVFIBHBSLAMP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZWRPSDCJJTPW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CZAHYRLMHOVX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GCOLOAVWADDA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HCPQXEYLPUTG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ABUTULDZMDHW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RZZZTOVJIPDA` Canada (Central) `arn:aws:controltower:ca-central-1::control/FDWKKFDTSZXX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AJACCIBBMVRG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BBRKQRFGKHFM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MULJFVIFXBLB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JJLTDTNZHJXM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RZNHAVNIPXMM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ETYPCNOSOJHO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UADGCPBNJJBS` Europe (London) `arn:aws:controltower:eu-west-2::control/NSPCYWJJBDRH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UOSOHIJTHFCO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NXSUDTXLSSBD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RCFDJCWRLBUL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MEGAPADSAAZW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EJSPZRWREGJO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MNPVCMDMYSLZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/KPORKNTFQENX` US West (N. California) `arn:aws:controltower:us-west-1::control/FHQXJXTFOFWJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/YPGHQDSXNTVO`

SH.APIGateway.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.3	NIST 800-53 Rev 5 CA-7 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MEDXETNLKNET` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OLUDTBKWBPDI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UIZDZMDGPDQP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ACSVLXDDUUQP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DSBTUKIIQXLJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RDTQSQGIEQUC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TBQUNQISNXQY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TOGMXHEOYZLH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PMGEOVFNRWUU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HOHJRCHMPISF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AXHQAFKYIYZS` Canada (Central) `arn:aws:controltower:ca-central-1::control/XCCMVZSAVCXR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/GCCFNGHREPQX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BXICHCDHLEQE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HNDYMYILKOIS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VOYXYLQQEHGQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YLVDPPNFSIWZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ITXDIRVPSUJR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AOQCYZGINFNV` Europe (London) `arn:aws:controltower:eu-west-2::control/OELZOKBLNQGJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VYXBBUCNMVKX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RCFCWBXOIOOP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LSRIUTLAUOGK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ESMRSCFJFINP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HBBTGGYEXEVJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OBBBFBBHDUVX` US East (Ohio) `arn:aws:controltower:us-east-2::control/TSNMTDBRWMPT` US West (N. California) `arn:aws:controltower:us-west-1::control/UYZHEIJXHMDT` US West (Oregon) `arn:aws:controltower:us-west-2::control/LQTFJGDAOWKI`

SH.APIGateway.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.4	NIST 800-53 Rev 5 AC-4(21) PCI DSS version 3.2.1 6.6	Protect configurations Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VFGALPQSLUIG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CMOTURHXVZTD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XIGRNZOUFDKF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CWHOFIFMIUUS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MHHXYXZADMYN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RXPVPYDGQHYM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KFKDSICVYPFP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ASBMSMGXQKPS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JDOSDYPYPULQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PBJPPAHXJDDZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZJYVVFLPKAPZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/EZACRQZNMTPK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PVVPNBVFLELY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YYWWZOFOQNUG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ADWABZHHJUFJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ONNVQAVMVKBL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VSGRNQSGBKDF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LLPHCRGWHFSR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HAVZHQBLTYRE` Europe (London) `arn:aws:controltower:eu-west-2::control/RRTYUCALLKNM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HUHCOZDVSPFJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LCRYTLBUZWKL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/POKVYFUCEDMC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ATLRQLKFUPXU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TIJDCFZLPKDU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SJEXUSOXPSPK` US East (Ohio) `arn:aws:controltower:us-east-2::control/MEGBFCTBLAPY` US West (N. California) `arn:aws:controltower:us-west-1::control/LQQFBBKWGQUA` US West (Oregon) `arn:aws:controltower:us-west-2::control/WGCGXWCPMWBV`

SH.APIGateway.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.5	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ASGOLCXTYZAU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IEPLMGOIQLKZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JZSERWWQXDHP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HXGROXENSKJT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RWEWGCDTNQWR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SZGAIYMXIFVU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GEQGLDHBCLHI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YKQIWSPLFHMH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QRFWQMUPBGAL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZJWNZGZXZKEC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HNEHJUYYAIOZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UHUYXDUHUCFJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TZKIUNDEFSSC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ICJXNXXFNJBH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AAKMRPSSWVFA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZBNVUTRHQWLB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OADTZYWCJJPU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SHGXOQWMYGDV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IBHKGKZKMHEJ` Europe (London) `arn:aws:controltower:eu-west-2::control/CPPQTQSZSOZE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CTJIIUNYJEWZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZYDXCLWMUPPD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XDXOUTCQQSBP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PLNAVOFLIEEI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XCCAVLLIUNBW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IDZLZNCEBCDN` US East (Ohio) `arn:aws:controltower:us-east-2::control/KTVOXDKUCOLS` US West (N. California) `arn:aws:controltower:us-west-1::control/LCJNAQINZRTI` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZUWFIOFNIKCI`

SH.APIGateway.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.8	NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CYXTCOLCAFTU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NPGMHHEHJAZJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SDTKOAZRPRVU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KXMSHTINJODP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MOGGHAHKPKWP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LPEGHVWXGRWR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WWVCTYPXDMVI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WGRUYTXBKJPT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AOTXAAIXUZGO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CGONJUOMPJPH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PXVXDTBZBDNI` Canada (Central) `arn:aws:controltower:ca-central-1::control/IESMZILOLTCP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KDZRDEAZWVDM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FEMIWYHJXJIR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FCVTAIDTCXKU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IUVYTYANIHHU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IIXJAYWWBYFK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TBQWFNYATDFM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/APXJLVKOBSEB` Europe (London) `arn:aws:controltower:eu-west-2::control/FPBVORGPWAIT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EXXWWSPFGNML` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XXEUJAKUQMWG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZODMOZSJINVR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PBAVTUMJOVXS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JOEIBMZJMELB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UBJNIPLJAUPP` US East (Ohio) `arn:aws:controltower:us-east-2::control/UQEZDQFEKINS` US West (N. California) `arn:aws:controltower:us-west-1::control/NOSMEYUGIUHP` US West (Oregon) `arn:aws:controltower:us-west-2::control/VOMLOGQZFVTH`

SH.APIGateway.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.APIGateway.9	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YGLMNEEPTMYB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ECXQXUMZPJPJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KBYFZPAGEIEY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HUBWBMQSCTCI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CEFDYPUYNCKH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TPQDZNHEPZZY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TIIIPYQDGSKH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HSLYQANZTCLF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XNMGCOKKDRTM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HJIWHLVZUMLL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QNUXNUDVNEJS` Canada (Central) `arn:aws:controltower:ca-central-1::control/YSRNXOSPMPAR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FRCDFAEKZSBA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TCUHJQTYQIXF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HRVWOYPEVTZV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FSETKHTFGIHY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/REKSQDKISWDY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IIFQFUXWNINO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GREKWXLBUMYC` Europe (London) `arn:aws:controltower:eu-west-2::control/HWHLVPFIFLLT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IWTDNHAOVXWZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WNECYXLMNEEW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CEGFLKUGXFLT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZQNZRBVFINOA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OCKVZREZIOQW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RGZSRLZYXNAM` US East (Ohio) `arn:aws:controltower:us-east-2::control/FBDMHIKAKXYQ` US West (N. California) `arn:aws:controltower:us-west-1::control/EIJKPXWMUFUM` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZNUGCJCJBNYR`

SH.Account.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Account.1	CIS AWS Benchmark 1.4 1.2 NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PMKZNPRSAAKG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MYAMVCYKWVAG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DTWMAHWPBVQX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EMCJNTXLMTCS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SHKGSTKZUTBC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IDEZUGBAFKOT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CBJCRYNFRZJM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CLWAFAIJBWUO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TDCHULZQJJYU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZZWLSYCOCNOV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OQQLSOXEHJLB` Canada (Central) `arn:aws:controltower:ca-central-1::control/IBIPKUPTGKCH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WTLUNUZUFNTZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LOEEHDRVHTWK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OURYMYEAPVPK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ACKPBIEHTKJO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HYVXDDIDVUSS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GIZQTXGOWBTZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TUJJHFEUQRTD` Europe (London) `arn:aws:controltower:eu-west-2::control/PZTQKPPLUJQC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KIIMXDNABIMQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EMSWFYKFGHGE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RMPHZROEDEVO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DDZWFSJPQGLW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KQCHSPVLTIWQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RYAEGDBVVSEZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/DDPIKWUQKYYH` US West (N. California) `arn:aws:controltower:us-west-1::control/NVPFFNRHOZEV` US West (Oregon) `arn:aws:controltower:us-west-2::control/SCHNXFCTFZJG`

SH.AppSync.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.AppSync.5	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BFEOWRWBGSTS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LKLXWBHRKDFW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CGPDLKJQEPXW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KQTDHCYPENTI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/POVALEXDFRYL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GALGXJCQPHEO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XNLNMEDKUDWT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CJZBNRVKKPHC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZWRDSYASCGHB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IIQXECDHIRNE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IKXCXLQEEPGX` Canada (Central) `arn:aws:controltower:ca-central-1::control/KTDSPDIJWYYR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WISNUYLLHJRW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KJGYSWNIWTPL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BBINHAZGPWUL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LRPBTLPEKFHL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RAWCIHSRQOHW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SDHFSMIBGGAH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KMXMASDFBPZC` Europe (London) `arn:aws:controltower:eu-west-2::control/WVKDSCRXWSUJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ULCHFPZDTYMP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CFQKXQNBMVZA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RAMPKSGTSPLS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VNXVFGOZVSIR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ILDFGIFJTPAU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PCPTBIXTYLEG` US East (Ohio) `arn:aws:controltower:us-east-2::control/OSEDLYFBZHCJ` US West (N. California) `arn:aws:controltower:us-west-1::control/GNYCRQTXZMLX` US West (Oregon) `arn:aws:controltower:us-west-2::control/QNHLOWOFTLTS`

SH.AutoScaling.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.AutoScaling.1	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ENLIABXOWLTA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AAWTMLMGLZEH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CXXHKFGCSWUH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZAUGAPPKZGZC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OWKESKMBJRIJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RJDQSGGXMFNH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AVSLCBTIPUAK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XDFGVGCIRJGE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HPBROJJRPRQP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QIYXMDNDRLKR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JJOBKPIWUHLJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/IKKVVSEWGLMB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BDHKVUUOVEFG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GVPMLVRGBXZI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ERJGTJWTUWQE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZITVBPNZFKCC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MMDRUAHTNBJW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HWVRZMYMPDLK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BVVBNBHSIGXC` Europe (London) `arn:aws:controltower:eu-west-2::control/SZIHWNZUDWBU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LMYDOAQOQOYC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NGOSWSWUIUMB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VGXKNNICRVEX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LZZSNAPPCUTW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EQAAEUGLWPUQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZWORVQKMSSVN` US East (Ohio) `arn:aws:controltower:us-east-2::control/JQMVONDOPRIM` US West (N. California) `arn:aws:controltower:us-west-1::control/NOOOFEEPXXDP` US West (Oregon) `arn:aws:controltower:us-west-2::control/CCTCKXMLWFDI`

SH.AutoScaling.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.AutoScaling.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DNFECJFKCFVB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AIOMXPZNXNEE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ESQRNROJXEVQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OVEQWNZWUVPE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NZVLTEYDGYTA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VFWAYLBRJFYI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XGQKIXJKHLIX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DCTOFQWBSSEI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CFQPPPBKHPVE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XCJJJBPXBFSO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TDAGMRBJQBCB` Canada (Central) `arn:aws:controltower:ca-central-1::control/JXPAOXBTCBUY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/THEQJEHRVIXV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LOJSJXUWYJIP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UKFLQQFJQTIE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EKZHXVNHEEVW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EEAHKRUSHDTL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IPZPNAAHURQK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PPNROGQXGMTG` Europe (London) `arn:aws:controltower:eu-west-2::control/NJMEPCCINGYY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XYTUJNEIXONA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NSQPEALJDFYR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NDKHNDDXMHUB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LXEIIROCTNAZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VXUFUULLWWPE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WPQFDZGIKXEN` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZBMNAYFPMEZY` US West (N. California) `arn:aws:controltower:us-west-1::control/HGYFKHPSJZIO` US West (Oregon) `arn:aws:controltower:us-west-2::control/TOSTAVLMCDIG`

SH.AutoScaling.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.AutoScaling.3	NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DPMURQNMHPNT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LTNKJITSDXNJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EOCUBAKFMZJT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VMBGAYOTTZMK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ADXCTUHFMZSX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LPSGVWSPBFOM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YWRWMTAYRNST` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VJQHUCFGCESL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RSJYIFHSKNSS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XUWKSWAQFWZA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AGJFAYKBFPEX` Canada (Central) `arn:aws:controltower:ca-central-1::control/JWIWNTSKAZGY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WVMCPAWLPRHT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XZHHUAZPENXE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HXBRWBFDCIED` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WQMEEXRGQCEN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TYEWJONRXZNA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YZFVDQSAPXEN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CBRREQKVJIEL` Europe (London) `arn:aws:controltower:eu-west-2::control/CNFIJCJJGMTZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OZFKELNYWUQY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HRKJPOIQIAVD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LDJGANDLBSJC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NLTCSBDKAYVL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YEWHZHZIYNYF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HHCYIDJRAZNC` US East (Ohio) `arn:aws:controltower:us-east-2::control/SHYROJUETSEF` US West (N. California) `arn:aws:controltower:us-west-1::control/EIDKBDTZOYAF` US West (Oregon) `arn:aws:controltower:us-west-2::control/SMYBKBKBIJSJ`

SH.AutoScaling.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.AutoScaling.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JQLJCVMPUALW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UQOJPXNVOBFL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XNJDGLJOHAMS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WOMTJFIXVURH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MXFNQPTWJPUO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NACEEPQFGKZT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JTODVGMOWHVD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HRPNUEAQHJJV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TNSLXHUTKWTZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JJCZDGADEZLX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WMMUEBCYUOZV` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZFZUXSLEGCKV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TNEYDFJODZUG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YVWDSKAJHEJO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DYKUNMKKBVGC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GVTHRVBNLZLB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XAZYWOIIRNFH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NLQJVWOVEWDU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OMIRAXEILQAK` Europe (London) `arn:aws:controltower:eu-west-2::control/TFXWZSADFWQN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HXJMEZAVXVYO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PQBPPPCAJMHA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OKTGUSSOFJNM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YEFXJFGHUVLS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LVDJEVJJJMVS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BTMIFVPUSJBQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/GMGXVALLWEBA` US West (N. California) `arn:aws:controltower:us-west-1::control/SECDBDYCHCAO` US West (Oregon) `arn:aws:controltower:us-west-2::control/OWVWXHTOQSYK`

SH.AutoScaling.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.AutoScaling.9	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CGWAPDQWZHBV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IUWUTWYAMWLM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RTZFSTKOXUDD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FPOPHNUDJVCH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UKAISLRTVRZT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UHHKZSLKXCPG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UDEHBICOLJXU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EGWOHKNMPKMI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XFPEFWDNOLGH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/TXSCDOVVJLFE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AELVESEUOELE` Canada (Central) `arn:aws:controltower:ca-central-1::control/DVIOWKWKIFHK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BXTQKCHRYXEX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TLYXCQULSGYQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XMFBJEORTDUR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IMDDCNRBWEEN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TKKWXRLGWPBP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WHYIMLTYFBVH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TYNABOHYGDXR` Europe (London) `arn:aws:controltower:eu-west-2::control/RIPUYTWTZYRU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LUSXKLYKYRGK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NINCCYVRGXRE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VOBNEPRWXVLT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DUDZUWVYZWHO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CDSPFAHUMRCA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VEIRXQKRRWAP` US East (Ohio) `arn:aws:controltower:us-east-2::control/KKACTCVDRBMF` US West (N. California) `arn:aws:controltower:us-west-1::control/PEFXRXSTWARS` US West (Oregon) `arn:aws:controltower:us-west-2::control/SKBFDFDSPRTT`

SH.Autoscaling.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Autoscaling.5	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RWSLCKPMLKNF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FPVPKKCSNSWT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IRMFCHOIJRAI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IYOEVGEYCOFV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IXDIRGHUGCNP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NRPXJATICULB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WTUSOZHJJKTS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IHXGONQFSNTY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BRQEJBSGCNRN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VALJLFXPIAMZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CARWHIVDIVSB` Canada (Central) `arn:aws:controltower:ca-central-1::control/IXJDZWZANLKO` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/CYDHONNQYBXN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VGDQWYLMCBEM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HPCLYPCCZRSK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DGQMJOMPDBGU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AHDVVKQYFYVA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DGVSMSOKYYKJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EZTDIOMARRWE` Europe (London) `arn:aws:controltower:eu-west-2::control/NQKPEMKFOZYZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VYYIAPRLJMXU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MNIQNJJPKKCP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SFOXIPIZGJMF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TKOURGPGJZYI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YPRLQTSFYWEB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QVGJOLZXDNNY` US East (Ohio) `arn:aws:controltower:us-east-2::control/HLVWEDLVEUES` US West (N. California) `arn:aws:controltower:us-west-1::control/TFRBKGKMRKMW` US West (Oregon) `arn:aws:controltower:us-west-2::control/CQYHNDCSDOKU`

SH.CloudTrail.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CloudTrail.1	CIS AWS Benchmark 1.4 3.1 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FASUZCFJZPRD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SPAPIHYUDXMF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AHVTLUTBIUMB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KUZDSXRCMEWW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SVEQOGRSDGOJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HDXRGASZIBJR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UPTYPDPXPAPS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MEWHPMWURIBQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JOVYOCPUBVQT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KFDHQAPHUXMN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VZYQFTDISEHX` Canada (Central) `arn:aws:controltower:ca-central-1::control/RQFYEFHIOOMQ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HSCTQMOWKGZZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PRVEFKIRBUOG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KHMYHDPQXPAE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IEJNYCAPCFWN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ICYIOWYEZXOO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AJXJUQBNAXVH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZSWMQFPPNNOS` Europe (London) `arn:aws:controltower:eu-west-2::control/FBWNWOPLCWCZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZJRGXPPXVABV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FFCACWGMMLCW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KNAXKICJIZKK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HCPXYDCVYXJM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LWWWXXCWABFE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JSPHSKFGKKQC` US East (Ohio) `arn:aws:controltower:us-east-2::control/KVDJVCPPNKRF` US West (N. California) `arn:aws:controltower:us-west-1::control/JDZNMEXDKMCK` US West (Oregon) `arn:aws:controltower:us-west-2::control/TKEVYJJCXGTI`

SH.CloudTrail.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CloudTrail.2	CIS AWS Benchmark 1.4 3.7 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YKEDSMCNFQBM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LNCJRIFYPMAJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OMMCJBKYCGMK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OESJOHRDGIPI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DXVXEPDLKICN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BJKTTLYAWQNP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XVPYBSFGAYYU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GJBSDWACBFQE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RHDAYMWQSNQM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FPLESKQFQMZN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OLGOHFLMUSSE` Canada (Central) `arn:aws:controltower:ca-central-1::control/AGXOGGHCGROE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LCWQSVEODLTI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GDBNBTCDAXFU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WHBHOBUBKTML` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BJLEQOVHKVJH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LAXTKCLHMKWV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZXUYWHJWHIKO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PNVPPZDHTLDX` Europe (London) `arn:aws:controltower:eu-west-2::control/PLGOVUAZUWPL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QRDXCEHXZQVS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WWNCJNLRFIST` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XGXMRDDYASOH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NJSTXDFSFHNK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FQYLTXGIKOOB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TCMJVYRGWMOM` US East (Ohio) `arn:aws:controltower:us-east-2::control/JAYTWZHKWRNB` US West (N. California) `arn:aws:controltower:us-west-1::control/BWPUAGFKHKFM` US West (Oregon) `arn:aws:controltower:us-west-2::control/YHMCHLVAJGXW`

SH.CloudTrail.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CloudTrail.4	CIS AWS Benchmark 1.4 3.2 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-7(1) NIST 800-53 Rev 5 SI-7(3) NIST 800-53 Rev 5 SI-7(7) PCI DSS version 3.2.1 10.5.5 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.2	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OBMZHHHDIVIO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QPVVNGFRJZNQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SHDOPOLDKXVQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FZYQSNLLCPXQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XMEDCVDUGCRA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WYJYQDZHOUMC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BCIWLEEWFEUZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KDJOJWFSTFGL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RCLUACHBLUEJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DSQPQAVNZCCC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CJTGDDBYSCFW` Canada (Central) `arn:aws:controltower:ca-central-1::control/JVYZMZLDDDRJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/XBBRBESWQBYE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BGAGHEOYWZSK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TUTMDPEILWWX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MTOABAQLNODU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JJCLKLPVMGHD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BWWERTHCDZXU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OHTOUHWXBHVL` Europe (London) `arn:aws:controltower:eu-west-2::control/YMWJQDYNLYGX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DWZLULAUBFFL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IIPSYLAHENNO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SLIJKXBXBOCM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HISGEJPOSDKT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JRGUQUTCBPMN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RRKYSCJXWUGL` US East (Ohio) `arn:aws:controltower:us-east-2::control/PQRKRAZHNQGQ` US West (N. California) `arn:aws:controltower:us-west-1::control/WFNGEYPJEAHO` US West (Oregon) `arn:aws:controltower:us-west-2::control/RFTWGBDAOZZG`

SH.CloudTrail.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CloudTrail.5	CIS AWS Benchmark 1.4 3.4 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 AU-7(1) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-4(5) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HPUKJJHQSIKS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SMGLYOPMAGZT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OBOZWIHZLRUH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RALDKYFCIKBO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OBRACKJIJWEO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TNFFXMMEKNUK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WKLSIISSCOIR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NZAPCFAOUVSK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WRJBVWCCGCPA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SFXQEFFNNHAF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TAGRUMIJCQMS` Canada (Central) `arn:aws:controltower:ca-central-1::control/UHRCNDTKYIUY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YQBSMWMLAFBP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MJUAASUPXJUO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EAPZTWJLSKWX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VOKJCUPZNXGR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MUVVRSQWZUJD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VSFUFPWNDFBC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UWGSZEDUWTBP` Europe (London) `arn:aws:controltower:eu-west-2::control/SWWUBFUZIQOR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DZEZVIWHTEMA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SQBVVUOFOKEU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MDCGEROJBBHD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VSJJAQZPGLUT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UTZGEIHNTWLH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MSSQQOYZRTEE` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZLNHKOHADVEF` US West (N. California) `arn:aws:controltower:us-west-1::control/WRYVRQGCJFZD` US West (Oregon) `arn:aws:controltower:us-west-2::control/BGLRJKKRJVJM`

SH.CloudTrail.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CloudTrail.6	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 10.5.1 PCI DSS version 3.2.1 10.5.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UANAZHHLLVAL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GZGSTLJQTIDR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IQIGWUDMIDMK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KMAFNPVVVNSY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JDFGAEYOWUAR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AKRYYJMCPEUJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PLCXUUOTVKOJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CXOPZYUABHOD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QETMRBRJTOKF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZEKOGFHQYJHY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FKLETNBFOVMH` Canada (Central) `arn:aws:controltower:ca-central-1::control/WERMMSKCVGST` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/UMBFHAGCTEWQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DDNFHHXFQBZU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KRVRSDRJMTMB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SCGFYJXAEBHT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XWGYDHAVITPB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DUAKPUQVTNQU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZHLTSYTCMZJZ` Europe (London) `arn:aws:controltower:eu-west-2::control/TLITDEMOCENK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LALFKCQHELEU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XMCPTGXILWXY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NQZBAAAWZKEM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LGBEOMROXFFF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MTKJAFEDNUIY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CYXBBWCLPWPU` US East (Ohio) `arn:aws:controltower:us-east-2::control/JUERNCJWDWDB` US West (N. California) `arn:aws:controltower:us-west-1::control/HFBYSOZTBSDM` US West (Oregon) `arn:aws:controltower:us-west-2::control/LTDEQKMWOFLJ`

SH.CodeBuild.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CodeBuild.1	NIST 800-53 Rev 5 SA-3 PCI DSS version 3.2.1 6.4.4 PCI DSS version 3.2.1 8.2.1	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RRXUKWUSZRGJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VHCVTEUEMOIW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YDRNRDUTCDVY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TIHGQHSIUQES` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HWRDIROYOCHN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ICYKSDRBZJBO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TNNKEHZSBGZN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ECIANAYMRCIX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OGBNWMEGMMNM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UOGRFZAFIECX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FAQACQVTCEUL` Canada (Central) `arn:aws:controltower:ca-central-1::control/SGUSWAWCRFWN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HRKYHURELKVE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GJYCUMZXBOOX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RRUESJHGXITH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FPFONXHMHQKY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UOXJGYHEAACF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PTXFMXXKHDKM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KAHXKGGQNXKH` Europe (London) `arn:aws:controltower:eu-west-2::control/MSIHJHKZRCLN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MELSCKPSEZZX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ERKMCXGCOTFT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YFGRLXGFZLXB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RFMFGBIDZBWI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XTQYGBNGCAXU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IKRQWXXPRIUG` US East (Ohio) `arn:aws:controltower:us-east-2::control/VTTYJJLQHCRP` US West (N. California) `arn:aws:controltower:us-west-1::control/OEJFUDWRJQWA` US West (Oregon) `arn:aws:controltower:us-west-2::control/QVAROLLMZGOA`

SH.CodeBuild.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CodeBuild.2	NIST 800-53 Rev 5 IA-5(7) NIST 800-53 Rev 5 SA-3 PCI DSS version 3.2.1 8.2.1	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MYTHILYBSQOL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FZODVDEYQHPP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AMKMYJENQHDH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IHLKDRJWXUHX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LSWKJKAKBDRD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RBONONXLXNLM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EQREVSFORAIM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UDLMCNZRQMEI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NENDYNYMGBAL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DSYAGPSHZDLY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SBFHYLKUSVPF` Canada (Central) `arn:aws:controltower:ca-central-1::control/YUAEVTSMXVYI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/DSRSDEWGLPVQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZRPUUAKXKYNQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OAUYWCZWTLBY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VMUOHSUKEGZY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FZLHXLPOCBEE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ETPIZFESNXBM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QSUUNZFUBPXG` Europe (London) `arn:aws:controltower:eu-west-2::control/AUCSKLFJXSJZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DZSVNXMIBQOH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JVXYXIDQPCHY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VCHWRLXHUBTN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CDKLYFTEVVQQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HNGUINPSTYDX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SNJCJYKNUBTW` US East (Ohio) `arn:aws:controltower:us-east-2::control/NEQISRROQVGV` US West (N. California) `arn:aws:controltower:us-west-1::control/ZZTXDQPPPAWO` US West (Oregon) `arn:aws:controltower:us-west-2::control/XKWAJFIWDTOW`

SH.CodeBuild.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CodeBuild.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VHFHWJVGFUUD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WKWHEZFZPQHP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CJRJPNDUPVHS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EAXVKDLAFMUI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NBEIXNBSTYHP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AGXAYVCMISLI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IGFRZKNFHMCE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DMDCAEXHSYVD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HBOJXAIXDHPV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YRUXEOBHHIFZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EECEVIJZATZL` Canada (Central) `arn:aws:controltower:ca-central-1::control/NZBZRTLNLRHC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/QCSWQQEXRIVT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FCGGEPJWWZPS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XADIVRYGGVDK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EYHVUBQYCYPW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SKLVKEDDBCKY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MLZAEEIQDCLA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RROQJCOSEBIO` Europe (London) `arn:aws:controltower:eu-west-2::control/FUIOFBRISQPW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ODQHQAUDEECO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SOOVWNHOEKYX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JSITOGGJBPQI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BBGWYQQCYXXU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BYNYOSFMYPZQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PSTQZTBWYCPR` US East (Ohio) `arn:aws:controltower:us-east-2::control/RPWVHXRXWZUU` US West (N. California) `arn:aws:controltower:us-west-1::control/OQKHMQZTXWKT` US West (Oregon) `arn:aws:controltower:us-west-2::control/FBFYJYXDGJDO`

SH.CodeBuild.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.CodeBuild.4	NIST 800-53 Rev 5 AC-2(12) NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MACHGEJBMRAN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PBJTXDTJFOWY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WUOXVMEZAFHA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DEBWVFLXAGZI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RRRACHPLMQYV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VZJSHORKBLYN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SSALRPZGKZXX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VMCOHOQCISWJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NQSLJQHQTLKU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IYKYTWEEEMHM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SIYMFKUZNMWT` Canada (Central) `arn:aws:controltower:ca-central-1::control/KWXNGCKXFPFJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/GGGHALQKNSJJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FRTPFQMERZYU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MWODKDPDPWQB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RAWBSXYDHUPU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RNJDHSDWLNIA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DYUZGSMUKQNQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EQRAZACXKPRQ` Europe (London) `arn:aws:controltower:eu-west-2::control/KFJKYEFRMELB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LWFGGPAZXPFV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SKQSYVFOAMNL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UCYKZQGTUOMH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YFFLLCMEMNZZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KCHFPNLICGCG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HQVCCVHGQAZB` US East (Ohio) `arn:aws:controltower:us-east-2::control/HMIMEZDEFGZN` US West (N. California) `arn:aws:controltower:us-west-1::control/WLKIHBBPDWPS` US West (Oregon) `arn:aws:controltower:us-west-2::control/RUQCXNAOEZOB`

SH.DMS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.DMS.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GVXZQXNLGEFH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CWMEQJQLGWKZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MIMZFVUEANJV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KKTKHLMBCETI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HCDBKZQGCMRL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GIDDGGAFOUJI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SDBDCTJOWKIR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PZGUNNSCNTBM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DHOJQSKCRIQH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VYIWFPXINQGE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KXGRZAGOJMBU` Canada (Central) `arn:aws:controltower:ca-central-1::control/AAJEZEBPCKQN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FZAOMYPAAMSY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UGTQRQUDPFTC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EWVRLTQPFQXC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XSOOILKWTSYF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SOJANSLTHRGV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DXFDQPOTSDRP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AIHUAMECLLHS` Europe (London) `arn:aws:controltower:eu-west-2::control/UUZLDXFJSJIK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FJWDHHBNJGDS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SYXWZPCOGKPD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NTZFRACWCHLJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OWNFLIOKNDTK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VEFFWEQXYOSJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TJKXNFIKOWSN` US East (Ohio) `arn:aws:controltower:us-east-2::control/TXOKWLKNHFOE` US West (N. California) `arn:aws:controltower:us-west-1::control/SVRXVKHILILC` US West (Oregon) `arn:aws:controltower:us-west-2::control/JPRWVQHPQWQX`

SH.DMS.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.DMS.9	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MJJBTSNDIPUF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JLBMYZONPCIU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PJKHUCTAVOZO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CLQMFXIUXTDV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IERTYPMWJZTT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UNTGIPBGZWDD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HPAIJYDADBVR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GXUWCLHGXXHS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CSLQWAPSNYMD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IBJCSZJOGVZU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MOQCBYJGXNXU` Canada (Central) `arn:aws:controltower:ca-central-1::control/HYOQASRNNLKH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LLPVYMACHNWP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GUDZJBSLRTUM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VVLPDXFCZDDI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TOKZOYWBNHCV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RTGAZYJXNUDO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HXMLMBZHGJLL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZPKNJQUKZDVA` Europe (London) `arn:aws:controltower:eu-west-2::control/WNTXELAFYVQG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BXJTJFZCWOGJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TQRURJLEAJJX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IPUWFFFTXTXX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LGHHXOSIAMHS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RJCXIDRMCMRO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CHJUKRWBZZZI` US East (Ohio) `arn:aws:controltower:us-east-2::control/FNOKNMLZKHYT` US West (N. California) `arn:aws:controltower:us-west-1::control/USZWEDXFJORQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/OBODYBXTJMOY`

SH.DocumentDB.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.DocumentDB.3	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PDJQPZFTFSOD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LETWPCAEVAPI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KAACGTYKENKG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JVHTNANJBMDS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LQWEQSXNELOS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZGFVWYFZCTDX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XMSCITVIVQEK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AHCCQFKRLYDA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WMKKHIOYHNFP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SOPOSMPJZFOG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VKNPUHFPPSVC` Canada (Central) `arn:aws:controltower:ca-central-1::control/JKHVVRTZQZZT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZYHMCABCLJBU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BQDHWQQBRZLT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CJFBZUYFEIHO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GAVMNOAPGIIO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CACMGTZWPDOV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MTSNTPINKHOE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KXCDBNHBDKTF` Europe (London) `arn:aws:controltower:eu-west-2::control/QHSRZCJABUCQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EIPKRKMDQFWW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XHNZSOCCCVKA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FZPTBKUDFBVA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XLEWIHLWKZIP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SPJOGWICINEF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZMVACKXBQOZS` US East (Ohio) `arn:aws:controltower:us-east-2::control/HSLNNBLCHKLM` US West (N. California) `arn:aws:controltower:us-west-1::control/MVDOKECXSJAK` US West (Oregon) `arn:aws:controltower:us-west-2::control/AIQPFTZTJQOD`

SH.DynamoDB.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.DynamoDB.1	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-2(2) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RWWLHHQVARER` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YWXTGOKXQYGA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XNMEOWFBWSUT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BEJCXBYWOVAJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LGRUMRGKZNJP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AFPOMTIBACAS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OQHBVDAXSZDU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/URWYQJCVIFQK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZZTZVYPQVDAK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CJYPHCQEAUEX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HNPVLFFHTGDP` Canada (Central) `arn:aws:controltower:ca-central-1::control/BPAFLCPHAROG` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/UYBVDFGADCVZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QCECBYGHSJFX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WZCNZUWQKNWA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SMOVILGCYEMT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HRSKFLXMLQXJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DXIARVFWPRRU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PEJTXAODKVKD` Europe (London) `arn:aws:controltower:eu-west-2::control/EKJWCMKGILMM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ATQHGWQORVYZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HOVABISQSGWO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CKUKSERAVGOD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SROWUZCGBRUF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YWDDVVHCZASI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XQGJDGQQKGCR` US East (Ohio) `arn:aws:controltower:us-east-2::control/RIGUOEEZBEMB` US West (N. California) `arn:aws:controltower:us-west-1::control/EKZBBLXTMJQR` US West (Oregon) `arn:aws:controltower:us-west-2::control/SQFKXDJCSXNS`

SH.DynamoDB.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.DynamoDB.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NILTMRUJRUMQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZDNIQBAAKQJV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ELRZAXWJYGNK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EUJVJQYTHQHZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZEYGKSIWJOVZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LAWQMOXHJYFR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RBIUNHSNXJGN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LVADITNDSYBI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SCPPKINQMZAF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YZFIEBNOJLQQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MUYUXDDJSYYY` Canada (Central) `arn:aws:controltower:ca-central-1::control/LEFDCDBLZGBP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JVUJTXOFVKWK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YSIWDENULVGH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BYPRBCPFYEWS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JKHWOVILEAIY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TBAWAJOXCNYE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CQBBGVJOWNYZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QJRPWNBCTHUF` Europe (London) `arn:aws:controltower:eu-west-2::control/LAXIOZREATEL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/URJSZZMBWZPK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JJQPKKSFBOKE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SLBGDQCTYLNO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ACVGUCRNNVMR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EVCIVOSOHSML` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ITCPEFZTGHOG` US East (Ohio) `arn:aws:controltower:us-east-2::control/HKFSWAKSTGQF` US West (N. California) `arn:aws:controltower:us-west-1::control/PKTHIPMCRROS` US West (Oregon) `arn:aws:controltower:us-west-2::control/QKJWJTTLZAEH`

SH.DynamoDB.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.DynamoDB.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VPBXMXCUJYAU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HWWWGJMVASXD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QIDTEJQLUHJL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YAJUTGHZORVU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RNFRKPNBDJIV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TEFXANOXFVRK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YAHSZZYJYOTP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VYIIVEBIEDCW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NJASDOEDZRUE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NFDDNWFFEUTQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JBTDVCEFJBLA` Canada (Central) `arn:aws:controltower:ca-central-1::control/HZUVKONSUUYX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZFSZCZSNNOUV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QCOJTUQOGZKE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TRTMYLBDVCRB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SJFVJFYIXZJF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WMLVYAWQFWSF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LEMZBJZGUGPE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EGNSOWWEVSBK` Europe (London) `arn:aws:controltower:eu-west-2::control/NMOWQQDRNKDI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YVWIXUILMDIT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VEOKKDTAUEXT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YHBMDOTAPUFL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HEWOETRYBLMI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UDBGKEJJRJEZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IMLSFCKTXCBG` US East (Ohio) `arn:aws:controltower:us-east-2::control/AJAIILPVXLOK` US West (N. California) `arn:aws:controltower:us-west-1::control/FURDEVJLKLKR` US West (Oregon) `arn:aws:controltower:us-west-2::control/VPKJJQGPZEHI`

SH.EC2.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 CM-8(1) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 2.4 PCI DSS version 3.2.1 4.1	Enforce least privilege Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BQBKXMIZQXNO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RHVIQGPGABIQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FLYKUCWHEFPS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VHSRRHUYSMZF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TZHRPEMFHIGC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DCYWBSWPHALS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OVWCDAEPMBUN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BDCQIYFJGXWZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QNCIIGXDITVK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HCXUGZLTESOU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BVKENGKNBSOZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZPHSVMVQOEUE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/UNQLKDSZQTRV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TTSVJOMQQLTN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EXNQKTGPHPFS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YYXTTLZPXPSK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LGLMNXXPHGKK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MUTKPLAJCLWR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UBCGKOORFCMO` Europe (London) `arn:aws:controltower:eu-west-2::control/XQBHIIQWUMXT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FBQFDKYYSJVI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MMDDRCCSPAHB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QEARNVAEKVZL` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LZCYYQQTZGWI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OXADCZVJFRQW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FKQAQCYRILAK` US East (Ohio) `arn:aws:controltower:us-east-2::control/GFOMMGTLUCZR` US West (N. California) `arn:aws:controltower:us-west-1::control/DVKTNARVQCPJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/TKXNMRFIMBEQ`

SH.EC2.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.10	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 4.1	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DKOCULDSUQEH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZFQNNBBFYKSJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EPXMGYKIWOPN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OXFAIHYQZTPL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DCNJHRVIKGSC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HBYPEQKUWCTB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RGHWXFCDQRAS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZRINADVUBTHV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CMHFRDIISEAB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RGNKYXDMFYRR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CXAGKGXGZOLG` Canada (Central) `arn:aws:controltower:ca-central-1::control/YUTCRRLVNEDL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JXJDSAEPADQT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PIVIHIALZUGQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ABNGTPOBJPZF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IOUVRZZHPJUY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DFJAQYLJXONB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LIVLLQIGCAKP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LQLAWRXDYGTC` Europe (London) `arn:aws:controltower:eu-west-2::control/VLMGUAIXJOHE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IPUXYYDAQXVB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HCUEDQFEUZVE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OCUUNAZLTMXD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ARDWIOUUYFMX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NSIDNZTQONXL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VAUYZRKDCKOY` US East (Ohio) `arn:aws:controltower:us-east-2::control/TQGKBSIQWYJE` US West (N. California) `arn:aws:controltower:us-west-1::control/HWCKDHWPEZMG` US West (Oregon) `arn:aws:controltower:us-west-2::control/XZPDNCDQQVUK`

SH.EC2.15

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.15	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IUNBSHVOQZWW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WDZUFDKBUENT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NBJEXIHGIXES` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HDIFINDBKXRQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DMKJRASPCRPG` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LHHYJCUXFCSE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PSMLBZUSEUZD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FMFHQRLLYTFU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VSUCLWGVQLDF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DSLTCHZEYIHC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EXWCZDMYUNOB` Canada (Central) `arn:aws:controltower:ca-central-1::control/JNIOFIQSINQA` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MPNMBPGUGXCA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DUHHRMNTZCWB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NXSNEJLNLGLP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KUWHVRCLYOJB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UXMQGRHNYMFV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AWVUKLKYWMUA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DJQXFSKNOMLU` Europe (London) `arn:aws:controltower:eu-west-2::control/YZCNTHFDJZSH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EIQBRXFUPGMQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XPRTJHEMBJWI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/STIVMPTCQIZP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VMQUBGNRJOYZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QWARLTYJMMAA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RJQGGVJZEBLT` US East (Ohio) `arn:aws:controltower:us-east-2::control/ULHSISJQFEQF` US West (N. California) `arn:aws:controltower:us-west-1::control/MWTJUNYUOGVR` US West (Oregon) `arn:aws:controltower:us-west-2::control/JSFKRLFHAKSN`

SH.EC2.16

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.16	NIST 800-53 Rev 5 CM-8(1) PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ERRWNBZCFEVM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JMFXEPJJIPXU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EHGVCOKGQGMI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UNXYUHCHQWYQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/INKYROEPFEKY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WHQJLTOONSGH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SXIRMTGNSIHY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DSMIAZVJBJYE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EVNHPWACQHEA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QWFYDUSSYRKU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SUUWFAXHHWYB` Canada (Central) `arn:aws:controltower:ca-central-1::control/JOQQKGOKQTZN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/GSNBYQAGPRBW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KXJKNJEDTXLK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZVILHAIQUGHM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UKRQRKXRAMKT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AJOYGOVKLNQH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DSHZXHCHDTGG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HOTICCOJPNKR` Europe (London) `arn:aws:controltower:eu-west-2::control/NRMUBCVGQCZX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DROYTLJVMLBR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RTBHHWUWSUFD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YIYBFGGFBPLN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SUKJNVQBUCUU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SSWLJOJKAOLL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LITUIAJFCNLG` US East (Ohio) `arn:aws:controltower:us-east-2::control/QSBUZZBZQGLT` US West (N. California) `arn:aws:controltower:us-west-1::control/GDAEWNRGJIWZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/PBGUIXCOFNGC`

SH.EC2.17

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.17	NIST 800-53 Rev 5 AC-4(21) PCI DSS version 3.2.1 2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TFQZYUNRGHTD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UVBVOHAROKPK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/URWTJDZBOHEP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WXFFLHKVJHMT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OVNAQBTKPYRL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SLCEEBHVDJFI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JHCEAUOIKEQV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HETFYOGBFWSA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LWYOJLPCBZPK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NNDRWESKFWPT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RURJAZRYODNT` Canada (Central) `arn:aws:controltower:ca-central-1::control/HPCENFROXVMO` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EXWQMBHIUDWH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VRWUTNMJEXZW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EODUGCVDWDUM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NFPERWALALZI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FCFNREOLQBYE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GEALLWCNONQD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XGPQWTPUGBBB` Europe (London) `arn:aws:controltower:eu-west-2::control/HJJLVNYZLCKN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZQARMCQAPSWW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CLRQTGIXKLGX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BKOPDZLMARJJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UBPZWCXGTCRW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FAADSZJAEWQP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ODNGXSKYGCAN` US East (Ohio) `arn:aws:controltower:us-east-2::control/GDSOIWYATGNN` US West (N. California) `arn:aws:controltower:us-west-1::control/UELUSCFFWQBU` US West (Oregon) `arn:aws:controltower:us-west-2::control/DEEWSUBUCMPE`

SH.EC2.18

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.18	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EAXONVCYTWHL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HJUFPDWMVMOM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WUKBMIHWTCEY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PULYBIGQAMIU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WXQYCRXPIYJM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CMOVKNTIMGOH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VQAEGKRUUOBJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DCMKUVKUGLNS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UPVTHTZVSLWE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PFVJDGLJWAPS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FZRLMOVTJNRA` Canada (Central) `arn:aws:controltower:ca-central-1::control/KEIKZYHHGWJS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FAUYLDQLFQKR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BTPGDLJBAMQH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VQHMRXJGRPVA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KFLXJOLWUWRB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JQPPWMLJVWBN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZEHAWVYCRMFI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VQQNYOUTJQTV` Europe (London) `arn:aws:controltower:eu-west-2::control/KZWNXDXYBTQY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VDINNRTBMHLP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IEVAZZDCNSZJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AXRGIWUYYBYU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GFBOQTZROOYC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JRKGCRIFEMDN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BKEEVLXJOIZI` US East (Ohio) `arn:aws:controltower:us-east-2::control/VFZNFXKWHKOV` US West (N. California) `arn:aws:controltower:us-west-1::control/XYCETKWSMKJE` US West (Oregon) `arn:aws:controltower:us-west-2::control/USRKPTPFWXBG`

SH.EC2.19

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.19	CIS AWS Benchmark 1.4 5.2 NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EYILMGYGYEIL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WDGNQWRQSRMB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IKDBYKSLBFCO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OSTTYXVZPAKB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CTMMNXIPUNQC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VYOUBCPPBFTY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JUUPGXVLHOPK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KEGFOACYSSZL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SQJOUZGFKZPV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VOSKFJTVXNWH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WWXRMQGLXZEV` Canada (Central) `arn:aws:controltower:ca-central-1::control/FQHRPTPPXKUX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ECHSFSKVDEAA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BZIXCRFOIRCT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ENRSIIYETDJV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SQREYUUVCPAS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ERTNJQSWMRZV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZHTVVLSYLJEN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NRXPLVWHAEYX` Europe (London) `arn:aws:controltower:eu-west-2::control/FMQRFKULNUDA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UUDRZYIGIGXK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MOEDATWHGEMJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XXUADTPJXUPW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JBZRFTCMSUPX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UHFTWFYBFECZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KTVMUAUBZNOK` US East (Ohio) `arn:aws:controltower:us-east-2::control/QUNSRZSYEABZ` US West (N. California) `arn:aws:controltower:us-west-1::control/LUHDJKRHUFPA` US West (Oregon) `arn:aws:controltower:us-west-2::control/QMYRIRVYDWYC`

SH.EC2.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.2	CIS AWS Benchmark 1.4 5.1 CIS AWS Benchmark 1.4 5.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 CM-8(1) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 2.4	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SGSPWAJNPDBR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TFLINQJFPNPW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XKATTEDRNKXM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YPREQUJHSSEG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GEDLQRVDDBWK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HRILSVBGXGGB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KWBQSQHOYCED` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FXJGCOYWIZGN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RDJYZGXFHYUE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UTMUYHBSRPLT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NHBWWYINTDIL` Canada (Central) `arn:aws:controltower:ca-central-1::control/ARHTRDLRMOZS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OPLVCORUUZLG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GNOQGMZNQKDC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UPQHAVUGCFGS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FWYHQCQTNNVT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IGEEBWCRXRFU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KXRAQIQEMJVB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TPTBSUKLVYNV` Europe (London) `arn:aws:controltower:eu-west-2::control/YXDRBSXGLSYA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TDDOHOTFIXLP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LOHKJBFPSBYU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AVBURXTKKGHD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PLMOHIHNHZYI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SUPDKRQJNDKG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CBXAVYGTSXPR` US East (Ohio) `arn:aws:controltower:us-east-2::control/TWIVJPDMFMYR` US West (N. California) `arn:aws:controltower:us-west-1::control/FYKFHCWIPZEZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/MVCYHCJCTHKQ`

SH.EC2.20

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.20	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RDFAFABZWDDR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JONROMVQOWTE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DJMCSTIICRBQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ODPVIBBCEMZV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FHOCRENOKPSD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WIULDPIAKWSU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DXIYRTDSYSEI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IXQPOKDTASVW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XSSLFGGJDHRI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SRFCPYZRKLDG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ILHAHVVNWGOM` Canada (Central) `arn:aws:controltower:ca-central-1::control/KLGUNNBLXGKP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NQOWMJEIYGYK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RJZXMCZOENJK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OGWATXPAFUXS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QQIFUCSRDDNN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GLCTGYVWLGWT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RKEZLZVACOVI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RNARDQCXVMPD` Europe (London) `arn:aws:controltower:eu-west-2::control/QKHKXOCLKMPH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LAQNPJIXGRKN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XPHEIRVTJSOD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XYCTOXNLQNRA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PPJOEUXNTIYX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FVMQLYGBWWPP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SYKJWOLYPQAG` US East (Ohio) `arn:aws:controltower:us-east-2::control/YXCGFXLUMVWD` US West (N. California) `arn:aws:controltower:us-west-1::control/HCJDMUGMARUR` US West (Oregon) `arn:aws:controltower:us-west-2::control/TCELFANHENOF`

SH.EC2.21

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.21	CIS AWS Benchmark 1.4 5.1 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-7 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RIDIIZXLZRRG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OFWWDYYDHMTK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VJMZLONUACSI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZXUCIOCDKWSE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UAJYUJLYFENH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SOUTWZRNWHMC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WTXMFUDKZUIV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LQNNHNWZOCVA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YLOHXVLEFUBG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GSMRCTEFWLZC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IYJCUGZPKJIM` Canada (Central) `arn:aws:controltower:ca-central-1::control/KMVIVYSEGFWX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LDFXNIYRRQKE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FLCQBKGZAFLW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EIUYPAOILCPH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZAVXSARXKIWB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PEUVRYHPMDFL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HQXPLOFUFNIG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YMSHAPVGFZMR` Europe (London) `arn:aws:controltower:eu-west-2::control/WZMUKRGPSNQX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BISPHFGOSVPQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WVVLAIDUAKLJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZIKZNBNDRDYG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KFAFRSCFVEGY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IJPYBWJTJRXN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AVYCVZQFCQNU` US East (Ohio) `arn:aws:controltower:us-east-2::control/PCTQSZLBOZMZ` US West (N. California) `arn:aws:controltower:us-west-1::control/KDDCTDCWJFZM` US West (Oregon) `arn:aws:controltower:us-west-2::control/DZFUOUZQSVYE`

SH.EC2.22

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.22	NIST 800-53 Rev 5 CM-8(1) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DLKHMTZYJYGE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UWGLVVLGFTPL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SVKEFFMYBGMC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LPKINEKDDRBM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XECWJJWRPADD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YSMQIQVOSFYA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VBBECKECOLJP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/POVUMUFWGDAQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AJFFKKXRAFMB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LSBJQOSBHOFX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YEFMBKXVHKVP` Canada (Central) `arn:aws:controltower:ca-central-1::control/AHMNFXCLBAVD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZTUTMDXPIJNY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WDLHCVPRLKUZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RALUUBEVCMVH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/COFGIGMLJYOG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WJXTWQVVGSXN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PDNRIHWTIXST` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SQHQBAAOKFRN` Europe (London) `arn:aws:controltower:eu-west-2::control/WNSAWPPAROTB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OKAMDKPODGVH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MXSHJFTXEQAM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YOEJBUHEPHZY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ORMQUFGUNCRF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DOWAGDSRKWQT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DKOGNVMOVXDM` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZIDBSURCQSXP` US West (N. California) `arn:aws:controltower:us-west-1::control/MEQBWNTEFWIE` US West (Oregon) `arn:aws:controltower:us-west-2::control/SPMPWQSGOLSG`

SH.EC2.23

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.23	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LTVXHJCKBGPG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OMUSTUSTDTUI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QFKXMWQOYSLE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JHWDNMKPAYRK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EJRHFCVWQRZS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MPTUHRDKCFSO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/POFZZOPTPXXG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HOMZIRWWCSWU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QKRVHRZEHOZZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HUSORROPEBJO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YZXWIKMVECPX` Canada (Central) `arn:aws:controltower:ca-central-1::control/UQZLLSOWWAAT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HAIHUOJUVULT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QFTGGFGWTDTI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FMZRJGNZGTLM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YCLKRCLZPSAK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KDUAAUNJEKYT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FPBOYHRBEENX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OVJGVTKPMGPG` Europe (London) `arn:aws:controltower:eu-west-2::control/RZAYURLGLITJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MKPOBINBPVJP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QRIPPZWTNHIW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QZPDTXHLZYZN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HLYRKTDMAYDS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EBHYPMTFLIHR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RHHFSXUVOLEM` US East (Ohio) `arn:aws:controltower:us-east-2::control/QBRSVXZPDEVQ` US West (N. California) `arn:aws:controltower:us-west-1::control/TROVUNZNPSAT` US West (Oregon) `arn:aws:controltower:us-west-2::control/NRTOUZZSTMBL`

SH.EC2.25

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.25	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XAPHKGICKEWO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/USRSKJXLIMTP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EVOXPWVTDVNV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZLOKQIGTIHZD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OKATDKHPXHHQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UXLJDHFLBJUT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JFOJHLNFFHQM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NSCQQNUEXPIM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QRHEHTVORUEM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NERQUPBKXKMP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JJJDDJMEJQHX` Canada (Central) `arn:aws:controltower:ca-central-1::control/GGJFODCQQCED` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NFLGICBRPHXZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VUWLCAOPMGSK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FUGBAYMWHQLM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EXZUBEASRXGZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UJODXYQTYQTJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QEDCADYYKKUJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LKSBZRZYHPVM` Europe (London) `arn:aws:controltower:eu-west-2::control/KCCULCTGPQQU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DRAUXWZUWCMJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JYSUVGJVILWK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MAEAXNRXJGGA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/INTQVTXVYWFM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SFJZGXMIEGNS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YCRFUQNWQGOU` US East (Ohio) `arn:aws:controltower:us-east-2::control/KPVGGAGMRUAT` US West (N. California) `arn:aws:controltower:us-west-1::control/XFLFCYPAZYWT` US West (Oregon) `arn:aws:controltower:us-west-2::control/FYFOMHKXJRNV`

SH.EC2.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CFMOMRYPRWFD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PLKNPBJYXWJU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RKVSDKLNGUBT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SVKZOQVUBAEW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NMOQUEIWWILR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WKHAUMVQJHBL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FBLTJKNPGYIA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CXPQSIRUAETB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QJPYFHYYTIDF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IZUERUTTSVVY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TQCIFMRFCZFI` Canada (Central) `arn:aws:controltower:ca-central-1::control/IEYBLJBRQTUY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HSAZCBIKXSHO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OCODNWWHJRAO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BIPPRPIRIKIE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WSODWMGKOUOW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KOCFPCCSODUJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YBWRYKBDTKGN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BXLYPFODSWXQ` Europe (London) `arn:aws:controltower:eu-west-2::control/TBZTSHAAEMWV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VDKPJCLCXQXP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YTMWTOLFTWUH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OENFDOWKEDVN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ENVNKIEJEIGX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TYBCYJHHUZHB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GPEXDJMATYQR` US East (Ohio) `arn:aws:controltower:us-east-2::control/MAVIODWHWGFU` US West (N. California) `arn:aws:controltower:us-west-1::control/OPFUDJAJJEQG` US West (Oregon) `arn:aws:controltower:us-west-2::control/LUVWJGYMJGGN`

SH.EC2.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.4	Optimize costs	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HGKFDXNLNWUS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SAQERFWNWQHH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HXHUZBBSJPTR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QVKVKMNHBRCV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NKRDRGTBTTIL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FTPNAYEWDTJT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/INFJUMTAJCWG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YPHZLBGOPEEF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TWWDQASEKNOR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZAASKAOSZKJG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UUBWVHOXZERE` Canada (Central) `arn:aws:controltower:ca-central-1::control/KWVQHHYVRNDF` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/DAQBEDMCKBQJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RJYQZKDGGPZO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OLZKKNEBMYYB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SVYLMDWLNEDS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RBHTGGOPGDYH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YWTUTRECJOJB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EJXFSQMMOBAU` Europe (London) `arn:aws:controltower:eu-west-2::control/MKJYAFFLOUTW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CUCAOWNGMHEU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XXDSSWKMJPRO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VXWNSAXYOZRJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RIAPJKWTUMIM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QOZOELBFZTCX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GTXSQEJWOBFI` US East (Ohio) `arn:aws:controltower:us-east-2::control/CVCROVPNPPCG` US West (N. California) `arn:aws:controltower:us-west-1::control/VBBWMDZZYTJK` US West (Oregon) `arn:aws:controltower:us-west-2::control/FICBNNTRAXTL`

SH.EC2.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.6	CIS AWS Benchmark 1.4 3.9 NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YQMGYJCACHWC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LRAVXDOBDWYT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OTTDUNOMCDCZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GIBTSEIVFPKI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KLHSLNRXJWBV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XSSFYRGJZNXH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ISLBYPRPLVGL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/COKPYBGATQFC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NZTMIPSZHEMV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KTEZAGNWATES` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RXAYBSGRJSVR` Canada (Central) `arn:aws:controltower:ca-central-1::control/OKZLDNISDVIX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NHZFXQDYRZGG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FWYAUKSIVHLF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CDWQASYHFNZX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XMDSIZZAWLKR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VWVYDJTCUGDR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WBMBBJQIKXEJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EKEHTOJRBETQ` Europe (London) `arn:aws:controltower:eu-west-2::control/CTTUXWTGFADQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FWEXUOKAJABW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WQTPMSQAWWPY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AYDQKGMDQWYK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DSFHAVKZUWMM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VBVVYZQYOWSO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BEEYZGSRRAZM` US East (Ohio) `arn:aws:controltower:us-east-2::control/KGITVPNAWVRN` US West (N. California) `arn:aws:controltower:us-west-1::control/UJGZYPQJITPC` US West (Oregon) `arn:aws:controltower:us-west-2::control/PDPODRNNTZOK`

SH.EC2.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.7	CIS AWS Benchmark 1.4 2.2.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KIMFXDECVRKF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MOQANIKCOGIU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AMMZARWOCRGP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PPUMEARUOMAS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OJWCFNXYGCAP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YGQDRTWXYLOX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UNNPUUZCMSIN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ROKMSCRMLKWF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KOPZMCROGHHM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XJMFQNQAPKVN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DLJMPWICLAQP` Canada (Central) `arn:aws:controltower:ca-central-1::control/XGNQTADZLIOK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AMXYWGRBZAUR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NYJHLLGLJNVL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HGUZMLCIPHIA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KXOHMXGPWJQZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HNRRRBMKBJKE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FUBEZAAHXFDB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ILUNFEJNBVLU` Europe (London) `arn:aws:controltower:eu-west-2::control/FHAGCBGOFCZO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KKPRSSACQYWB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BJOYYBNMHYWW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SVJTOWEPPDHK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GTAUBCBZVFQD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DQPCEGISFCNR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AIOQAEVYZWFE` US East (Ohio) `arn:aws:controltower:us-east-2::control/OYKQLAORAIBS` US West (N. California) `arn:aws:controltower:us-west-1::control/MFFNOSWTXLHJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/JONOVBLPBWAW`

SH.EC2.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.8	NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XJMRSHVOHPSH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HROSXRFZJWGF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZTLTQYUVGVMO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WENMEHKVCFXE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZCHTVKFCYRLG` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BICIOKSBGCME` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SNEJNAQWLZFS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PJIPLFCSHLGZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/JIQJXDPKNWCG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SKLUMZUSGPXZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YUUASYFEKTYI` Canada (Central) `arn:aws:controltower:ca-central-1::control/HXUBJTXHYPIP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PUTRRPWWOCJJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EPCOXJUHAMZG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XEPPSQCWGKST` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EVQZCKSCDYBU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JEAZMYRIWZAC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OOPFUUSLYKRG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HBOYAMQJYZKC` Europe (London) `arn:aws:controltower:eu-west-2::control/YQTWMNPRSUPZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LFDVAAXJLZNB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AAMXHVKEWQLB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LZQEEOZHAYBQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DGFXYNQJAVOC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IINOISFTCCHY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RZXGVSCOVETI` US East (Ohio) `arn:aws:controltower:us-east-2::control/LUMAXIDLGKZV` US West (N. California) `arn:aws:controltower:us-west-1::control/DUWQHNJEQKNS` US West (Oregon) `arn:aws:controltower:us-west-2::control/IFGERUTZUTFR`

SH.EC2.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EC2.9	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OKPGIXLZQRIO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EIMNSHDGLQVB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VVFAVFGIYDED` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EXUUFYGYJTSR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZKJSMVYVUARZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DJYJFJKFZGNB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DODMLNUCRLQT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WHRCLJSDRMGI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MQLRBDKQRBRZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FVYZMHLQWQIC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OKFZZQLFBDBI` Canada (Central) `arn:aws:controltower:ca-central-1::control/XPJJCAOJDFWB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HCLHILLOGJJK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DWBLDYSTIZXJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MKOFVWRGJTTD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GDLDQWNBTZSC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KUDNEDMDHXIE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ASUNJVJNROQA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GAVOLJJJJLIJ` Europe (London) `arn:aws:controltower:eu-west-2::control/JQNYRJPWYEUN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YMHVDAULAAXN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QUDLGPTBDXPE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SVDMZPBRMQFH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AUNBKCAOOIIT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WVIZDNIFQJVE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MINKVOGPJARR` US East (Ohio) `arn:aws:controltower:us-east-2::control/RYXXKGSIEIVR` US West (N. California) `arn:aws:controltower:us-west-1::control/FZQCADBOVIHK` US West (Oregon) `arn:aws:controltower:us-west-2::control/KXUMGWDZGDKW`

SH.ECR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECR.1	NIST 800-53 Rev 5 RA-5 PCI DSS version 3.2.1 11.2.3 PCI DSS version 3.2.1 6.3.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MVZNPNPLPRNV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EPBJHIEWIVAA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QVUCVSZUBUVL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AQOJKZAMTAPS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WWIZFFUMTLCH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FKTCYLYWJYFL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VGDUWIBBOKKR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DISETFBTTHBO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KTMZOOLGTWJX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ENWXSEDZQFPT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BSHBOHOTBWFK` Canada (Central) `arn:aws:controltower:ca-central-1::control/VJWDDYTKMDLE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/IHLIPHEHNOJN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UKMVZZGIXJHA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DNLCBNZJFWLM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YEXPDQMOFOBN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PVWLVFHWSVKP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JHZZFUBHZBCB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UFGUBZPYBLPN` Europe (London) `arn:aws:controltower:eu-west-2::control/GOSHHOOLDEUD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FVBLDVJDBING` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IIRRKEUJNOPW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RJNDLLHHWRFQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QEUXUOMIMVYR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FYIVBNSACUET` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OZQOTZVQZXUY` US East (Ohio) `arn:aws:controltower:us-east-2::control/JQCJORMCEEUT` US West (N. California) `arn:aws:controltower:us-west-1::control/JEZPGFQEPEQL` US West (Oregon) `arn:aws:controltower:us-west-2::control/LIWRSKLRMDEW`

SH.ECR.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECR.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-8(1) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HXFNNYMBNPTG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IRGFQCSIVCFT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UEEBKULXVSOR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OCKPMLOSKZGW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OMQODDHDHDHY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LOYORBYGCYNU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QLIFEPVSULQB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TKDSBFRHCRHM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/THACMOMUCYAC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IYYZHHAJQSEA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YMICFUBHPSFL` Canada (Central) `arn:aws:controltower:ca-central-1::control/SKIMJMSMPJYN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/DQCLJRPOCNLJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WNRNZOLQUPYQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DWAZBJSQQRKV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FMXGUCTEFMHU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ULRYOBBPOVKA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EBQIYCTPBKTZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MTSVJIZFHVJG` Europe (London) `arn:aws:controltower:eu-west-2::control/DOWLYNHVRUPZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CFENKYCNLFUQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QCMHFKRZFAYF` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SSILKIVAQLHG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ARGHRKUTBONS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/POXSILHFUISA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ASKLTEEGJOIL` US East (Ohio) `arn:aws:controltower:us-east-2::control/JWNRPDFKGDYD` US West (N. California) `arn:aws:controltower:us-west-1::control/HKFGMXYZUIZU` US West (Oregon) `arn:aws:controltower:us-west-2::control/ICDSCZRMSAGC`

SH.ECR.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECR.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 3.1	Manage vulnerabilities Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DFUBEZMXEZBL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SUEJQARYPPAE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NQSPSFVPXCGO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IXMOORTCBTMD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JJPFCAGLTADD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AMXIUAVTMARH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BLMMXDEPNVRM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XOFCCMMRFEKZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VMXVKJDQHDKB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YFMDKMOWVHHA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ESDJRQSSVDUR` Canada (Central) `arn:aws:controltower:ca-central-1::control/UUKJMLKQDJSZ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FLKYFUIDDUDQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TXULSFUTMWAD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JSBJEUKDIWVD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KQEEWFQPLSVD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SVFFPGHZMQZV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LMYYZFNCXZOV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EYLAVXIWUYJG` Europe (London) `arn:aws:controltower:eu-west-2::control/YZOORHCUOIIX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UDIEIIADBPPZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RTOXVKSAYWWI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GYHTXKTWTAAN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HAWCXMYKQQTT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AIBSWGEPDIRC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UDDDYEJAYHXP` US East (Ohio) `arn:aws:controltower:us-east-2::control/PQBPPQRIRVDR` US West (N. California) `arn:aws:controltower:us-west-1::control/PKBHCVZWGSUM` US West (Oregon) `arn:aws:controltower:us-west-2::control/HDESRSEEGACA`

SH.ECS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.1	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 6.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SZWEHVVHJMIP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DSKLVAJRQURD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PTKUNQWSQMBF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CRTKLEJMVWKX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TKHDTPAGORXX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DZKNSGRUQHTT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AZCCGLCEAZQW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DRQQFNIOIXFD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CPDDHHPDKPIP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OUSVYVZTTODX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EXKYKYRGTWQO` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZBKHVVFKVDFR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TMAVUWCXLZXC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XDQJHTGYRMXH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GNTMGCLHMVJV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VPIMQOUEKYAC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MOMGWAKIYXIB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SPBGFRVWZHXV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JUUTNCMUDPKT` Europe (London) `arn:aws:controltower:eu-west-2::control/WVYXIBWPTVGT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KJDQIUMDDLYE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OPSDXIWYJWOR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WHJIHKILMMNI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PLSZPIQAPQQM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RKEJYYZHLSHX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OPQLRHGSJJBU` US East (Ohio) `arn:aws:controltower:us-east-2::control/YQDCIBDYUPTD` US West (N. California) `arn:aws:controltower:us-west-1::control/NVCVMSRIONRR` US West (Oregon) `arn:aws:controltower:us-west-2::control/PZJZHDWZUIMB`

SH.ECS.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.10	NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KOCBIIWAJAEB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MXBUBAMPJWPR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ALVOGJRVKKZK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MFBANBYEIBII` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NCBQOETLDNIN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SUDPRJEDUAWI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HXVNTLYIMNHV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JLJTQCESWDOA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WILNHTOPFEWQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IGLKLJYVMMSU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JQVQLOXPHPKX` Canada (Central) `arn:aws:controltower:ca-central-1::control/ULWMHFCYLPWR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SAGZKBZXLFFI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XRZGHYWSUNRE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FPJHJVSSVDDO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EBJTJOMBWLNQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BUXJKSNSQFYK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IQEIAIOLUKVP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TAHWMCHCPTII` Europe (London) `arn:aws:controltower:eu-west-2::control/WTDCOBPXKBVY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XUEPVHSYPADK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YKLCIABZQBFC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MCEZJKKCKGKH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CDSDRHKXGBDR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NLUIVMHMGHOA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WWVYZKSEXPPK` US East (Ohio) `arn:aws:controltower:us-east-2::control/ABBRGFOMERCX` US West (N. California) `arn:aws:controltower:us-west-1::control/ANFBKAZJRLAL` US West (Oregon) `arn:aws:controltower:us-west-2::control/LOZWHACNQRQQ`

SH.ECS.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.12	NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BSCPZOUSBDWC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GRFKVGOXCFQF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EOYYFDCHIFPM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QILRKMIFRVDI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NDZNBCDEZWFW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XAFJJVQHMGNX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NBZYIOUJQOZL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EVNJGVRMBUIZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MGJPDOBPUTIT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DIJSFTNEWYLQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XYPXLPEVXQBZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/KXERYZUCGGJC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TYBEIOMBHPXB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TTHICLWSSHFL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZWAFHWIZMEZE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UOGMDFBVJPQJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RAPTAXZKDGMR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EVHXIFTXJMKK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NCQMUQIVVXCS` Europe (London) `arn:aws:controltower:eu-west-2::control/GIMEJGBOEQRI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PQEJONXBITPM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KDHKOXIRCOFK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DCGTNKUDXIRB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QCTGYTTZKNST` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EXXSLRJHTNEZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LWIVFPXZOSHV` US East (Ohio) `arn:aws:controltower:us-east-2::control/FZXOIKGOONZN` US West (N. California) `arn:aws:controltower:us-west-1::control/PJKCMWEKLDRL` US West (Oregon) `arn:aws:controltower:us-west-2::control/TPAZNYVAIDJA`

SH.ECS.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LGEZYLBHCFCX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GKPBYQJCJXNZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DRVAMWTXHOSO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AZEUZHAHYCTW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CZIGPOPRPXYN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OCQSRQOSDJOY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KQMHXULBWHPS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZPDCBKMLWIIO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OAVLGBTROIFK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CMJWPEJCMMSE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QKWKAABSDKXP` Canada (Central) `arn:aws:controltower:ca-central-1::control/BEDXPJRWTDZQ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OCPIMTZFSBCN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JVNVFXHHIODF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BJCUGFWEWJPE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GEWFDODMQPJO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CLAYNXLGAVDN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HPJLJYIRMNTD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HCEOCFPEDPJB` Europe (London) `arn:aws:controltower:eu-west-2::control/MGZAPMBPTJJC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ATLAWWQGPGKL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UDIHIZIINZZE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LZPFIOYTKEPQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WBEJGNWAHACL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LKTODXRXWLVB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JCFLSLPRFWPS` US East (Ohio) `arn:aws:controltower:us-east-2::control/HGHFAHJTOSDD` US West (N. California) `arn:aws:controltower:us-west-1::control/QWKOXTIBTRAG` US West (Oregon) `arn:aws:controltower:us-west-2::control/ITRPZWOLQECJ`

SH.ECS.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.3.7	Protect configurations Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MHQPQEPZUDYX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MXRTNPLUMULO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YNJYRFYEDDHE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VJYBXQPUIUBX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZLVEDBUXMLDS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZMMJVDDXRGGF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QOYRGWFHSGFZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CQYNUJHWPJMZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XTGMIDMJOWXW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BGEYNPATXDUK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AZLDGSVPGHXI` Canada (Central) `arn:aws:controltower:ca-central-1::control/SFBMOXOHPGJA` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WGCZSMZYPRVA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SNWDOPIOUEOV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AAFEFSFJFGFC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KNUALLKQETTY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KMZNBGRAUSFH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PIVTGNWBHWLJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XKOKVXODCBPP` Europe (London) `arn:aws:controltower:eu-west-2::control/WWVNVNIGVLQY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PJOVTFEHEAKV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MPXJFGYGYNCO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TJGNMPQQSBOV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AAPPXFYCSWYU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JXVVVCWLLIJN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UFYTWRSCKNKN` US East (Ohio) `arn:aws:controltower:us-east-2::control/DESMSSIJBYWH` US West (N. California) `arn:aws:controltower:us-west-1::control/DPBKENFFLCHB` US West (Oregon) `arn:aws:controltower:us-west-2::control/KYMDJLKLXJHG`

SH.ECS.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.4	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DLSNTJKGQSHI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KRIZYNEJUYSV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QTLPYWOKIUKL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZLQSIBGRUZQN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TBCVJBGPTNRN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YEZCUVRWIYFA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HLOEWPGIUMUN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WYHAZMRJHMRS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LFUVYWFYYLLU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RHMLILLHZJHX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HDUKAFUQIVRN` Canada (Central) `arn:aws:controltower:ca-central-1::control/IFCCVDCGNTTK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NGBPVXHQTDYA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YZQPFFCVZSNL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/APLYEMSZHMGP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PGNRTTNFKGWF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DPDNARELDWKA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZZHVNIVRKTDW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BTEHFAMXVTLV` Europe (London) `arn:aws:controltower:eu-west-2::control/HQTXDZNCYCVT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/STYZIXTVYTTF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PXWXSRHGAUVA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZQPQEFBOEAFE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EWBOKRDDYUVS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HIEAVTMGOSDM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZTDLFKNABSTB` US East (Ohio) `arn:aws:controltower:us-east-2::control/OCQLRQRWYOGE` US West (N. California) `arn:aws:controltower:us-west-1::control/GSDEWHVOWFBJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/MRRRZFTNEETG`

SH.ECS.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.5	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ILSSNRCUTZWL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TESCPUMLRYMJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JHKKIIMQVTBF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RXTACLFMBSCY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ELRGZFCLXSTZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AFNCBEGBYIXM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MIZNLHYOJSAP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GETZOYOUJIXQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XWHFZMHURMPA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ORUQHLXWMNAG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AWVFLCGFLTJY` Canada (Central) `arn:aws:controltower:ca-central-1::control/XGGLVMQEYMTU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LHVIHTFBYKQR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JRZBGRQCVXUK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KEYDQEZAMGMX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZUITZQOVJNUJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CLVYQDKYSUZI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YXSNWAJDFONY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UIKDFBESIRCQ` Europe (London) `arn:aws:controltower:eu-west-2::control/PAQMWTHTZYVV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JFIBZVCAGGGD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KVNMSSAONMET` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LOIWXDUPTFKY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JZBWZXCIODDJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ONOOSEFNYAQJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KPIETXSDELVX` US East (Ohio) `arn:aws:controltower:us-east-2::control/DZURSFLDZJCZ` US West (N. California) `arn:aws:controltower:us-west-1::control/CVZOJYLQKGMS` US West (Oregon) `arn:aws:controltower:us-west-2::control/GTHMXNOZDNXN`

SH.ECS.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ECS.8	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 8.2.1	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UYSOVWBHUISV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XVZZSJJLYUKS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FXUBXSUYWJPD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GNPKSCSZTRDA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TPAFCBBFMPSP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KANMMZEMJFTV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IIBOZJQGIUJM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WQZEZOJHIDDT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HLGKEXFGGOBE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YUERYKUWJCKB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UENWNTFFAIXY` Canada (Central) `arn:aws:controltower:ca-central-1::control/OTHWMXXNMCSP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WLCVUFTTECBE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RTATKXPWIRIB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VCSIRHFXUBDG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HGLDPNFOQMBH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DYUFYCSMBVVE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CWPYLOYKUYQL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EMXDVHJLRSJH` Europe (London) `arn:aws:controltower:eu-west-2::control/BPVJCGDDGSQY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MVNPGRMJPAIV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ESSOBFZEGAME` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NXOSVPQYAXBD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZCTAAUJUVNNL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RNZTOFGURZUK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LJCQVFMBPQAV` US East (Ohio) `arn:aws:controltower:us-east-2::control/NAWGNOLLSBXU` US West (N. California) `arn:aws:controltower:us-west-1::control/UBMPZYXOEOSM` US West (Oregon) `arn:aws:controltower:us-west-2::control/VHVNQSXRDIET`

SH.EFS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EFS.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TFHSSDJRCTZY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SLDJKLKWIOUH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DOBFVCUKROMU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YNHUHLGHQVNE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PEFGDAPWOCZZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IUAGTQHHNXJJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TXBXPYIOXWJS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FCPQPNIVMTLV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TTLLYUNPAEQS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AXBSMPYAMYJK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MKGQOXSPKRAD` Canada (Central) `arn:aws:controltower:ca-central-1::control/CSVENQNTZNYV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NKPEDBIXXLOU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EEWVZSOALXSA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DWPOEBVESPXO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QNVQPFTVIXEA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TKNBLKWVOZOG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HCLXEJAPCRIY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YRPBNRJZQEHL` Europe (London) `arn:aws:controltower:eu-west-2::control/BNXMOCOJDLXM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TPNLRFVPUGON` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MHEAAQADTSMS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KBBKAEXXISZV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IGLSTMSVAELW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GJQNSJLZRNTD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DAAYOZMUFPOA` US East (Ohio) `arn:aws:controltower:us-east-2::control/TUBTOQPYRFCZ` US West (N. California) `arn:aws:controltower:us-west-1::control/ZOQSLEMJOPAG` US West (Oregon) `arn:aws:controltower:us-west-2::control/SSNRPFOJAFFZ`

SH.EFS.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EFS.2	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BJXDDYDJEOWE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JJCAFNCMRLEH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/POMNJTHRCLYE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VTEXLEQNDAOK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QJUJQJHCGPMM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RYDLPNLERROW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZCNUZOBEOGLC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LNAWKNUYDXZM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OJAGQJKAXRQT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PRTQCTAKZWDW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AKMHRCMZKOJP` Canada (Central) `arn:aws:controltower:ca-central-1::control/GCWIQEDCGVFE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YDPNCZNDSSFU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QRUYZOHTBYFY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WZYZWFVHKZGJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FGMJDIKXKHPE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IVBSVCDSCYOK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DMMVCSXPELDJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FVGXQKRPKOYS` Europe (London) `arn:aws:controltower:eu-west-2::control/CRQDNORELCAL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YVVVIWNYDVIW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZCVATPIZYBIL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TKMFEVYTECKF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RSIKZTULCHYF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PTOQRJVREEMJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AKKPASMFZEGR` US East (Ohio) `arn:aws:controltower:us-east-2::control/PDXZZWIPVJJY` US West (N. California) `arn:aws:controltower:us-west-1::control/YNYOCEJWWSRB` US West (Oregon) `arn:aws:controltower:us-west-2::control/PGSGUFIPZMDK`

SH.EFS.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EFS.3	NIST 800-53 Rev 5 AC-6(10) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FOLBDIUMJWPD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JTLLXECNDVPV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BBXHQCBPAYLS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FMAXTHSWUHAN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QQPVAVFALYBH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QZXHMIOHKTKH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FVTTANDJPCUB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MLSTPREPKCET` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OPPEWLVDKCXA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KPGRCEEMAJGT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HSIDWOHLIQEW` Canada (Central) `arn:aws:controltower:ca-central-1::control/JJUVJECZICXY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BUDRXSHCOGSQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZVUGCKESDOAV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LTKEQNETPZJY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RIRPTGIVTUUG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LWNGKBTNPFJH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ODGUDUJGADKL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FRSIKZQWOZSG` Europe (London) `arn:aws:controltower:eu-west-2::control/FWTBUWRJMMAI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EMNDTRBBZAOD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CQSAAOHTFRDM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VGQPGJBDIUIU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ULZFCDANAPGC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SYGALLBUNRYO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YLSKXEGSHZFO` US East (Ohio) `arn:aws:controltower:us-east-2::control/DZQNOWWCFPJI` US West (N. California) `arn:aws:controltower:us-west-1::control/EPCJMYEFWURL` US West (Oregon) `arn:aws:controltower:us-west-2::control/NVESMCWZHHTI`

SH.EFS.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EFS.4	NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QOFSGSNGIOOW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UGEKBAPNWMMB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XKCOVRIEKWFZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LHCKUUHCRPBR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PSCHVYXAEMQY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HYFDEIVIDTOE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DWSCMVLGXNUT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VBQLOLHZXKNI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UWYRRBPEEWVO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UGZJYLLGKZBU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VDBMVHLOSUHA` Canada (Central) `arn:aws:controltower:ca-central-1::control/QSSJLANZTBWW` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ODAZBLFJALRS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DDGNCQCYAADS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HMMIHMJLMNYS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RUBEQKKWPQQX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CZQSRKSXMRPB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/COYIITXFFYGR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DUAIAYKTTLBT` Europe (London) `arn:aws:controltower:eu-west-2::control/NLYPSJYEGSYH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SMEIEQREFMGP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ODAKAGHOKRHS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GPOAJZWHHFZV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NBREBLMTEUKG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NUPVFXUNVWQR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IINULENBTTWX` US East (Ohio) `arn:aws:controltower:us-east-2::control/NLBIAOKRHRAW` US West (N. California) `arn:aws:controltower:us-west-1::control/OXIESZJRCGZM` US West (Oregon) `arn:aws:controltower:us-west-2::control/SMRVHSXRVJWI`

SH.EKS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EKS.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PZNJPYGGAHGT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RLUAIIEDIKYI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BLUVRGCQBQCQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HFEPQKKCGYUO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NXRGGRCTDHZW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HGFRLOAZSNPF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SCSYDNSADYGA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HORWJXPWMEYX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SLOTDKVQKNMQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MHZJRRAAHALX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SUMZBIMBVZBY` Canada (Central) `arn:aws:controltower:ca-central-1::control/TLPEVLKHXZPJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/QDTEQPUETVAY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OCMAXHKFGZKW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WJURSPGIRKYY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PLKWFCUWEDYB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DUAIHANNMLVL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UBYUPAHYCWJV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WPMCDIDHHGGQ` Europe (London) `arn:aws:controltower:eu-west-2::control/COPIXEUXPEHP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XUXSTEHHKXOY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CMJCEDJWTSFM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AABWNWRPKUSV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IVFNGYKOLHZI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ATXMHNVLDBRI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QSXPJMVUGBWI` US East (Ohio) `arn:aws:controltower:us-east-2::control/JBGJBQFRJEFT` US West (N. California) `arn:aws:controltower:us-west-1::control/ECMEOTMZWCNO` US West (Oregon) `arn:aws:controltower:us-west-2::control/UCMPEYSGHUVA`

SH.EKS.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EKS.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YHEYMINVSRRA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TBPIUJUVAONS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YTILPIJEMRTA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KNMBERLUNBLY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ECFVWPZVWXPB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OLRVVJBCRSGN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BYELFRVVGDXC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZGYTSFAJVJCI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DAMQGUZZUZBH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VOWKUEFENPWN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KJTDLDLLAKSE` Canada (Central) `arn:aws:controltower:ca-central-1::control/NXDAILOKJURD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HYZUVFXOCCDF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QXPCMOZGPBRZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TPLKDJQMBAOX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NNTRKKQFKPQB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HPKISRTIUYXT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BBTDUDHEUNOX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YSQYVFCPJXKE` Europe (London) `arn:aws:controltower:eu-west-2::control/YIJVYZLMAWXZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EKDIUQEYSTOM` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CIERKGJECKQW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IIVZJTCZIKUT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EZRJDWZIQMBV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HQAHDQEAVOUR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RDAUUJAGICFK` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZFJKLNNVBGRM` US West (N. California) `arn:aws:controltower:us-west-1::control/GYVEZGBOVENZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/KTILUSDFMIXF`

SH.ELB.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.10	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CKXZCVMBAYHF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KBTZTSCDMAZV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QCGDTTLRIYXP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KXJZKDGJXTYM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EKJRKPNZNTPH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SNUVEKZNARWV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EVKSZNELWESB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FJZFXVJRPRAZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZDVYGBSRJWYG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GOSBQHKZWLMA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PKWEABLVIYRC` Canada (Central) `arn:aws:controltower:ca-central-1::control/RVBQKRTSIQHB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KIHYQSWCHQVT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NURKMCLEHUPH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GAFIKGMDZOOB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XTYTRYANVABU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VDJAWJVTTZTD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LQVLBBSCSCTQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KXDJVFVEKKHB` Europe (London) `arn:aws:controltower:eu-west-2::control/FAOBZSYTLPVT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XBJIKRKMXAOD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AAIBGQKSHHIR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MPNVVBENTFQC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QFTBMEPARCLC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WDXWFRSIXIUZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FVCVSQHZTIZT` US East (Ohio) `arn:aws:controltower:us-east-2::control/GPJSWKIEBWUR` US West (N. California) `arn:aws:controltower:us-west-1::control/WSUSFKNXHPIX` US West (Oregon) `arn:aws:controltower:us-west-2::control/USWBDHCGVRDW`

SH.ELB.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.12	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.3 PCI DSS version 3.2.1 6.6	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QKXDBZCRGDOQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FDYRJEVDYAMZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/PUUVSMOQZIPJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QXHRCRDLPKYU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NXIONUMPAELM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LKVZZNIHLSAG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UHZLVYPLDRQE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HAQAZMDWOYQJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UXUMUBGBZHZO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WSPIJIJQEGPF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RCHKBNQTXCVX` Canada (Central) `arn:aws:controltower:ca-central-1::control/TUKTIBCDJAVB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SOHOTIVOKVPW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VDPGRRYBGHOV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ILOYBFAFYJIB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JYQSYKANCTJW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TZKYSLICQLBP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DOVLDSTXJAUL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VPPWCERAPGTV` Europe (London) `arn:aws:controltower:eu-west-2::control/QVTSOBDYQEAJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JBHKDYCKJGIH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GZNVSWXQZTLM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LPXJGWJZPVXW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OCCFTGEZKUUQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HQGAZVJBHZXY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZLQPMXHBILJA` US East (Ohio) `arn:aws:controltower:us-east-2::control/VGZVYNURBZDT` US West (N. California) `arn:aws:controltower:us-west-1::control/LRHZZLHRJNUX` US West (Oregon) `arn:aws:controltower:us-west-2::control/LVFJKSJQZIZH`

SH.ELB.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.13	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JVKBZJSZJJRK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YEHCCDZVQHPU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WARGNXCJHUVW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RAMKNMUEEEXG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MIBWUBKXYDPJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WMXUZBXGIQWF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WBLFCWHDUJAE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TEGUOPRVXVVR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZUSLMMQOYOHO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CBCPFZJYJPCZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PEQJWBXGOPKA` Canada (Central) `arn:aws:controltower:ca-central-1::control/FXCYGAGEGPGU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MLOMVGPUWHWO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IHSKURWXDUTW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TNSWZEUETMJV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SRJYXMTWSTJE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QWHBTFPDPONS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GMNLFERXOINC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XLTLBTOQHXLF` Europe (London) `arn:aws:controltower:eu-west-2::control/QSDQGJCOPYSA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PIVSOAXMRWDV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/STAPMLGXPHZJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JRMOTVPYFKVZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BLGKBHADUXBZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PKDNMVJGPHFK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KXYVYWSAVBJH` US East (Ohio) `arn:aws:controltower:us-east-2::control/UECMTXGSEOCG` US West (N. California) `arn:aws:controltower:us-west-1::control/BXDUORERQDGQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/ISTVPVBYSJIR`

SH.ELB.14

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.14	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.3 PCI DSS version 3.2.1 6.6	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BLKJDNQOOPYZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DNGQPKLYSATM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XJCITYUFRAZL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JMOCSNTDNPPI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QZCSKRAKNTLY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GFCILRDCWFSU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DEJCGPEZWQZO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WUXJUUZOQMXC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NTKIROXXRLDD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/WXDBJQMZPZEI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RYRYNOIYYKNG` Canada (Central) `arn:aws:controltower:ca-central-1::control/HABOKKLKHBXF` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZVORGIKGGTHQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EWPWYQNJOIWE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UVTTCAVNVZZV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KUDRCOMEIPTR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YYKQGZLWYWRA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KSNRKEYHKNSY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HUBSUIYPXEUM` Europe (London) `arn:aws:controltower:eu-west-2::control/JHDFVZTRLRQD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KGEMSZYTABFZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UOZYYWOJKSLC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GWALXXFBLAQX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BZIUINLRAIGK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SWGZINQZMLLT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YFWVKLAFIBUY` US East (Ohio) `arn:aws:controltower:us-east-2::control/WCWDSWOQLVAX` US West (N. California) `arn:aws:controltower:us-west-1::control/OAUQWMMSCVFX` US West (Oregon) `arn:aws:controltower:us-west-2::control/DQHJULQCNNCE`

SH.ELB.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.2	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(5) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SIKWHFLKEIBP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FJHRVGIVYRAG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CERDAWILYRQO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UTLWZJKGQSNN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OEODZBWNEIYC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QIAVFQEMYPRM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NZKULVEFLCPF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FNNZMAARRNKG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HQUTVBZCPUEL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CDXNAIGWNAZI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CSCDKDOOXGEE` Canada (Central) `arn:aws:controltower:ca-central-1::control/GWNPDCMTNYXF` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JIVRSEWSEMEC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UOVULDQLQTHL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JPXYUIGARLMN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZDDENALCTJRR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DYZTHAXBKUQL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TJAGBYAFJZRJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TZOKKXANFHQY` Europe (London) `arn:aws:controltower:eu-west-2::control/FVPMNSNNEBNB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YDXJFEAKHTBR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ARIHSKQKSDDH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JAJRJFIYOGUO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IXXQQZYYZYGQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PLAZVVPNXQRL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CDLXUWUBOOTY` US East (Ohio) `arn:aws:controltower:us-east-2::control/GIDGHLCTSHTW` US West (N. California) `arn:aws:controltower:us-west-1::control/FMIVIICGFRXB` US West (Oregon) `arn:aws:controltower:us-west-2::control/SBRXFCDRVYFI`

SH.ELB.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.3	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MIGDRZDQCYXE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KWVQFWUDDNRJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QRFDGQXERCXB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RHKBQSPWEASW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QYVIFUHJLOKU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KTZTXRNIMGCY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LQBPPJNUQRHK` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BGOEIOEXPOID` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WLNVBASSPYBO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BVUPIIXTVVJE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DVJXZCGLVVOJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/GVQODFJYLZWC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/CKSHWTVRXJKN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BKTUULNOSCWA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GRRMZGYJTIGG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YESXDSARDRYS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OLQAOCDPKUWT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CFQGFDHVUBDU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MBTYIFQQQMUF` Europe (London) `arn:aws:controltower:eu-west-2::control/PMRUICASDLHV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WBBZPUNUJIZW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZWALJUFCFAXN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LMZUXJWVLBVV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SUOXQLRYVMPD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HDCQTGGAITHQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FWOYTUVWHEYQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/YWXMTFLLBGJP` US West (N. California) `arn:aws:controltower:us-west-1::control/ZGOIVNURPERH` US West (Oregon) `arn:aws:controltower:us-west-2::control/DFCYTONBHIGM`

SH.ELB.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.4	NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EHQTZMXOOPIS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WCUNAXIOKSOX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MLYXGOVHGTHD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TEPRPAIKHSCW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MTRJXJDUMVUC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YCLAVFMLZXCO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NETYBSUHJWAE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TGUHGXFNQXKW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FIPLHETXVCED` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QBKKNEVBRDBB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VOKOFIGLJPAL` Canada (Central) `arn:aws:controltower:ca-central-1::control/EPRDRSPZQGPS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AQNZXABKNRBF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TBBRKUWLCCBO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LQNSFDJJBWTU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MWRJRKRTUHHJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MXOMOSXJKPUM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MXSOPCYFZKNO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IMZPHJIOZRLA` Europe (London) `arn:aws:controltower:eu-west-2::control/PWVTDMKGKMJD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UQLQVFUBNHBW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NYZEIHJJFTLA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YSAAMJPUHUKD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HOHMKMFDCQYQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CFXHPKIJYIHO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HBTZGRURMOKM` US East (Ohio) `arn:aws:controltower:us-east-2::control/ROBASCYMSHHJ` US West (N. California) `arn:aws:controltower:us-west-1::control/XINTTRUSSMYM` US West (Oregon) `arn:aws:controltower:us-west-2::control/OELFZGUMNKNU`

SH.ELB.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.5	NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GGCBGYLMFCAP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EGUFZMWYXKEN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OXVTPFBQEEAQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IVVPLPKPUUWQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KXCWRUYQTNSY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FOTLYKSQLKLV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KUTSWPPPROZX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NKENZBRJJPOZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HPXOCKUZZONE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZYULUGIDXWIO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XCCOZXEVQAIF` Canada (Central) `arn:aws:controltower:ca-central-1::control/FBADZSAQTFEX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EPTZXXRKEJXY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CQGLVPHETURU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QOGODLKGBRJI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZSBQEDXDMBGN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PWNJUISLYJID` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OAFWQGLHGSLT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZSCPMMFXXTQY` Europe (London) `arn:aws:controltower:eu-west-2::control/XTOUKDNICGIV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NJNQRVLHTOEL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KPPRFDSNEHHC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RAIRUOGCZMXO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XYVDVFXNJSMW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EYYHLNPZCJJV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RRDKKWVTNZOH` US East (Ohio) `arn:aws:controltower:us-east-2::control/VURKNNKDBOFS` US West (N. California) `arn:aws:controltower:us-west-1::control/BCKEONHSCFNJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/VVOADNJLLYGS`

SH.ELB.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.6	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WKYXVICTRWVJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GTACUFUJFOLQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZKRUXHVKSDIG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ZONLNMDDOGJO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XNQQSJGAEQGF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QECHNAARNAON` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LKMNGSDAUUOZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BDRMHLFBGUEP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PJAZYXFFMUVW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BZUEXVHCVDFW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WISMFEQWDGEJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UBKSMZHRBUQV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/QLNMDOSXCAGC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WRSISOEDDWSD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DIUYVYZXUPEM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/POKCJDINNSVR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IRNAHNHJOZDS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LAPPDKBMSNVK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DELHOMCMSGRF` Europe (London) `arn:aws:controltower:eu-west-2::control/ZVGHQEHEVMAJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LGIRHZSFPFYQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NRLBJCNTUEWC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DSMVNLEDYFBU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XOVVTHADCZBI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ONGHDHNAAHAV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SYVZPNNPLEGU` US East (Ohio) `arn:aws:controltower:us-east-2::control/GXDETIMMTQLK` US West (N. California) `arn:aws:controltower:us-west-1::control/EWWSQVZDTHVM` US West (Oregon) `arn:aws:controltower:us-west-2::control/HVEKNEMKLWBH`

SH.ELB.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.7	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QQFDXXLGWIZM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JASBBOIDJJQT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZRQGKZBOWPZN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NKYEWHLZPPQC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LVYIZWNHIUSD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IKKHFUAQZUVN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SLEGBPKQJHBZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FIASTWTNRWVC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LPNJZVNGKYJN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CITRADVGNTAS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YGKRXSVZVALL` Canada (Central) `arn:aws:controltower:ca-central-1::control/RRQTKFRGJHIU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/APCBJCVFGOSR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MASPMNHSXITG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LZYJKNUEXQRL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SHYPAFLBHAML` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RPSXICURQJGW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KCAFTTWDKQUT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/THSXODYFVSSS` Europe (London) `arn:aws:controltower:eu-west-2::control/VEJYGWLULHGK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NMSVIJUWETDU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BAPNJTQFHFPW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JXTMSGZCDSVA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/IPVHUNNSNTOX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FMFSHPKQEUCC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WHVUNZVVTRSQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/NYOZBRSAFFEV` US West (N. California) `arn:aws:controltower:us-west-1::control/VNDDHFWXWULL` US West (Oregon) `arn:aws:controltower:us-west-2::control/HXVRPCPCCRZY`

SH.ELB.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.8	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZANGJUABGQYS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TFGJGPSQORAW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DPJVNBBVQGHT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LSDFYBAGXZRB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FDHKJTTJKUWJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BBKARSAMZQXX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OWCBLBIAXYKW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WHZUTCZDEVXU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LBDQCQLATJBB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FQNHHEMZAUQQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SNAZEWUNRHOJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/GFVYJMUPSGXT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YZDTGBGBVBOU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YQLCUFAOJXUX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WNXTKKGSRYFJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IJXHXDULMKRD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RGOVRXPADGUO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BTOGRLASAOMX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GADJVJJLUSKE` Europe (London) `arn:aws:controltower:eu-west-2::control/DSKPMWLYPDGM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YYPWRLINUDDZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ISFCKXASLNGU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WVXBPAHMZTUG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MUKQOORSXDTS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VYFJFUWVHFUY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BORGQLJMFKKU` US East (Ohio) `arn:aws:controltower:us-east-2::control/LJKJKRDIYJNY` US West (N. California) `arn:aws:controltower:us-west-1::control/VVYVCUSYMJDF` US West (Oregon) `arn:aws:controltower:us-west-2::control/FEXUWZRZIBJR`

SH.ELB.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELB.9	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TPHNCYKTGKAT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ETZEWGQBLYKT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SRRIDXSTJWSL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IFCBCLNRPANH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EBMMKHWNUETB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SVECMBMGSKGW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EVUOWSGRWEWU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UPDNDZTPZAIN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PYRVSCBYFIYM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YDOOLTEEQPHM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IEKUHWXICOVE` Canada (Central) `arn:aws:controltower:ca-central-1::control/NIQNQIVTOBLT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/APUKHIKZOWWX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WPWBIGRZPVNS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JPUVJIRCMKZF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SDBXIGMFJFDR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XWNVDGGKONTU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GIHEXCNTFLFR` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VBDNCNXOOKSD` Europe (London) `arn:aws:controltower:eu-west-2::control/GZBBCHZOGDLP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/RJLYXAXGELHQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UYHOLRJQMLPL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LCWNCBHABVYX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FGQCDYTFTIFL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HXSCYTCTJUUH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LYMRJYHLDSDO` US East (Ohio) `arn:aws:controltower:us-east-2::control/JHHGKBILPUKI` US West (N. California) `arn:aws:controltower:us-west-1::control/BYOUCZLQEVRL` US West (Oregon) `arn:aws:controltower:us-west-2::control/DFCKOHVLNFDB`

SH.ELBv2.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ELBv2.1	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SLETKJFKGZDD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EXMPRXAVGBCZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JNZLKQTNNUFG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KCWNEMFFUYLN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OTYTQJEDNFMF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BATAGMQWYONM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EHRVFYCHRLGF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AJRCPZGMLTZJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FJVEBRUCXPRO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PWQLTCVHRKDB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CVGIIIJYOPJE` Canada (Central) `arn:aws:controltower:ca-central-1::control/YGASWQGDRBGT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SKKZLSXTZPFB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SIPOMQYYFWGO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BBCLMOKGMYNN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZQCDKAMUINPZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NVUHRTMKLMGJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TAFHVAWCDKEE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PKGSEAYOWAOJ` Europe (London) `arn:aws:controltower:eu-west-2::control/LOWUMPQRPIGR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GWLFGQOFTRSI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LFSMNKAQOCLB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CGEIYIUUBPQP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RASJLHVWFOBY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BSHPLTXRABUV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PPNNYFOYSBQX` US East (Ohio) `arn:aws:controltower:us-east-2::control/LNITYBGXKRUZ` US West (N. California) `arn:aws:controltower:us-west-1::control/JDTAAUXJTEYF` US West (Oregon) `arn:aws:controltower:us-west-2::control/VBIBPIJKJEYJ`

SH.EMR.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EMR.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NAYPVEADGOMD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IGDKTEKHEWGJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SBGVRVKPCNKE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FUWGQXDEJHVL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/STJUMJQUYPRL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NOTXPWZXUBGQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FHOHEHHEGVZT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LCGUHRDQWNGL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GJCORWHPFGQY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PJESVJUANSXB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WMEBEEINEJSJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/EPAGOHDKWZGV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ULYPPMCVKHFM` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GONVSLDLUOON` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UZBNWERMADPQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IBLZUDBNMLLT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TNVJSMFBVSMY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FEDEJCWQVJVN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RBAJHFBNQNJQ` Europe (London) `arn:aws:controltower:eu-west-2::control/IGGIYASTPRJG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SEFFPSXRZCDD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KQDXDJXPBPSD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FZOHQACIBJPO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/APHPEHYUXGUB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IMKKFPVGPRHC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IFSMMPPVKOTA` US East (Ohio) `arn:aws:controltower:us-east-2::control/JETOPUCSYFAI` US West (N. California) `arn:aws:controltower:us-west-1::control/FKPHOKJPJXQV` US West (Oregon) `arn:aws:controltower:us-west-2::control/JGCWFSRMUIIO`

SH.ES.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FJLLCPADNQRI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BTFXPSJCWREC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UMFDEWAMMCFN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LASVWDCILYGQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UFTABTSVDUCN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SCVOJNYHGDOL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DPQWUTHJQUFO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BIMQVMMQISKP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SFSPFDZNCYNL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PSSZAYXKRTNO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TXKBXIQHETAE` Canada (Central) `arn:aws:controltower:ca-central-1::control/POZXDXUYCPRU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KQYBXQOEQPUN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PFHFMPYLFGRU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UQZODGEVMCYN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PTTSHGGLKLPY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YIIORYNQYAZD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TWLJABPWPIBG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FMHZDKQFRJTA` Europe (London) `arn:aws:controltower:eu-west-2::control/GQVXDQOIVYOG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/KZBVIPYLQACH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CYMXZNWESFUZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BHCHVHBAAUEK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XLRQZVMLCYXX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QHWIQGMZHZJS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NKJEYRKBJVFV` US East (Ohio) `arn:aws:controltower:us-east-2::control/UCHAADGIVPUY` US West (N. California) `arn:aws:controltower:us-west-1::control/ICJDPHKYDJMB` US West (Oregon) `arn:aws:controltower:us-west-2::control/MDTDTZWSIGIP`

SH.ES.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NUBMVPTLFIOS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MDDVJOKGTKCH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WKAJHHZHBVBN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TPVVQKJODFVL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZBQCTENKLCXY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NOKXLSVSZDSE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AQPZACGPBLIP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FUGYRQOZUEJV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BAQAAMCLMWUE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BGTMHGMLPSLX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RYNSUKWHEKFJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/SZZLDHEGHCRE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SUQCFRRDESKV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BOLPWWJIEXNK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HTBTLERHIIFN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LRNNCPQEFSSY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OJYNWSXUYEYR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EJPWVUPLNKFI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EIAQGIKVMUXC` Europe (London) `arn:aws:controltower:eu-west-2::control/JAQAMUDGAIVW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OGKTBRBTRFLO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LHHVFZPSCCSN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CBGOUEEDVYTA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WZWIWALUAQOH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LMUSVXITTLYF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QCHIJWURAOYF` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZOTKTSFENTUJ` US West (N. California) `arn:aws:controltower:us-west-1::control/NFJRPJAPDRMR` US West (Oregon) `arn:aws:controltower:us-west-2::control/HDSBLJREMYRX`

SH.ES.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.3	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OYNSZIYQFZFL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DMMKKQXOCSHY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/NJNJRYBPIRKY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WJVNWGGFDDKN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WEYEZKFDEHMJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OZYVQTZLOGQO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ODCZILUCVWCI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PPYOPHNGFCAW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LDLVCUOJCZXV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FLPWHVUNXCGK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BQYGMMUGUNYP` Canada (Central) `arn:aws:controltower:ca-central-1::control/XLMZTTAZIZFJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZRPPSGUOUXRE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QQBVGZTCKGJJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VOCKVBVIXGPO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IOPRWMTVBSLN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MTUARCWFQCMU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JQBKMBHGJVTB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YMPGRSPCJBBD` Europe (London) `arn:aws:controltower:eu-west-2::control/DLCHOACBHILF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BEMDKYRVFDOA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JBOJNUOTVVNI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JFBEKONTTSST` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KVQXVUUKWVYO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RPIHYXAKUGCV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QYNCJNDFTBXE` US East (Ohio) `arn:aws:controltower:us-east-2::control/ULPXARUKLUVO` US West (N. California) `arn:aws:controltower:us-west-1::control/SMXCBZSJLEHZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/FMBZHHQPTZTW`

SH.ES.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.4	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JFVRUBCHYLNT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YMQKWQKNNHRQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HNFCSNRZEIRX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SYUVAMHWZNFM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MCCXEFZBURHZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TIPBMSRPMONC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HNXBAYGDTHSS` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GFKAIZZPILLQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NTWHSOQIKOPQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FWEXPAJZVZXD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CBNORVNWJSKN` Canada (Central) `arn:aws:controltower:ca-central-1::control/DHRRWEWMKFNT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/RWJXIRWCIKUP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/LTWWGEJUMYGH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XUINBCFCAGRU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WZYPFCRTWXIX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GMBCTWRDCQSD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HMSUGFHMAOKF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RMAQOLXGSLKK` Europe (London) `arn:aws:controltower:eu-west-2::control/RVIBRAMTLWXY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NCUUHDFHMXWJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SVVXFCSZWZGT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YMPJJICGYTXQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GXCORENQKVSQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HHDZXJRNTOKS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/STVVHFHXKVQM` US East (Ohio) `arn:aws:controltower:us-east-2::control/BWPWOZTDEDRN` US West (N. California) `arn:aws:controltower:us-west-1::control/PWMKWZWORUTC` US West (Oregon) `arn:aws:controltower:us-west-2::control/SJLJVDZSATIT`

SH.ES.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.5	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MEWWZVBHFVKN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YMGZPSVSKDBQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ELQAASFTEWWI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ECKECTWTCCES` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QMURUKXSMBPV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YVMKOVTHFRNH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UIBDVRJADGKZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AKWSXUIZDGPZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HBJICLMPQAQO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EUQQUILQLOSY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KQYGFFWLNNLN` Canada (Central) `arn:aws:controltower:ca-central-1::control/FUEFZWKCJABK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PENXPYCCVCZK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TETKGHQCHVTJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/STAHFNQBOJDH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YBTLUGMFRDZE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NWDNGENHAIJF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OQAITYPOGVKL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZAAOBYBSNALV` Europe (London) `arn:aws:controltower:eu-west-2::control/WJGQNETAVNGC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XUDITOXTGLVI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EYRDWURBOHQP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UQQKJVAKATEP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DOVTOEIANGDI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EFCMMUJLPXPU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MMCPMMUFJIYU` US East (Ohio) `arn:aws:controltower:us-east-2::control/XMJYMFUZYCDL` US West (N. California) `arn:aws:controltower:us-west-1::control/EFAWSYQWHIVU` US West (Oregon) `arn:aws:controltower:us-west-2::control/CJEQHRVXTIWI`

SH.ES.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NKAVRYPDHGSE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HWGMENGJQCBM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WDKCZTLLFYSN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KSBFKZWAUVIG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XZBHSUUNHMBC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GLOMYATYELRZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YLIQXEVTGLUE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GSKYICEFCYUL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LSVJLTKRGRNL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LZDPODTDDLRP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RBRHWOLYAJVK` Canada (Central) `arn:aws:controltower:ca-central-1::control/FAJDNSWEYJTJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YKAKZYLDDDGR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/THCGKVUOLBGV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ULQKWBEFGLXU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GZYPQIASBBIJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RESGJWSXLLSP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TZOAAMIEGPFS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IJBRHMLEUQOW` Europe (London) `arn:aws:controltower:eu-west-2::control/RVWKSECGWWEP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IIUFDVUSUNLT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RHSAZWQNIXVW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NDRIFGJIEOHJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PJKVMNNVRXBR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CLXEBIXECLBK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RVPSMUYBMOHQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/URIOOADAOQPW` US West (N. California) `arn:aws:controltower:us-west-1::control/LLKXRNITKZJX` US West (Oregon) `arn:aws:controltower:us-west-2::control/VWKJFNZAPCDY`

SH.ES.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.7	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NWISRZLPQNZI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MXDKIFLTHBYE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WPXNVLDJXXDP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ABAXYOWHDPKC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/WJRWCRHTOLDT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PTXYSYHARCVA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZGMWIEVFUUPG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QORXBYKOQWGO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YKZLIAMKUETJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NYFPFTLMYDPC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/POTTNFBLZHUM` Canada (Central) `arn:aws:controltower:ca-central-1::control/RTHTIINVLDRG` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YJJCPYBOGYDE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GZWHLSAGPLNZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VVAXFEHLQPOJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JHNMRAPWCSXQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HOSZWKQPCCPN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WRWXSJTWHNFJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LETWZOWEVBTI` Europe (London) `arn:aws:controltower:eu-west-2::control/JAJCFTHPCQKI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EVUMEQKJCCQO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LIVMZVUIRHIZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OAAISVRRIMKQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LHCNVAARHNHA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IHTMPZLJCAOR` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BHBTVOFTLCSB` US East (Ohio) `arn:aws:controltower:us-east-2::control/KAFELHVBFCBK` US West (N. California) `arn:aws:controltower:us-west-1::control/QHEQAAHVHJSP` US West (Oregon) `arn:aws:controltower:us-west-2::control/KDDVJHAFANAS`

SH.ES.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ES.8	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BMQFOUBLJSPC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MNQHHJRYBKJN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RMOCTANNUNFN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WZWUGROTVPXC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RNGQNWDNMAWR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QVPGWCRCBGPS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JCKILQELGLRE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VWVZXXJAVDVY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CHITVXZCWFAK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VFGSGKGOJRDC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LQGYABBBDPOY` Canada (Central) `arn:aws:controltower:ca-central-1::control/EJOTPAVNDFJH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OATHLIAMTJXO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OPQGRNKSRBMF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NFDUPLVPUUZS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SIBUGFYSXGEW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LJNQWQIKHGVF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EPKXZQYGZKXO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KLGGCWMMZGVI` Europe (London) `arn:aws:controltower:eu-west-2::control/ISVOJHDBVFJJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AWDIDNMOVPQY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QUZNHKTVVRES` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SOJOOVIRDOVY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SDCEHLEJFKCA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UCYKCMEFOPSY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FZIUYKFDZJIO` US East (Ohio) `arn:aws:controltower:us-east-2::control/AUHGLFUEHAPR` US West (N. California) `arn:aws:controltower:us-west-1::control/WIHBLMWBUKEA` US West (Oregon) `arn:aws:controltower:us-west-2::control/QVHFDLZIKRZW`

SH.ElastiCache.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ElastiCache.3	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Prepare for disaster recovery	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SIPTPCJLQJPU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GUAQZTKZNWUV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UESOVOADVSMU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TUBWWAKIRKHM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ORKAWARTHBMN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YFFUVDJOSQBZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/GQNVPRTFGZEH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWAGCJQXXEBJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IRLLBPCLBFSF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JRHCEMTOLLGX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WUDZZTASZKSD` Canada (Central) `arn:aws:controltower:ca-central-1::control/KGADKRAUIFQN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SHXUYSRBPNYH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QXSNUTUUGEAZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UNGKAMDGDEVV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SAKTZSWAAVOG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YCSUIJWTEFQZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JJYPKVDVXNRN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UEJWOKFTRSVZ` Europe (London) `arn:aws:controltower:eu-west-2::control/RTYCBUHACGDJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XDXTHCXIPLZN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LJRRAVGPMGTW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ADYLWASIOSAM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZNUBYCNEXDAB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QGDFMFQRSBZT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/URINWMLAKAIO` US East (Ohio) `arn:aws:controltower:us-east-2::control/QXRLPYENZJCP` US West (N. California) `arn:aws:controltower:us-west-1::control/XQNLRVTQMJZJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/HKFIZPQYALLF`

SH.ElastiCache.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ElastiCache.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FXDAGVLSDXPI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OCTEENEKRVAZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HDKDHUAIWMQA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EVVXTCRGQFLR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LDIFNEUBEHBK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VFVPEETPEQEZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ICQHLMCVCRIO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OACBBHOVAEVA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OKARFUXXCRPD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NJXCSEBACNMH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WUZLZICYJEQY` Canada (Central) `arn:aws:controltower:ca-central-1::control/TZVUEBTZQYUN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JFYOTKQAYIGJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TULMANTMOIIU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IENWEDYXAXBZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WMUXTHVGQTVF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FZSXJQJTSXXE` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XRSMFMJJNPOJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/AXTVUKTDCTMC` Europe (London) `arn:aws:controltower:eu-west-2::control/BKPITJHEZYZJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MIWPGWTCPNRQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FFZOFKLZMDAS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VVPWGBBIZRDP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZJFWDKVHFSBC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GHMJIJSAGKRH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ELSTNMSBJRHJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/CTWGSFKXEHVP` US West (N. California) `arn:aws:controltower:us-west-1::control/XUXCOXBMUZAW` US West (Oregon) `arn:aws:controltower:us-west-2::control/BFBUHVUQAHXR`

SH.ElastiCache.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ElastiCache.5	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HJVBGATTSLPA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/STATTLAADUWA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WHATZMAFLZTS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MOZEHOPJBUAL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OXAVHUYZCPHI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IZBMLBVASGIJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NANPVYXXTJXJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LFEWHEAIGECJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YYPPUCNFWOOK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UJCRTBUEMVCX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XDPGQBKTXIJM` Canada (Central) `arn:aws:controltower:ca-central-1::control/OUPAKTMSMMUB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/XLQNEVZUJTMC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RYKMECNHFEHH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GBBFKVVGJBAY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RNEMCHYHNZIR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YNJZROMYKICL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FDRFCGOXDUWD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TUWANWNHVLHL` Europe (London) `arn:aws:controltower:eu-west-2::control/IZMXBQXWVJQR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OYJFTWZPOVLL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QWYTIDJZXNBI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FMFVLJJLOGAF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LMRIWCCPGEQZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SFOQXYOTHJAL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PWYQKXALPDRY` US East (Ohio) `arn:aws:controltower:us-east-2::control/HYCAQOLSMZCV` US West (N. California) `arn:aws:controltower:us-west-1::control/BEJQLVXCYDCE` US West (Oregon) `arn:aws:controltower:us-west-2::control/BNPHNRTPVKRQ`

SH.ElastiCache.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ElastiCache.6	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UKIDNNYCAVDR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LHDYUGFGYCVR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CCKMLVVXQNSW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ICGRRGUZPUAA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IQIOSUYNBMXZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FPEPLYGJPXMK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MAMEKLCJOYWV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AIFKQIPQMNEX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BMQHZUZDYVZZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BJQECJHQIFTN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QFUYTTFOUNKF` Canada (Central) `arn:aws:controltower:ca-central-1::control/BVJRPUSXDJNH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KCUWSZCXYVPU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZZETEGSHHBWU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IYADABKMCJQK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/JVXHGVQAGQDZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZXFHFYXZQLZP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AGWFRYCYAEGB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WSTWCKUNUHSS` Europe (London) `arn:aws:controltower:eu-west-2::control/UVCRQZYZWBXD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HAFDHAKBNSLA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LVTBKWSDNANH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LSQNRZMFRZBW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RXLXXKDMDPKR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MRZJGFEJRMAN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UMVEAKCEXKTZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/FCYIJPJOZUEC` US West (N. California) `arn:aws:controltower:us-west-1::control/KAJUCVYTWZHC` US West (Oregon) `arn:aws:controltower:us-west-2::control/BZVATKLFDCDD`

SH.ElasticBeanstalk.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ElasticBeanstalk.1	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HRCTODXELWQC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HFXXCBDEPZKE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VGWIRUAPMVUR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GXYYXMDJPQWS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QIUYRCCPMTKU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TJVUCTRUZXBI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AXWLEYCNCKEF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QTKGHOCLSKQR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IVNFFJMNHDXC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KTPYDUSKJJCT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QHCNWWHTXNCB` Canada (Central) `arn:aws:controltower:ca-central-1::control/BDAQDLACRNUJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/XTYUZLHVSMVX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XXHCDRWNECMP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CHMEORVPNYMK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AOEPTPWCMPHA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DIWONFCMLOJN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/POFVXJOELWBG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QFIFLSESZLTQ` Europe (London) `arn:aws:controltower:eu-west-2::control/HYKCKALQSVGN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PZZGZMWJZJUB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JPNESWZFMRXZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WUFPLDDPTWTR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EDYJDTLNFUTL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ULCSKLZYHVEE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HFVMYSGPEYDN` US East (Ohio) `arn:aws:controltower:us-east-2::control/VVCFXNZNIDRP` US West (N. California) `arn:aws:controltower:us-west-1::control/ZBUJLIWPXMZC` US West (Oregon) `arn:aws:controltower:us-west-2::control/CUVOLGXTISMS`

SH.ElasticBeanstalk.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.ElasticBeanstalk.2	NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LRSKXGRJUPSJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NOIYKEUVSUZD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UVWVYKZLJVVR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OLBWUHFKLXTO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MSGQQPKQDVPU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DWGNUKILACZO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VWILRUWFQDLN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UZMJMWJXYBRE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ALIABGGIBJQX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OHLJWBJTORXC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PFGDFVQAJTQE` Canada (Central) `arn:aws:controltower:ca-central-1::control/WIFJQEAWBYYY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/XQOZXRWZIKCB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WIZMLNWMCLPL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IOZSNWPPOGWK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HWWRWNRQAYGV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HQOFJHTBYWKA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RTLGDHKWZGGQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OTKEBOVKUDWD` Europe (London) `arn:aws:controltower:eu-west-2::control/LWIJCVNZKWGE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OHJMUKRRCYAI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FYFCDEEYCYRJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KRJQNHBHBEWR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ITYNJOUCUHDO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XVEUIUNHHVRS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CIYPAZNJKRRG` US East (Ohio) `arn:aws:controltower:us-east-2::control/UPAWTQLRRSZX` US West (N. California) `arn:aws:controltower:us-west-1::control/FPMFOBUJGTEV` US West (Oregon) `arn:aws:controltower:us-west-2::control/IJZKGIDVPZUE`

SH.EventBridge.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.EventBridge.3	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AVFUHZRXXOUW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LYXBUZQRSWCM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MEUNQCWBTTPW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BOCATJEKJNPZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YHVJNETPUOTD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RUXVSGIGSQEA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JDCUDNFZGYQP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VQFSGMZOXVFB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AKIQOCPERZBO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CIBFJVBECDUS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IOTEBZPDNJPB` Canada (Central) `arn:aws:controltower:ca-central-1::control/GUUWDKSVVMBO` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/CVKGSFXCNSHD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AUPPFVDVTTBR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CCINVLOQSEKY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OVFHMRIQMYLB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QRMOLACOFLJK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZEHPGQTSGWMJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JALSKERKCEHJ` Europe (London) `arn:aws:controltower:eu-west-2::control/OGHYSXXZSTRA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QVSPNJKSPQYK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KGAUPPFJAUSX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SQQCQEPSRASY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SHECRQCSRWNL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DNVQQBIRWGUO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CVKWOZJRGJWS` US East (Ohio) `arn:aws:controltower:us-east-2::control/XXEZKDTEIZLY` US West (N. California) `arn:aws:controltower:us-west-1::control/KSZTLKKOIIFH` US West (Oregon) `arn:aws:controltower:us-west-2::control/FFODCLSFQTOD`

SH.GuardDuty.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.GuardDuty.1	NIST 800-53 Rev 5 AC-2(12) NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CM-8(3) NIST 800-53 Rev 5 RA-3(4) NIST 800-53 Rev 5 SA-11(1) NIST 800-53 Rev 5 SA-11(6) NIST 800-53 Rev 5 SA-15(2) NIST 800-53 Rev 5 SA-15(8) NIST 800-53 Rev 5 SA-8(19) NIST 800-53 Rev 5 SA-8(21) NIST 800-53 Rev 5 SA-8(25) NIST 800-53 Rev 5 SC-5 NIST 800-53 Rev 5 SC-5(1) NIST 800-53 Rev 5 SC-5(3) NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(1) NIST 800-53 Rev 5 SI-4(13) NIST 800-53 Rev 5 SI-4(2) NIST 800-53 Rev 5 SI-4(22) NIST 800-53 Rev 5 SI-4(25) NIST 800-53 Rev 5 SI-4(4) NIST 800-53 Rev 5 SI-4(5) PCI DSS version 3.2.1 11.4	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JCGDSVGPRMGL` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LDWXELVIRNYK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/COLEXQFTHZZV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SXTYEZHKEGVG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GCMPCBBAOQYW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FITXSLOHMHEK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SNCISHTDRYUQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NOLGMPHOAPVF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SEPYALESYFHN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AOPCFWRQJOPT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EOBRPOTBIPCF` Canada (Central) `arn:aws:controltower:ca-central-1::control/MPEMCZUTKJSC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZEQPOFNEEZGA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HNRJJLKEIRQJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RBAGOZGFJAMH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BYUKMXPSTZGB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FYEZWBYGBMOS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/COTHIKHVBERH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KEFOAQPLEGGA` Europe (London) `arn:aws:controltower:eu-west-2::control/WPICOSEVQTYS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FCEDIMUYTORU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QOGJGFWGIULX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LJXHMOYMHZFY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UALVSOXJWOHD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZQJRRNJGOEVG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HHVKNVANXXAA` US East (Ohio) `arn:aws:controltower:us-east-2::control/LDUGVICWFOGH` US West (N. California) `arn:aws:controltower:us-west-1::control/ZHDCSURIXQPI` US West (Oregon) `arn:aws:controltower:us-west-2::control/APFIGXPGEUMB`

SH.IAM.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.1	CIS AWS Benchmark 1.4 1.16 NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/SJHQUPARMCWS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WATHPARPQNLR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WFEQVTUHENVP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MFXIIBSZNHHF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CDHPONIQLRSC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/TENOMRDYBHFD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NHIAFAGTLNCF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JUJQVSCCZAMM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LFXQGUJOZIVJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ERLQVOUMUUHX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OFNMQUIVMWFP` Canada (Central) `arn:aws:controltower:ca-central-1::control/UIZQWGPRMOAM` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BNTLCPTUQSZA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RWLDODTORAPO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UFSPWKOMEQVD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AFVWWEIUROEO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KAKVHJADITQO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PTUIEJRUTZCZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GPMRUNIPAAHZ` Europe (London) `arn:aws:controltower:eu-west-2::control/XZFJDHDJZVRN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CFROUVIMJIDN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OJPZRNXPKNEK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MGPHXKVOAECA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZJTQIKZHBJFU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RDFMPAZPDBSW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GQRKBUMEATXJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/AMOSAUZUOENC` US West (N. California) `arn:aws:controltower:us-west-1::control/PPYXQOKDTPWB` US West (Oregon) `arn:aws:controltower:us-west-2::control/BYCPKIWWCXUS`

SH.IAM.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.2	CIS AWS Benchmark 1.4 1.15 NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BBNWDAOXBXMT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DGRFSUNAERPG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ACWMIEUICSKY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YAALMGHJQDZX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EFJBOODBQMVI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RYBHHGRLQNRS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MZNMQRQUHTFF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NYVWQVOKPQZU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YKNIXGERUKGE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HDMIXFBIIWUH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FUOHDAWIOPUR` Canada (Central) `arn:aws:controltower:ca-central-1::control/BQESNVPCOBGD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SDHFDUTCQJXR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FQJSHAAJBVJZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LQIXJHNIBDMZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XFGBPVBXFMHV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DNMIIIVJIRHV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YVJMLAPDOCDS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JGYSATNSTORL` Europe (London) `arn:aws:controltower:eu-west-2::control/SJWVDQMUPEYN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZDZRSNRNROAX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FAMBHRFNSCPZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GVZUNYGBVRTG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HENQCXAXEEDW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KWGAJQBCVXTC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CKRCAIBXILFK` US East (Ohio) `arn:aws:controltower:us-east-2::control/GNUNOTQMCLNP` US West (N. California) `arn:aws:controltower:us-west-1::control/QOUCRVYJIWUO` US West (Oregon) `arn:aws:controltower:us-west-2::control/VBOICSFJPYQV`

SH.IAM.21

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.21	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FZGWEZNCKXYH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JLKWDUNSJRHX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MIGMWGINEUVS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MXPBNMAHQMHQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XBVCGUSYKPDY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WFVNBRNTREIU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZUBOIDITQGAF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WUHBFCQMVMRD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CWYTGQUDYNSL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RZKQLRKYFBEX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OINTKVOXGRGY` Canada (Central) `arn:aws:controltower:ca-central-1::control/PPLFAEVCJSZX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/IHZCRBDAJKSV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VIPDQGLETFRV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WSDYPXEIEKWF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HCJUBNEAEYCY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OBXJITNHRYHC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PFZLCBNQVYNK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PQTGHIEDIOPD` Europe (London) `arn:aws:controltower:eu-west-2::control/USZNDZRQBZJR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZICTMAGIPBNJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AHYWPTGMTWBA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZIRRCBVTCRIG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NGCYINYNJZUF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/CLKMPBZOBOMC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HQVLATIMVODA` US East (Ohio) `arn:aws:controltower:us-east-2::control/WUAKZZMFASZA` US West (N. California) `arn:aws:controltower:us-west-1::control/XTNWCGTRKAQQ` US West (Oregon) `arn:aws:controltower:us-west-2::control/FEPUEQJBEEJE`

SH.IAM.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.3	CIS AWS Benchmark 1.4 1.14 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-2(3) NIST 800-53 Rev 5 AC-3(15) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 8.2.4	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GUMJAKYNZOUS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ABGVZPGEGWCW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EGBXSELJNDTO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MCTNEBTXCMPF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VLDLQKJMQHEM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RFHKMYZYMHYO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ORGYLPOAGEQU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZQDCZNSVLWOO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZWZXSXOWDRJN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DVSXDXUCKOTF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ANYPTXWPOUTR` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZBRPUSKMGALZ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NGGHVSLLGHNI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NYWZTJUICRUT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YONQBVRCJMTF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QCUYUTVQDRTV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UDAUJAYQMCES` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CCNVIKXXGEWD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RHVPZJVBRVIC` Europe (London) `arn:aws:controltower:eu-west-2::control/WBMPXAAQFWFJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XQFZKZXQPJLG` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JBFLQKARJEYV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LKUXGWNMHUIQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EIAOZORVUQAJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TIINYBAUSDLA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZEJBJAESPURY` US East (Ohio) `arn:aws:controltower:us-east-2::control/DWHOWHNGILYZ` US West (N. California) `arn:aws:controltower:us-west-1::control/DGSPIXKNFKXW` US West (Oregon) `arn:aws:controltower:us-west-2::control/NJXSDDNVGFJT`

SH.IAM.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.4	CIS AWS Benchmark 1.4 1.4 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.1.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ONNOAXBAARDW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NGBXNMUBONAH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LCWHRMFYRDPY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KNDGXYOAJBAD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VNOKOKESMBDL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MYNFRQFMIDRC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VHUIPKTSFMRM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KRKFAUZIAZCH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CVTOQOHCXJYE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NZJHCYOIWUZE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JLCIICHHZQCR` Canada (Central) `arn:aws:controltower:ca-central-1::control/LFHALIRSAOMG` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EJNYMZGSREUA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FVFAHHXHVEDZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LFNXIKBHCFFH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WMMEOLOBHWLP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EESHRQXCBBCW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IDXRXRZOKJDY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NEALLBIMAHJU` Europe (London) `arn:aws:controltower:eu-west-2::control/PQZZNTWBVDMA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JQIXBFLCEXKN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FMXNBQSXQBWO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CLAWIMQLAMRV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XMJCOMYEEHFK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DYTPSGEFQHGZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MLZMKASTNAMJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/BWMCZWYOPOFV` US West (N. California) `arn:aws:controltower:us-west-1::control/KRXFGDZBTYIR` US West (Oregon) `arn:aws:controltower:us-west-2::control/XMQHVQUWVANU`

SH.IAM.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.5	CIS AWS Benchmark 1.4 1.10 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 IA-2(1) NIST 800-53 Rev 5 IA-2(2) NIST 800-53 Rev 5 IA-2(6) NIST 800-53 Rev 5 IA-2(8) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 8.3.1 PCI DSS version 3.2.1 8.3.2 PCI DSS version 3.2.1 8.6	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HYIRNIGRBSGP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NFWYYESGYVLD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GCNKIMWWZRKL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ECYNNUZFPWMI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CZUEAKVHIQNO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MAJHPOEPBKQN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JCAXHHVCEXHO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CCOLABWRKEYN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PLGJLSNGGCIG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PFLWBFIQLKNQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WIAMMQBAAQJJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/NOOUAVOVBUEY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WCRAIYLWBTCB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JZQVFKSOFWSA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BSLSEMWQWPDU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HXUNMLYFTBJC` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZWYNNDLJZJCU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZCWGPLLPWHNE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WUGDSPITURNA` Europe (London) `arn:aws:controltower:eu-west-2::control/YWKENJUJLZUI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WXQUFEUZXQLB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EOHPSJZVHDAH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GHNNXJDYCRMZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NMCTCNELSULQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RKTXSSCRCOSG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JZAYNLETVJSZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/FCWYWFZYCEFJ` US West (N. California) `arn:aws:controltower:us-west-1::control/CWPEYHMAQLIX` US West (Oregon) `arn:aws:controltower:us-west-2::control/FJMFSLSUYOTC`

SH.IAM.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.6	CIS AWS Benchmark 1.4 1.6 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 IA-2(1) NIST 800-53 Rev 5 IA-2(2) NIST 800-53 Rev 5 IA-2(6) NIST 800-53 Rev 5 IA-2(8) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 8.3.1 PCI DSS version 3.2.1 8.3.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KQOOHLEPXQUI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WUJRGFWJBVMX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FFFZNTDNXQVY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/BOIRCXQEYNLQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GJVLNVGKXKPU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HIVWUODPEDII` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CPSFIRHUZZIQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PUNPGEQKLGNW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/DJMVZWKQLOWP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PGOBDPTBEYHR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XQIFMIFDFLMS` Canada (Central) `arn:aws:controltower:ca-central-1::control/RBIDFUAIDOZW` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BRUQBWYQCDTI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NKLMWNZYKALI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/URZCBQFEOADH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RIYGDTPNPQHD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NVJXVJYUVYIK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BCKCUYAPDUNX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FSWHMTMWCPCU` Europe (London) `arn:aws:controltower:eu-west-2::control/EQQYPBMTXUZP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WTTOHMYBKCFD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/IHMDJKLAWQSE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MAIUKCQFTGXU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CSOWVQIYIAQK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZDWYGZQRVGUZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YXQAYRGZITSE` US East (Ohio) `arn:aws:controltower:us-east-2::control/VMFIYFNTTOHK` US West (N. California) `arn:aws:controltower:us-west-1::control/XPMKIIBTFCPX` US West (Oregon) `arn:aws:controltower:us-west-2::control/MEFQIQZLFYAO`

SH.IAM.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.7	CIS AWS Benchmark 1.4 1.8 CIS AWS Benchmark 1.4 1.9 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-2(3) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 IA-5(1) PCI DSS version 3.2.1 8.2.3 PCI DSS version 3.2.1 8.2.4 PCI DSS version 3.2.1 8.2.5	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KMXJYYOPKOQX` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WASKPVFDLIYU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FRIQSUKOEAVU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KGKMVFEKJMLZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EHEDTYHDSTKT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XADXTOPDEFZN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EPZGMQYMYCKC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GLWFPUPESYOC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XLUHJBTPSEGR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XVUSKLHPBBTW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/YNLEDRZFZHQH` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZUYARIGWZBSL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OQXXUGRLOSND` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IQPAHZJVRRMC` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RQSJZNLKMTGL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LIUJKZCJEXBK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WLFXSCNCYPKF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ANGAKCMMPQPM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ASYFZUOMHFUQ` Europe (London) `arn:aws:controltower:eu-west-2::control/AKBREXBVUKLY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IEVZFDCMJQBO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MLFMZUIIUXOV` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QINXYALGQCYH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GZRPWBEVWIJO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WJKCHOEITNXY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YJDQWPMKBQWV` US East (Ohio) `arn:aws:controltower:us-east-2::control/QJKCDNAHSGNU` US West (N. California) `arn:aws:controltower:us-west-1::control/GJMEDGOCQHMC` US West (Oregon) `arn:aws:controltower:us-west-2::control/VBKLNMEHVTZB`

SH.IAM.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.IAM.8	CIS AWS Benchmark 1.4 1.12 NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-2(3) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 8.1.4	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EJCVJZJZFQBM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IVONORFCYUSG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AYWUKJZBDYQW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LLXPAYEHWBTA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XBSVEXONGNEW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FKPJQKAODREW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/REWZGVLUZGNR` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ALXCCRNIHSHQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HEXKEUELTWUJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BVWVOOCPEIHY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZRBGDAMADYWX` Canada (Central) `arn:aws:controltower:ca-central-1::control/SDKZNRQZVJYU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LWLQJPKISEPA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XZDDELXKYDNY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AHXFLMPRCUOP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ABCVAFYFOUZL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GCWXNKTVTJES` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZHIPMLGXKTII` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OTDQBWDVYVJE` Europe (London) `arn:aws:controltower:eu-west-2::control/UNYQJZPHYTYB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OPPELJVTHMAQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MKIQOKZAPVND` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YQALXGIKRVFF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GYTHSSUDEYVA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VRSVTEXAEZZH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DYZBFPIWFDCI` US East (Ohio) `arn:aws:controltower:us-east-2::control/JQZWJZWMTQCI` US West (N. California) `arn:aws:controltower:us-west-1::control/XVHDUOVHZBUS` US West (Oregon) `arn:aws:controltower:us-west-2::control/VUQQVIQVRPBS`

SH.KMS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.KMS.1	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 3.5.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RFBLHWMVJTFN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GZSTLTFISUDT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BYXFJJHFUZOU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HEQYHQMETWVE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MCUWTMLUTJTD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IGBZSWRYBKOJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OEFSDGSRYVWF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IWKWHAGMHFQU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YBJERSBVCEHS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/STCLOEMIOHEK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/BYUVFYCCJJHH` Canada (Central) `arn:aws:controltower:ca-central-1::control/VZYJNYATGYQB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/IFWWBTJOJAQV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QGQGZMRWIRVZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YXQNFHQPBJAZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QKTHXYQPLNYY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YAGTWUPGFPPF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YXXBZRYGGQHA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YIKIWDHYLGBP` Europe (London) `arn:aws:controltower:eu-west-2::control/ZHHPIYVVGYPR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GTNCXJXJAMYN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RKSWLPRFIXCQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IXFYFSFYWVSG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TFBIFZHWQZVK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IIMAAOEMTFUC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZYVSVOFNLTNG` US East (Ohio) `arn:aws:controltower:us-east-2::control/NUJRZCEGSRSQ` US West (N. California) `arn:aws:controltower:us-west-1::control/BWCBIXNWVGXU` US West (Oregon) `arn:aws:controltower:us-west-2::control/OONPBHUUNDTP`

SH.KMS.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.KMS.2	NIST 800-53 Rev 5 AC-2 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(3) PCI DSS version 3.2.1 3.5.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RVWELBFHFMZC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZNENLKTJAJED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BRCRZNYQLWRK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CUVJHPIMJUHF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MRXFACTRKJXK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JBHOZLAJZRHT` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CMFKOXCJHMRO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KSMDOJXHBPMW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/NHKYZBGUEQPJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QGLAZTMDPKCR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FZBYDXKSLCXX` Canada (Central) `arn:aws:controltower:ca-central-1::control/IXRRCZUELMDU` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZAAPLIRUESNN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YGKEXZMFRPPN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TOKMJLDBUDKZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WTDVCVDHOVVI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XNYUAERHNATC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KVZTPSEVBXOM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KPKAHTFYDJQQ` Europe (London) `arn:aws:controltower:eu-west-2::control/PKKCOIZMWYXC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UOEWOHQTFMZC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EBAZZEBBRISJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WMOSJEYVXZGN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MWRLXDZGCIOG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IITOVJDNGAND` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QNVYEARPCKHY` US East (Ohio) `arn:aws:controltower:us-east-2::control/LTNDXSCGBACC` US West (N. California) `arn:aws:controltower:us-west-1::control/HAYAUPLTJHPL` US West (Oregon) `arn:aws:controltower:us-west-2::control/KOWUMYGVIEUY`

SH.KMS.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.KMS.3	NIST 800-53 Rev 5 SC-12 NIST 800-53 Rev 5 SC-12(2) PCI DSS version 3.2.1 3.6.5 PCI DSS version 3.2.1 3.6.7	Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XUCOHZEXNIAF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KAQGLJVRWWEO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SMQGPFWVOPUB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IRPUDLZBQQWO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QQHHWGHUWJJC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/APZNZRNDYXHH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SAHJWNCMTYAX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TUHCPYQGZEHJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BDIQMPNVEKNT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NUKLTOZLTRAX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RNMUNGOSHVXK` Canada (Central) `arn:aws:controltower:ca-central-1::control/QRKASNXFSCTZ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/XMBXLITLQFMD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TRHPTRLDZSJY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GKPVMRDXGVOQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UESQJJTMCLKN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EFXYPQPZXWIY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ORUXQHOLQKJL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VLQZELIVKMED` Europe (London) `arn:aws:controltower:eu-west-2::control/MVMZXTDTZZOF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HSHOQZGIQHCR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZYDEXLPEPMSN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MDPBLQMMJEYP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MZVPJOKIMPWX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XIVTDDCWRGYG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CKCEVZPVWRJV` US East (Ohio) `arn:aws:controltower:us-east-2::control/HKNGPDPGWTEN` US West (N. California) `arn:aws:controltower:us-west-1::control/WVDONOWFFERT` US West (Oregon) `arn:aws:controltower:us-west-2::control/JNOLPJAAZDRU`

SH.KMS.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.KMS.4	CIS AWS Benchmark 1.4 3.8 NIST 800-53 Rev 5 SC-12 NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-28(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 3.6.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YTVYVWITCFUI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UIXBQCXGFNKF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GACATEGITTZC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YSEVCOKRFQTC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HMBCPOWZQTEX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SIAZYKIXAWVM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TXEYAYCQTOET` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XJHAYWLPKCMW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XMHSZGFVUCKV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XRIEYHFKCMJA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GYSFEBTFMRMP` Canada (Central) `arn:aws:controltower:ca-central-1::control/CGOLOMNECFEN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/GRZXSVFTXTZT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/THPIDDSSFYIT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DZFTQFAMHQSJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EZTPQMVHTQTO` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NEMTRUMJHVFV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UAJMZMHPGMJK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PFKREHBJDPLH` Europe (London) `arn:aws:controltower:eu-west-2::control/PFYJKVBDZVPK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BJNOWWJOCTHA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DBAOGBFLWRFZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SDLTEFXNUIOQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VIYPLSVMEESU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TFYPSKCNCXOX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KCRHFJYLWGRJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/NSBUGYBQMNCC` US West (N. California) `arn:aws:controltower:us-west-1::control/KWKAWRIJNZHS` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZISYMNHRKXUX`

SH.Kinesis.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Kinesis.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FUHEULCOXRCO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QYMQRDJFZIZM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VHBDITDWYRPV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WTQVFWIGVFQL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XUUETQLLWFPI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YPEWSZCWJIUR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QKAEDZNRTWVN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YTWGDULHCPTP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LJRFKNWNZTFU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CUQOJATNKEFD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WOJIPKZFKHQN` Canada (Central) `arn:aws:controltower:ca-central-1::control/XWJFEUSBZYWC` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/IIMLDHCDXTBE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OZCCICXZVLAG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SZWCQYAXJEBU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PREPRJHMCLIQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AAEYGZDGTKFG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ROGMIDNQFYJA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OXTKOQQPJYIB` Europe (London) `arn:aws:controltower:eu-west-2::control/DKOUDYFDPEJG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AHSFQWOFMNRN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XBNTGCFWJQKN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SBXKHTMBPEDV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YTFUOVJAIMGJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QBJVWZOQCTXK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LKIISYYCVINO` US East (Ohio) `arn:aws:controltower:us-east-2::control/LFMGOMWMIZYW` US West (N. California) `arn:aws:controltower:us-west-1::control/CZCPIUJBEXHI` US West (Oregon) `arn:aws:controltower:us-west-2::control/MGBKMMLYFDEG`

SH.Lambda.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Lambda.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UEKXGNSVRGRU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QGYYCHAEYCOK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OYRNNPFIKAPV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/FQMQXEDYMYNK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RHATZQJEWAQS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WLOTGENGLMYP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UTAKIVJNPQKQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VTLSMHLQZNAJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UQXXELUQDDBO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VTYEDXNYTCOU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JLYYWTJFZWYU` Canada (Central) `arn:aws:controltower:ca-central-1::control/BOWRFNRKVWJH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/AZZIBXEZNBLU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WXFRGPFWBNLR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BOFZCOBNZVVI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EEWUILLNDCOW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZVADYVLUVCCG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SSBTBADOWTQP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JADBMJXDJEUI` Europe (London) `arn:aws:controltower:eu-west-2::control/TYKOSEICGFCJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BGDFNHLTPMUE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/PQMCVFMSALWN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LKIGPQZSIHYY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WYXEZTRSMXEP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IHXAQZRZTQAV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SRLPVJHNHYTD` US East (Ohio) `arn:aws:controltower:us-east-2::control/ORSOXPSFFMIB` US West (N. California) `arn:aws:controltower:us-west-1::control/YKGFFWTMFNXR` US West (Oregon) `arn:aws:controltower:us-west-2::control/BNIHRCLLGNHH`

SH.Lambda.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Lambda.2	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 2.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZNIZSPSJFDIZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TQDFQOHZHESH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HVGTUUNEPBRE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QPNEMKAWAOIV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UUIDKEQEDKLS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BHBSEUQUFGWL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZFZGYYSNGKUD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NPXHIQYCWKOR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TOCWOWCANSFU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EMPVDSJEEFCR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KUZWESEZOPZP` Canada (Central) `arn:aws:controltower:ca-central-1::control/FCQWRAUMZQGM` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZJVLSWMYGQAK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WLFOUDCRAIPB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/UULQOEUOGUIU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SNXJDQUCDOAM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UKLEWEUIXUXF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EWJVNNABTCNV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PIGMDBBNREIU` Europe (London) `arn:aws:controltower:eu-west-2::control/ETXINVUEIROP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MNLNHLMNFTWZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QUYOAZGIZEYE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UOOEWDHHSDLP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JBWMSWLKQORH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YKPNTLKCMMXE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IOGKXEBDRDUW` US East (Ohio) `arn:aws:controltower:us-east-2::control/MUKLGCDYGHQH` US West (N. California) `arn:aws:controltower:us-west-1::control/ZLUQNBGOPGBC` US West (Oregon) `arn:aws:controltower:us-west-2::control/KIONODJWVSXV`

SH.Lambda.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Lambda.3	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EZXFMSCVSFND` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MGNWLCTXLPSK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CELGBNIGQSFA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MGIYSFEIQJYE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VXWDXDIHPIAA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EUDGMAMQFGDU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NBGOFSTXHPHY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BJGEEEFFTPQV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EUFJHWDURPMH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AQMKVOVMAULY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RIIKHXKHXQEL` Canada (Central) `arn:aws:controltower:ca-central-1::control/WQKOVTMBTFSI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/QREFOUCIOENJ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IWVKFZSXRHHS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WFNFAOLGHLSA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YMEOWGILVDCE` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ANDEJZURRWYW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JZWLVKNTQKMY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ILRWQBZXYBBL` Europe (London) `arn:aws:controltower:eu-west-2::control/VTJHBPAMJPSP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WNZVTLIZNQMH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VYNFEVGJGTCE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XIVLQYLWDBSH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WEJCSVOUEOAM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RHFDHZUNYHNI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PEKUMESILPFW` US East (Ohio) `arn:aws:controltower:us-east-2::control/XCWRDKSXIABC` US West (N. California) `arn:aws:controltower:us-west-1::control/NJAAZCVHWYUP` US West (Oregon) `arn:aws:controltower:us-west-2::control/UUIZSSUBLVZZ`

SH.Lambda.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Lambda.5	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/QKJEFAKKVKJF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ALATAQKJFIUK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EAYLGRQVQPQZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KSCPKEAMJICJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/URSPINKLPQKQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PYKSDWCTUPJJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RKMONBSAJVER` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BNVVXZALMUPF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WTXQRFALXGYL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HRVRMXIYSSCL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LBYJFRQLEBXN` Canada (Central) `arn:aws:controltower:ca-central-1::control/XFYQBLRUDYNB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WDXYLZKPUNLW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NAQQDSSDPLIK` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RAZDFXAMILZM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IICOIHCGFGGP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OKADZOPDPAKU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IXRJSJMMSZII` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FBQFGSETXZRC` Europe (London) `arn:aws:controltower:eu-west-2::control/OVFVGQGZLEZR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CJBTYDOANLPH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZOXFLHHBPJZU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QODRXEJVEIMF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GVOUTACOQAGT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AUWVLGTJACCW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/MHEKRUMWQLBJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/LWOJRFFJEDHR` US West (N. California) `arn:aws:controltower:us-west-1::control/JSXPJEPESCWV` US West (Oregon) `arn:aws:controltower:us-west-2::control/QTBXGAAGFVRJ`

SH.MQ.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.MQ.5	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XVUEXGJABAQW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TUEAEQCCIAXZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VOWVNNHPZEWO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HVKNXPZTQPPN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BIHWNRENLKQI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GHRHLPKDQNUD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZDHKTELWDPFB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RVHWTOZMZZUC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BXDSOSNWHWBB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PDRFQSVOOVTC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XFBMFIDMBHNU` Canada (Central) `arn:aws:controltower:ca-central-1::control/ANJDRBFUQKHR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TXQBHAIUITTD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KGCBNMWIURNX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XXGGQSGTNGWO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CWMCQNYSVMCK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BYNEBSEDNCCL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NNBHBPPRRGPA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JJVAOTYWEWKV` Europe (London) `arn:aws:controltower:eu-west-2::control/MWCMTRXTJIVB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IGHALIQSHBFL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BVPDDVMVRSCZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NXDTQXRPKTMU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/RFZALQWRGREM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BJPEFAAXQVXQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IOJURKAHDJMK` US East (Ohio) `arn:aws:controltower:us-east-2::control/NRCJELYAOPRR` US West (N. California) `arn:aws:controltower:us-west-1::control/GTDMYCGJOUBA` US West (Oregon) `arn:aws:controltower:us-west-2::control/NMKTHYJZCOIT`

SH.MQ.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.MQ.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TYURIRAMMRNF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SHQGVAJQUTWC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DTPEGZXDCDAF` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PHYTUYFNLZVS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RLOCJSUGNSFC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ATXQBWMKKEUE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LEEGFQSSOAVQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EDUJATALIZZV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BXVOZYIINNMW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HJMOGBBVJADD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZLQKCTBYTMQM` Canada (Central) `arn:aws:controltower:ca-central-1::control/WHBLMHZIKBCR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BCFNPXFKBQPD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PILNOLMETQBJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VIJMQGMSVVAO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FLTTTDXFEOZG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HJMJNAMYYZQI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VQPNCSKOBWIJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LVPBTGSSLQOL` Europe (London) `arn:aws:controltower:eu-west-2::control/CDUYEYRCARPN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VCJWHYALYQMC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EMAZRANSAVUH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FLZZUJIWPJWU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HFGDHOBOBUCE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HDKUIDUXEZBT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/JDWPBMAQOJIU` US East (Ohio) `arn:aws:controltower:us-east-2::control/QUICIQKYMPLV` US West (N. California) `arn:aws:controltower:us-west-1::control/WGTNZMKTGNLH` US West (Oregon) `arn:aws:controltower:us-west-2::control/WPETNRUNQIYJ`

SH.MSK.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.MSK.1	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KWDYHCPKHBRH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WSHEELURXWQO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/APPECGHSBOJA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EIPLVFPXPLAW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IMKXTSNPMZOI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JVUELRTAEORI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NMLQDYBMXUXO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NNUGSISVJIGP` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/AKMDCPLQCITK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FJPEDLVYCIRX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GYOBBPJVFKFP` Canada (Central) `arn:aws:controltower:ca-central-1::control/CDBVKPRQKJYK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OXLRVPWHDBOX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XNGBVCCEGVLW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SJYHMDROZRCV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VNXUVZMZSZNK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GJGYENPVYZKG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RPTWTFGHMVNP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TWJDIQOIAYHG` Europe (London) `arn:aws:controltower:eu-west-2::control/ZQWGLUDTFVAS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TPJQEMSHIIOD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AYPXBQOVRKYU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ECRZIUZZAAXI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TMOZDTUVJCPV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/REJGVXRIBJFD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZCBBRHHIQTGB` US East (Ohio) `arn:aws:controltower:us-east-2::control/AIEOAKHYQUJQ` US West (N. California) `arn:aws:controltower:us-west-1::control/KSDTBSQNPNJT` US West (Oregon) `arn:aws:controltower:us-west-2::control/RIUQKWDXOUKP`

SH.Neptune.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YUVYWQOXYGEN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YLQYBOMQLLXM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LJMZKYYZPTBK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HKGQLNXOUMFP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GHEXSXLAEZKN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YDRDBHSTEGFF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZBXQRLDRLPTH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QYYYRRLWTOMG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YIRYWJNNTLLE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UUKPRCORXVNP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MMOCUDRHNNPT` Canada (Central) `arn:aws:controltower:ca-central-1::control/PWBVWSWBTQAD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MUCGKSCASOSW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OTZEVSPPCPAV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VQNVJACNTFQX` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YGCCJHPDGFIA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JENANLFAKZGY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CGQFCORDUKUI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GDXCMPUTLMSY` Europe (London) `arn:aws:controltower:eu-west-2::control/NWDVPEPKHXXD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/FMPKPQKUTUJS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QFOISFQEWOUH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FBHAOGNIYYOW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZOHBYOGYIDLY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SPUKKNHZROPV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ERKIRHGBAAOK` US East (Ohio) `arn:aws:controltower:us-east-2::control/PRPAALVXURGL` US West (N. California) `arn:aws:controltower:us-west-1::control/IXGQFTYIITQP` US West (Oregon) `arn:aws:controltower:us-west-2::control/JWHKRTXTDDMQ`

SH.Neptune.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.2	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(1) NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 AU-6(5) NIST 800-53 Rev 5 AU-7(1) NIST 800-53 Rev 5 AU-9(7) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-20 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-4(5) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FECOCXRBSTWT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XGGGXAPXFTJO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SKHXOXXAWZZH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HQGZCYUDHVRM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JOFGAKMPDBTZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZPZGKOGHBUPR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZMWXXTAMBMKN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GUOLSHIXWFMQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FUPOVEEUOSWA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OUTDDXPUSPBN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RKBZMFTHUIAU` Canada (Central) `arn:aws:controltower:ca-central-1::control/NUNSEOUQVSHL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HLBYVPQZFJLY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZDQKOVBBQWRP` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BRPKTGMLVSPK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UMZNLNFRFXWU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UVZNNUHHOYJP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LFEMAGNETCBU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NEEDBPTKGKNC` Europe (London) `arn:aws:controltower:eu-west-2::control/COQXZKYKBNXQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IVQMALLVRGXW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YOZYNHRHYWXE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XPMDXCUBNZBZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NXIEGOQFPGKH` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PJBDTIYTNLGL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NZSQQKEQDXLV` US East (Ohio) `arn:aws:controltower:us-east-2::control/QHVCYPZDPBEK` US West (N. California) `arn:aws:controltower:us-west-1::control/BUNWDCJNVGGI` US West (Oregon) `arn:aws:controltower:us-west-2::control/JWQLYMAHKVLO`

SH.Neptune.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.3	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JHDQSIOJZVUF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EEFBMNMCOWQC` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FTUDBPPTFLVO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AGQDWLBSVZHW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RTVVDUOOJYOU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MWNOLNFGIQDK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UPMLPTQLKBDL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QTLTUBCUAGTR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GPRIYFLJKTBB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IUTWBEDMHVOR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/LODIEBOYOAFJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UPGOTKZMWQPV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EAUUECEDDLIN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZKDTBATDAALE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WCIKPNRXONCP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EREEUEZTQQVI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DRAGECOKGOAQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JSACSQXQKYDG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GPMZXXKOJOEE` Europe (London) `arn:aws:controltower:eu-west-2::control/YXJIWSXJEKIM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AZVYVLXSEMIH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/TWZMHJYQYMAQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JQXWQVQDEGHO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OWPZMFIRCYRL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/JNYGVGSVCVBI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SBCVFDUYGKYV` US East (Ohio) `arn:aws:controltower:us-east-2::control/KJDLRYEAIYSB` US West (N. California) `arn:aws:controltower:us-west-1::control/XLFTYXPVMTGB` US West (Oregon) `arn:aws:controltower:us-west-2::control/QXWJVOYQNEKQ`

SH.Neptune.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) PCI DSS version 3.2.1 2.2	Improve availability Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IFEGWQDSIKPQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FIPPIOYFAFLU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DWOABBMIWODR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GYPMVKORWSCM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HSNLXLHCBJVZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WYUUHCKLJMJN` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PGFTHWQALJRU` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ODXEWSFKGMDG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TUXNKQCYFAHX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HEJCCNNEJNXY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VBYGYZACVYON` Canada (Central) `arn:aws:controltower:ca-central-1::control/OVWJICMFBDRQ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KBRFDCEMCMME` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KQNOJHSPSWZH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KYAOWCGCMIJP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ADORVDROWVPA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KENJMHUAZXML` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YSDTJFKLXDVQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DMWNICKIQVGC` Europe (London) `arn:aws:controltower:eu-west-2::control/RINTJPAJKWWU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AKZDXQMJAOMP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JZPAXGFWCNFM` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NFMITGFPYCDF` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JVCJEKDAXRRJ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OAKVBKHIMKTC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KYVCQZLJTYAV` US East (Ohio) `arn:aws:controltower:us-east-2::control/ILBNGYEWNVEW` US West (N. California) `arn:aws:controltower:us-west-1::control/RBCJUCVKLOSB` US West (Oregon) `arn:aws:controltower:us-west-2::control/RBAJHJOAQMVK`

SH.Neptune.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.5	NIST 800-53 Rev 5 SI-12 PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MGUTYHCPTZYM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PBNWAEEUFUFF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OHKXCRIQIZFT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VZANDNGXQTNF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UBCUCEBVYHQU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DFLUIGICKNQB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UOTXFCKSIXWO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AHWGAETJPNSM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IEOEHVHFUPUO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GKNHZQLFFRFV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IHVGCQPSAUPT` Canada (Central) `arn:aws:controltower:ca-central-1::control/DHYIFIEGKCHK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PYYXTFDJDDYV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ETKRDEYMOPRO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NNOZLXEZXISA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/PFZNFCAUVFCW` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SXZIYGDJEXEN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FRAKOVEWXKNY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KPAXHNZWNSWE` Europe (London) `arn:aws:controltower:eu-west-2::control/DCOYCPDNYJUE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IPXRSRRYYRJC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZOAFWMFKKQBD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/BVQAPPSVVMTU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XARRAZWCBHZQ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/FFMGXYSRLTRM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/ZYAJHMJFHKWJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/CKIKYVTTLNFL` US West (N. California) `arn:aws:controltower:us-west-1::control/PCCBHGBJUDJZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/LCVPESGNCLWT`

SH.Neptune.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.6	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HVCYZIJFMXQD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SJGTHCQYJPSS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZIAVHWESTETC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DWWVOIHDHQNZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RMFQTRALNAGP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RGTMIUHBCJER` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LGWNTWLEWCCX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/KYGVJYXTEIYZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KMNEEERHOZWO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PVYFTOGSZCNE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WURSDLCPCBER` Canada (Central) `arn:aws:controltower:ca-central-1::control/VRMZTNTYOFHJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JIRNXWZAMBRS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ROVIKNQOEUEA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RYZKHKXAYWDF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CQHZFMPTVOVN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DUGMAAUPOHIN` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DECFBWMMQJUN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FSEXTXDBFHGZ` Europe (London) `arn:aws:controltower:eu-west-2::control/MZGGVMWREOLW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MDUGRJDVHOAN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GDJHKYWDAFTN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IGVBMIOSBCHN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TAFEPNUNHWML` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MIDTNRJVELZH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FUHJOTQRVJKS` US East (Ohio) `arn:aws:controltower:us-east-2::control/OWJHHGLSKKCZ` US West (N. California) `arn:aws:controltower:us-west-1::control/AIGZVIHZIKTP` US West (Oregon) `arn:aws:controltower:us-west-2::control/WGJJYXWWBSKA`

SH.Neptune.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.7	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 8.7	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AXOKSXNLWXOM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LXMVRYAWIFSN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SMQUYAKAPIBQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/USIGWXBKCXXC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/CLVUUGJHPGSZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZREIJBCXRJCO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SQTZUIFAJOSV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HTMETSUNKKNC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ELPFKNRXKOFT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KNFZWIVRWLRD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SAWAEHLECVJO` Canada (Central) `arn:aws:controltower:ca-central-1::control/IXZCJBXMBCGV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/PNFLRAAUHSGN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZWWWOWACAAKX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WCDVAVCZRVIM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WJIXMOGGTBSR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JKNOXSAZPSVJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/IFVIYYTAAAOD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JUDPXQZMWMHP` Europe (London) `arn:aws:controltower:eu-west-2::control/ZSKMJGSZRJOL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YYRZENLBFMKW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JMVBIEDPIKCI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EITSELUAMAAW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EUCSDBRJGCRU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/POBIUAEMUMJJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QUQXKRSLQMMU` US East (Ohio) `arn:aws:controltower:us-east-2::control/CWAKJSEKLKFQ` US West (N. California) `arn:aws:controltower:us-west-1::control/RZVQJWSEMVOJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/WKEGTXZTMJQQ`

SH.Neptune.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Neptune.8	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HEKMQTKBYXLJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WEOIGYCOGKPF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FFYZCCNNCFOI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WHZKUALDWLXH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YSSJISDHBYVX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/IQNCAGYRQMAC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LQEQHTWYTJDA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/POJMDJSLIUJF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FLKRVTMMLUMN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FGMBOTUPQGBC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JKQPSVMSXRTI` Canada (Central) `arn:aws:controltower:ca-central-1::control/MNSOQMMBYSSN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KOTUUTOFVIXT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PNMLKBCTHPLN` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NITTJUBTOMKL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BEUAZKYAMIKM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PFYGRXGODFYY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DUQQHJPVKBAM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IPODQTVQNOEC` Europe (London) `arn:aws:controltower:eu-west-2::control/KYNITBYARJGK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YLGUUUJTSQLD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RMZOAWRCANPH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GULCMEIWRCFS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BGSLYPRCMQER` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UGAKIQSFNZMU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VVPIJUDOURCA` US East (Ohio) `arn:aws:controltower:us-east-2::control/RFZSTHMECLZN` US West (N. California) `arn:aws:controltower:us-west-1::control/IOZSELCXPRJP` US West (Oregon) `arn:aws:controltower:us-west-2::control/HZVBZDZLPYJP`

SH.NetworkFirewall.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.NetworkFirewall.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 11.4	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JENJAWUYEGRV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YAHOURUTJXND` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ECCRBKUVPRPY` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SIHZYNYKWUBD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/COFWINSONIVB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KXECUOXEPWAE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZGPLRRUVMGNX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JVTCWOYSPTGH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TIPAEJGHISPE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MJDMXHDHSWRY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JRFYOTWVVOQP` Canada (Central) `arn:aws:controltower:ca-central-1::control/OVLTEUUOAYRM` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VAKMSWGEGIEP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TFSSQYTBVRTD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HIPTNVONFYBM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OWFEMSEFETJT` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CFZSNFACGJKB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HTGHTGSSAJSI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JTCGWNUCWXGP` Europe (London) `arn:aws:controltower:eu-west-2::control/SJFAUIKIWZPF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PRDCUMRODGQB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RBZGEHJMJZUU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OSLNWGOKVLAZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NHZXBKNITZGX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NBAGBDCLBADT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DAEZMRPYHWWW` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZQAOKRZIJCXK` US West (N. California) `arn:aws:controltower:us-west-1::control/VQSIZTLFDMPV` US West (Oregon) `arn:aws:controltower:us-west-2::control/MNFWKRSSELQI`

SH.NetworkFirewall.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.NetworkFirewall.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CZVFFNNSDLEQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UAPVSQAKUVYQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LZJFDKEAPALS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YXCJHLEGWVHW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ADHDCQHCPEPM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HAHSWPLBYDBY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JMWEPFJUSQNA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/CERIDGZLWHOZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EVSNHFCDZNEP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YPGBWLIQDFYB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DUNPNDWZDMYZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/NDXZOSZBZAZP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LDWVPJTNUMYO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CKQTVOBLJVXU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RJJHGAMBLWGZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VFYTJNCARANB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BBHUBHBBGVZR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LHDPSSMNEHHB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IDRAWMSHQVAB` Europe (London) `arn:aws:controltower:eu-west-2::control/SBJTKQLKUMRB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NYONNGGEHZHP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DMOKRKASXNKX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QLOIHKJBFNVP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PSXHFUYQUQCD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZTXGNKAKQSMA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HGOJKKYHHZHX` US East (Ohio) `arn:aws:controltower:us-east-2::control/NTLDJCLFBWUL` US West (N. California) `arn:aws:controltower:us-west-1::control/DAOBSZNWEUPW` US West (Oregon) `arn:aws:controltower:us-west-2::control/CWNUOQODLOSL`

SH.NetworkFirewall.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.NetworkFirewall.5	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UEKTVRYPWNMD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OTLVXTNMYGXK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ERGWLQRSNYOZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/RCAFDPAGIMPZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UITZKUTHJKXK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OWXSVHKINPIX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YJRTMROZMXKX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XGOFVGCGBCZM` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/VZMVHIMBIXOW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HNJZTIBJSFAF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QWRIWYUWYAPI` Canada (Central) `arn:aws:controltower:ca-central-1::control/UYDVGEXROLLF` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EKPQGCTPMXDD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EAJHPCQELMZV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AOSOUBDLKQJG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GJZCYPSNOAFF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LBRWRVLMUYRM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZMJPHWUWBDPB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WWSRLJHIIWPV` Europe (London) `arn:aws:controltower:eu-west-2::control/ZENWXCHUOHMG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BVMXMMWXNCKR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DJJTKNLHNFDK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AIQUOFLWHWVR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UVXRNPHGYSAW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IPOXUDFDGKOD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BATNHYBOOGVK` US East (Ohio) `arn:aws:controltower:us-east-2::control/CECJUCSKGADN` US West (N. California) `arn:aws:controltower:us-west-1::control/DEXQDIFLMJXV` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWRAGIQYHJDZ`

SH.NetworkFirewall.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.NetworkFirewall.6	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NBUAKLSKYTZK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JWGLNRCBAKTN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LDGXFYHAKIXE` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MUVXUXJSLZGB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LKVLGZYDOJZJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AYDXHNXYPDCX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/XYCCWYXCUANN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GWDDTZUMKSHU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MMCBTWVVBBFM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/AUNPNJBRBKEA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/IATDYWKRJAMQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/MKMOEILVVSHM` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VKBNSDZPQSXE` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BOWRAGMFVVRG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZKOHNRVHWRDM` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LSBUVHESMXCJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QKPGWTQGAYOM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ERJQXHVOIHLL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZUUHBYQIZGWS` Europe (London) `arn:aws:controltower:eu-west-2::control/PDJFTMZONXVB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NDCLXMQMSORR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/VQNCJSIOYIOZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DZCOBQIISXZM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NKZDMMPTEBRA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BGLWKRBFNVTN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KMTLZUHSLMDH` US East (Ohio) `arn:aws:controltower:us-east-2::control/VITJPDKJTMBU` US West (N. California) `arn:aws:controltower:us-west-1::control/EROQWWAXAUCZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/SCVMOZZWOZTV`

SH.Opensearch.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CLQWCKKWYPUR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RXHXAUBMURFM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YHHTXFNVSCLL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EUSIHTCWFMOW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RNXBNLPOKCJM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/UBZMNDYJFFGL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VGRJRWQDVLHM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ISPPUNAOKJTL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GNNUAYUHJXLT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HWLETTJAFEHH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NXRTWUKUBUAT` Canada (Central) `arn:aws:controltower:ca-central-1::control/DHTDOXDDWKDT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WZNPSPXEWGSP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZPPLHWOMKJDA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ROFXSHTMOVMH` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SSBMEZOMBXUD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XVOJWCIJKWHS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PDKMMODLZJRS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LJDAJTIFMIBW` Europe (London) `arn:aws:controltower:eu-west-2::control/VRWSAVPPXKRH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NRDKLFIUEHUR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ORJIKLJFIOKT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XUQNZTJUTOVM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PAOTNLHHFSIL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/TFIVPOESOEHS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IHCAIGKUVWBB` US East (Ohio) `arn:aws:controltower:us-east-2::control/HTPRMMEXYQLS` US West (N. California) `arn:aws:controltower:us-west-1::control/TWLXKVBLCCQZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/QOEVDDAFSXDN`

SH.Opensearch.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IYALAFXUNGFM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GPFKBYCARNHS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GKQYHNVCZXUM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NPHMMQWTNQJA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LYLMJDTOGUWV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HTJOZSBBCWOS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IJZWORRCORNV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PDIQINMIKBJU` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QWJLMXTGTTTY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YHXKREIELOYC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QWRWFZJUHQIR` Canada (Central) `arn:aws:controltower:ca-central-1::control/VHKUJNWUZHWF` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/IITTYYHUWOCB` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ELGALPGEXDOI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QERQYVYWJCWL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EYYDQBDGWXAG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SCZURQDYZUVI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KEARYSPEKTMC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/UFAZXZNLUFJM` Europe (London) `arn:aws:controltower:eu-west-2::control/FQPSSRYBKFBC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LCPPNUYQSNQC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HTHUYTADXZDA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RBLYKOTFZVIC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WWBJEASDBRQS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MSRYQGHHWEWP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GABXYPFSQLCM` US East (Ohio) `arn:aws:controltower:us-east-2::control/NVSQFLJUXNEJ` US West (N. California) `arn:aws:controltower:us-west-1::control/BFCZCVPISWLS` US West (Oregon) `arn:aws:controltower:us-west-2::control/QAPHAIOJQJGS`

SH.Opensearch.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.3	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FNZWIJGLXJLQ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HWCSFEUAZHRP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MLXUGQDBTLDS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GGXZVSAXJJDO` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/DDDIOGTFAEKS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LDDCEQCAMDTZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YFPVNJZHWLTH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/IMPWKHACFWKN` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/QPRZHOWCOFOW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OTXHJNYQTKKD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XBYJNDDJKVTT` Canada (Central) `arn:aws:controltower:ca-central-1::control/VEHXNORMXQFE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NEFZTELEMRXP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CBWBMTSYADVE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/SUNZAYXPCJSN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NZTGOXILALHZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EBIDPRVIIGCY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JJRZUNKXJFZP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XUAAEQGCCKZF` Europe (London) `arn:aws:controltower:eu-west-2::control/DAUGSZZUKKCD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OZKIJCNPYBYQ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SHRKXJGGCMXY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TKRYARQHQROT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GBZHTMIUZRXR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UUHIFUJCREJE` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DPIEOZVOOBXD` US East (Ohio) `arn:aws:controltower:us-east-2::control/JXNDKUHIKUPE` US West (N. California) `arn:aws:controltower:us-west-1::control/CIJEXNXYHHBI` US West (Oregon) `arn:aws:controltower:us-west-2::control/MSRORYOIEHHF`

SH.Opensearch.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.4	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YUUGSSTYHDRD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/VSVDBRERDDDR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RPXLCWPBLWOD` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EZAUSYQGYQLD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YSKVFEGJXHSV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FBETLNTPIXIH` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VHYRFZVUXGTC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VENRTMNHFVDY` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YGRKTWGZGYWP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YEJHBFYVVLWW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DNZHEXJKVLVJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/MTRETSLGNEME` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FRYWISOBOVHD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SYCXPGVFVCCL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QCDYTZZULSCI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KGHPMJBWTZNM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/VJMBXPCTBUUJ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EQJJEEOXJKQK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SOQCBCPJHEEE` Europe (London) `arn:aws:controltower:eu-west-2::control/JPSTSWTJEDDK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TTTMILSTLIIA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/URNWHAQSLUTK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IBAJXXLJQPWA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HIJSBWCOEMTD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QOVSYKVMKSSY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GADHHKSJUALK` US East (Ohio) `arn:aws:controltower:us-east-2::control/ONGPXFNPQBSA` US West (N. California) `arn:aws:controltower:us-west-1::control/LIHPYITEEFGH` US West (Oregon) `arn:aws:controltower:us-west-2::control/IPGTNQNCEVHE`

SH.Opensearch.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.5	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZXRCHKHBEHEM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QCKMBZLPERQS` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JJWIXLUWYBCV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HMQDJFSYXHRC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NUJXOLMOQJPX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GZUMMDQRRYGL` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DDOOGMTACMYF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MXRREADODGVF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OZIJZGYJIAUK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/FLDCLJFBTYTO` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PKVVBWDUWRAQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZWUQUZVGRFGN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/RNEIKIXCATMK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QAXHUNQCUXSA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DOQKUJTHAOLV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/MCFVGQDHUXSS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UWBDELPUIJOH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PLEFRSRSYGNH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XUQONDDOGRUR` Europe (London) `arn:aws:controltower:eu-west-2::control/FSORDAEQFTUW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WYXULLGHGHOF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QWLZFZKBMYWW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RBQMQZKMTUGA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/BRNTOEROOLRZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RRBSFPOEGJLV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WAOBYBQZJHTA` US East (Ohio) `arn:aws:controltower:us-east-2::control/ABHACZZEEKDD` US West (N. California) `arn:aws:controltower:us-west-1::control/UJPMWYJTEGIU` US West (Oregon) `arn:aws:controltower:us-west-2::control/YTIOEVUJXBVO`

SH.Opensearch.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.6	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WJQWSHGXSAJD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RRVXSOJGMERX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BRKBMKFMLHEQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NALYWTOTQSQM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VAPYCLLZUKMV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AHZDAVZEIKPI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HRLYVYVRKSJN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/THCUKEEVGVRS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FTZIOOVBEHSU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QXOHIMELFQEU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VAXKYSHEJLIJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UFNJUYUNHPUO` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OYHALSTSCFNG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IQTWVHRNNLNT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KZXRCPJIBICT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NBJRUMLUQPZK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RRWZUZXOGCDF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KXYVVJCMMJDW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HXIYGAHXBPFH` Europe (London) `arn:aws:controltower:eu-west-2::control/KPYLKEFVFLLG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TRTPXUQNQSKE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LNDWLZWTDSWN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ISVLBWDGYRBA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MJMSXIBKNTLS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BYZZFSUVEFIH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UHLKIWWGXHHO` US East (Ohio) `arn:aws:controltower:us-east-2::control/INAHZRREYHKS` US West (N. California) `arn:aws:controltower:us-west-1::control/WOYZNDSBYFMD` US West (Oregon) `arn:aws:controltower:us-west-2::control/GRZJBENTFMIR`

SH.Opensearch.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.7	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-5 NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ZWHWLHXHUAOJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HSYLLYCWHCSU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QGKGUEKWKELB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JVLECKNIHJFT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EJHVEBBDUJII` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWWBNORXHGFQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YOEMSQTAHUUJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YWDFKJTPFDGL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/EGTEXCKXTWYU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BMMPEANNVKWG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FRDIPYNAUIDH` Canada (Central) `arn:aws:controltower:ca-central-1::control/CDTQYPILPGYQ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZNMUGWGSKIVR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HBOVIWODSIIQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TYPHPKJCUDNI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UBSEPWEOEVHB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WUFSDVAJELEH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BIBJTKEDGJRL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QIUXDLURBXQH` Europe (London) `arn:aws:controltower:eu-west-2::control/SQMDHKIDEBFB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QHKUXLTQGOPU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EAXLDWNGUJLQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XHSLSXRYTVAO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GWLBTSJMEICD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KJJGFQQDNIUG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TMJKCOOOPZDS` US East (Ohio) `arn:aws:controltower:us-east-2::control/HYJEBTQLGRWB` US West (N. California) `arn:aws:controltower:us-west-1::control/KAYPQKGVRYEC` US West (Oregon) `arn:aws:controltower:us-west-2::control/XJACAJPWJYEG`

SH.Opensearch.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Opensearch.8	NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/HNQCQMAFDLKT` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QFJBNBXURYPK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/SSAMJDSXKUQB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ELQLURSWUQRB` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JNQSUTJIWIGB` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YRWIMCSZLLAG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EQZOVYLZJDLT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/YQCKQPEAIJQT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MQGZXOCEDKKX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PIPNAAEJRKZP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VDTTQZONKFRZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/CLTBPMSNISNR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BEKTEPYOAZID` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QBMJTLWYWCPB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VKDATNFKIIMU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HUPEGIPAJUZG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MXNOIHOKNZAQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EDOHWAMOEKGE` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CCKMAIIZNSPH` Europe (London) `arn:aws:controltower:eu-west-2::control/UBUBNOTQLYHV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EBZSATEEXTKE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YVVOGVTLJMDU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KZNMLSRLCZWD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LVABWMRAZRKM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LYIOTWAGDXPY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OEGCJFDHPGEM` US East (Ohio) `arn:aws:controltower:us-east-2::control/MIUYZGCZSCNK` US West (N. California) `arn:aws:controltower:us-west-1::control/HETKZGLMYTUT` US West (Oregon) `arn:aws:controltower:us-west-2::control/ZYMOYFTGCZOO`

SH.RDS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.1	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 2.4 PCI DSS version 3.2.1 3.1 PCI DSS version 3.2.1 6.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.7	Enforce least privilege Protect data integrity	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DMXLVPBVFWXW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NYHKFPLTQJUT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/TOXGHRQOOUZM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JZXYYUXYDVES` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TEYOAWSUCXVV` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EHMNWTQNUQFX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WJZWATRWSJFI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QZXCSYNMQUWZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/KMPUUHKSUHBG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RCAWASVGOOMN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RRMAWLRWESEZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/NZXCAQOXCCUB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YSYMSEVORJZV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NCZTIRGKTDTQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FHVGUZIAJFLA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/RONREVDOJLHJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BYTOPPHNPJJX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SZSCCZSMDWKV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/GWPDEHULWHVB` Europe (London) `arn:aws:controltower:eu-west-2::control/ELQQDOSZOPYE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BJULHHBJYPSZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YQDGTKKPRKCS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DQXGSDQZEWIJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LYGRMMKUVFNO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DRLOIMLUYCCX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UWMYPVTQGECU` US East (Ohio) `arn:aws:controltower:us-east-2::control/OYYKDWBCQTYU` US West (N. California) `arn:aws:controltower:us-west-1::control/EFSULLGMVDIB` US West (Oregon) `arn:aws:controltower:us-west-2::control/CAGKPKAGDCTC`

SH.RDS.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.10	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.7	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GDAKXHOROXFI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BMSRSAARQHKA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HCCCLBUSXOTA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MOLCFSPBOQVJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EQYGHRCYHWFQ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RYHNWNNMLODQ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZCCRJMDHYMCG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JUHUNMEAVSXZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SMAVVTOYNJTI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RFEFRXCFVBVJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TYOYIDGNBXHX` Canada (Central) `arn:aws:controltower:ca-central-1::control/PRHACJRAZPNL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/IRLPUAXQSHRR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SXLQIDOEFSRI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GIOUJKXMSRVV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BTPGJCTLRYLN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DWXDIGXEPRSD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/MPNQUZZVZRCD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/YPEONMSLBPTL` Europe (London) `arn:aws:controltower:eu-west-2::control/BLXPGHVCWRQD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DKTIHAZFWVQA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BMBNSRRBDGRH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QYFAIPFBZUFK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SXWBMNUDNTJG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZXYUZGHNGIGV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QKWGQNGCDPYW` US East (Ohio) `arn:aws:controltower:us-east-2::control/JRCVWZHHQKOW` US West (N. California) `arn:aws:controltower:us-west-1::control/IOEHOHYBSJCL` US West (Oregon) `arn:aws:controltower:us-west-2::control/EFAPZPONOBQN`

SH.RDS.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.11	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6 NIST 800-53 Rev 5 CP-6(1) NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-12 NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Improve resiliency	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ICRTSIMBZTCK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GLARUXFBOGED` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UEYPQELHZGCQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/WNGCEPODSWMA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/APLZVZJQFRUH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YITLGYAIRUBP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NLSYXYBFFZKN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JKXCQSHKOFWD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PVJEIOWFEXGW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZISOXDCSGBYW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QSQJPIHTYALV` Canada (Central) `arn:aws:controltower:ca-central-1::control/TPWBDXCLLFXK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OVDBGHXGFZWW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/EXPWZLGXOBNE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MMGQLBCVPSLA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZHUFJUOHQHAK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NAZPMDWJPWUZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JAXREAASLYKL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NKIMJVTTDZKZ` Europe (London) `arn:aws:controltower:eu-west-2::control/PUGHZSTXSXHE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NOXEGPPLREHN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FLEUTKUGBWHK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/AXTSHLNWLMNH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NPBCFRCEAEYA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MUBQTISKSHFX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/IFMREHTYREKZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/JXWBLIPXTXFM` US West (N. California) `arn:aws:controltower:us-west-1::control/PJJOUURHUEOL` US West (Oregon) `arn:aws:controltower:us-west-2::control/EXXRISQZELSP`

SH.RDS.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.12	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.7	Use strong authentication	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PPRBNPCBTFHP` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QBYXIXYHPVDU` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/APLECYBWMJVR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TUCHTKHPPAUT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EKQVBQIVKIZC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YDFQASDRCIIK` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CIYFUHZVUZPZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BBFDNNCBMAOT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BMLXMSRNEDOJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BUGCTHLLJQMB` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AISNWVVVWLDE` Canada (Central) `arn:aws:controltower:ca-central-1::control/WLJSEVCPUVGT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EDJZGRIQPVTY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YCYHJVTHDNPX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GVDYQOEIYAUD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VGUCUQAUXAQZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IDIWKMEHGGCQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SBGIXNDFPFQX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JSYSYGUPHBMX` Europe (London) `arn:aws:controltower:eu-west-2::control/KWPJSLPTKZRB` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VHGKHDTUEGUU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EMTSPBJCHQRK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/CBPLVMBKSBEK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ACVWYGNAHQNB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HVTKBGSPIXNI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SMFUECIOXWRX` US East (Ohio) `arn:aws:controltower:us-east-2::control/XPQKKOXJFOJU` US West (N. California) `arn:aws:controltower:us-west-1::control/BTZHGHNRPFLP` US West (Oregon) `arn:aws:controltower:us-west-2::control/HGQGAKCYLYSU`

SH.RDS.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.13	NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/EKMARGCEYJWJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/PNFRHULEIBYH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XIGVOEMJKAAN` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YHGQSNNFHDVQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KGZHXBBNWVRL` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/SJKOVPHPKCSE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/SJPIQINHJLYT` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/PJLXYFZCQDDF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SFKATYNUSZRY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YPOKZKTDHUNP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/QQIFSSGGRXQW` Canada (Central) `arn:aws:controltower:ca-central-1::control/PTCFMAVPZJNJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BEWQTTHFKDRK` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GCFQCJMRPAWO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NEDQJPKPLZUP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YTDRSPNPDUDG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/YAWQRWPSJEMQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LDIPJFZYZNZV` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XIRVQKZQFELN` Europe (London) `arn:aws:controltower:eu-west-2::control/YEQBFMEZZYKY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QMXTRQBYGTDF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BNLZEEHOHYUH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/EWRQZABFFYLB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WJRBVNZTEHSR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UBPMMEGVOIKQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GUYPLHFGVYSR` US East (Ohio) `arn:aws:controltower:us-east-2::control/SVRYURDPWZDY` US West (N. California) `arn:aws:controltower:us-west-1::control/BOPQOMHKGHTF` US West (Oregon) `arn:aws:controltower:us-west-2::control/WLWAWYKRSUMI`

SH.RDS.15

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.15	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/TQMQDZPBVCXM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ISSGGJGWQRWG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VBNKKWDFNAZW` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SEHEGBVDGFYC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SCPCSAGBOCPR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ALNCDIFDIXFY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IFVOPWBQIKYO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/XVSMSTPMPWPO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CXRHCSGCTDUZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YWWIETPSZRLW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WUCVFOBYIXKY` Canada (Central) `arn:aws:controltower:ca-central-1::control/VUXWHQTMDUIL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ILHNKREJDYQX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CVMCODCFPUMR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PODHWRTIBWDL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KJTOOKWWQYWP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WQIBNPYUQCNY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/KTCDQKAPVCJH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QBPHBORNXALB` Europe (London) `arn:aws:controltower:eu-west-2::control/OGMFCZEGTRHD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QBRSRBTJPWBO` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EMKIUTOIPGBE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JBXQVIUHLFJC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VGYYMQDKNIVU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/AXSXMBZSGOEX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WEBMACIXPMUV` US East (Ohio) `arn:aws:controltower:us-east-2::control/OXZGGJJGHSWO` US West (N. California) `arn:aws:controltower:us-west-1::control/RLSNOOCARNMP` US West (Oregon) `arn:aws:controltower:us-west-2::control/IJVHZTDIWOAW`

SH.RDS.17

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.17	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.4	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YFEFQAGCTXFF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HXMIQJLNARRI` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DVLDWXJCOMXM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EPTKMHACQELH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IRSNXUYHPOTU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/YVFDAUWENFAA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RIDGXWTAZIOY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SRQHDGHEOMQL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SRFNCNDSXZNT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BLFMKGLMSCWC` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EKULWZDOHRAR` Canada (Central) `arn:aws:controltower:ca-central-1::control/AUGOGJCNNLCH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WEVXLRJLQDIS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DJZAPEFIHNFU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TYVQESYPRVFE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FWIVEWQQXNHK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TPCZTKSNYAEO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GVYUMMGWLGUS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BFNXHULOVVIP` Europe (London) `arn:aws:controltower:eu-west-2::control/ZCZUYDTUHIOI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BZZSMKNBILCF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LAIQFBQWSFFS` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HSQPPMNDHTFT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XCWJFZXXHMNV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YALXEHDSNCTD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DTZXJLHKFLEJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/TUGTHWRGHGVM` US West (N. California) `arn:aws:controltower:us-west-1::control/SIUCVIXCSYVX` US West (Oregon) `arn:aws:controltower:us-west-2::control/THIMEGDOQLQT`

SH.RDS.18

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.18	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UGCFLEFRJEAO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BCHMHENTVFGJ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JSNSKZQFYVBT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/NNRQJBASRGFM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/KOTAXASSUDZM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WUNIHEUEMUJR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QNNEFNXORSWZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FLLXFLHIFSMQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RBYPDKTCHCVN` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KMSMPOVDZICV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XTZAMSAMSCPF` Canada (Central) `arn:aws:controltower:ca-central-1::control/WGELDILYYVXL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/EEGBQWIUIZWF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BPCAMESMWAHB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/DMBWVVVMDMSA` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/EJNZYMOZMYKX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NTIYGIRHEDBI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PTCSKRPYZBEQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PSTYGKOBDUTG` Europe (London) `arn:aws:controltower:eu-west-2::control/ZZHOCZFFHRAS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SWEQGXNIMHXT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BGKVATFYWVZQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/IKECNTSGIIMR` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HVDWLUSRQUKU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HYSDYMKJVUVK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PXYEQHPGSBAU` US East (Ohio) `arn:aws:controltower:us-east-2::control/JYLXQUQOFAHZ` US West (N. California) `arn:aws:controltower:us-west-1::control/PTTJFTDKIAFZ` US West (Oregon) `arn:aws:controltower:us-west-2::control/QFDDMLBXZFMD`

SH.RDS.19

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.19	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/CVBWWWASJNLR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LRQZTCPUUHNY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CTNWHYDIRSVT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JBYTKROMQCXV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YXOJCJNNXMYN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FNYIMXTFODXS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/KOYHUZNARZGE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WYTBUHZZBIKS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FDBSHSSUIULV` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XHTDMEFQZXKX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GMIFABMHIVGQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DUYBROXNVRZJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TBJWFPUZUFLC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SDCINGKZSOQU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PSETMOZVYBWN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LAZJDBKFEJMA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DBONRSRLEXLY` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PIJEXHKERCDI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FFWGQTMRZLCX` Europe (London) `arn:aws:controltower:eu-west-2::control/WJYRSJUKCXTX` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PWEQIFVKNZUB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/RUINCDRXSUTL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TORCJRWAWQJN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PNHNTGCTFSEO` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SODGIROQYHNV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NXPQTLYAEZFF` US East (Ohio) `arn:aws:controltower:us-east-2::control/MHCRBPUUNLAM` US West (N. California) `arn:aws:controltower:us-west-1::control/JHQDLXADFWXA` US West (Oregon) `arn:aws:controltower:us-west-2::control/LRBSFHOKMEYK`

SH.RDS.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.1 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/POQROKYYHAEH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HUZNLZYDDEPK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/RYZQHJVDDKSU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LVCJBGBIVJAD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TLLTLNDOAEIR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QPXOSOOJYDOD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/OUPWBXITSHYI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FXNNEWSUUKUT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IWPFNXTZXADU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NWDYNOSQWTKZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ONTGJZBSDCNI` Canada (Central) `arn:aws:controltower:ca-central-1::control/LVTHEOBWSHXI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VFQJTFQJQHVV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MONNJZHXUZJV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AHLQTXXYAPRC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LRLYXEVQGYTM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ATCIYLXTXRRT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PRKAFTOJNVAO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ZNRDFQQKVSBM` Europe (London) `arn:aws:controltower:eu-west-2::control/SLIBAUCMRGDZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/WLPKIQHXVSRI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/OBAEZYKYCQIH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UBDKGWIEKVFU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XCDQMEFFFZZI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KCAXLPFZJXCU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WDBVVIVSLRNF` US East (Ohio) `arn:aws:controltower:us-east-2::control/JOYEWALSGIFL` US West (N. California) `arn:aws:controltower:us-west-1::control/ZWAQHUGIFEBL` US West (Oregon) `arn:aws:controltower:us-west-2::control/MZHXJEYNYHPM`

SH.RDS.20

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.20	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WZTZFERDRNRZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CHKIZUAIWSCR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YMSJKTCPZVLQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HVLENLXSMYVM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JJQGZMLRABGE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NVFJXDYXEZUI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NMNPOWBBVKTQ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QMPWTHDYXPNF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SIZRZVALISEG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ORJVOTVRSXOR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GOBWLIKGKFZX` Canada (Central) `arn:aws:controltower:ca-central-1::control/OODDUWOHHNMJ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/UHKKWRNFMJCD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/MGGSWFNHYEYW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MLIXSUAHTCVK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/AYTEEMREPGTY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UDGHHIQNVRVF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YWSKPSGQJIRW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OOZTVTPLFUZE` Europe (London) `arn:aws:controltower:eu-west-2::control/SCDHEPMDRZYD` Europe (Paris) `arn:aws:controltower:eu-west-3::control/JWYATNKBGECV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QPBDBATLPAAL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XHJRIOVIMYSX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SZTPUSPPYSUE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/OAIMBCJMFKNH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BZKHLGWSEYGS` US East (Ohio) `arn:aws:controltower:us-east-2::control/QKBXURIFEDNR` US West (N. California) `arn:aws:controltower:us-west-1::control/ZWIFHLDJHCYK` US West (Oregon) `arn:aws:controltower:us-west-2::control/EZKYVDMHEXTT`

SH.RDS.21

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.21	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BNELLPBMJHTB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ECQRKNRGIBRB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YXJRNYQXFFBJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GZCLBNPOKRNZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/TXYZIWQJJOBI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MUDGOLDWJQFJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MNZPCCBBTWHD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SFJABILZRZSE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BEAJMSHPLZAF` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RPIXSHWACIZA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DHFGSCPHGFGY` Canada (Central) `arn:aws:controltower:ca-central-1::control/JUUCAVNVKIFZ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/DNMPMEOKAURX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BDSWAPWAEJOO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PQXGEUXCHWII` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XZAJRQOSAIVS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/DJPRIJPVEJUR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NGAKKKIJXXWP` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FKEYGPXPKFLG` Europe (London) `arn:aws:controltower:eu-west-2::control/IREBVNNCJFQN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/UEMPPORPOEXD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ORYVRQJOAQZA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KAJRFHZHEEQE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KBZVYYUQDTMF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ONKVQCAHDMMG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LSOCQKOMTNUV` US East (Ohio) `arn:aws:controltower:us-east-2::control/HXSMRIUXHEQL` US West (N. California) `arn:aws:controltower:us-west-1::control/GTXGBGCVGHQI` US West (Oregon) `arn:aws:controltower:us-west-2::control/VNVOSKGSBKYM`

SH.RDS.22

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.22	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2 PCI DSS version 3.2.1 11.5	Prepare for incident response	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AACFICNJTRID` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EADJCXOMVJYL` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EXEHMGVOGPEL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XGNLIROGTVPW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NLYYFTDJKWHC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QUVLHKDDEGEY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IKWWUGUCJKGO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/EQAAWXJPTMKT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HGUANBQWZZZT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SCBBSWOUATXG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/INUBMSGPMDBZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZGGHJOYOXRWY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WXSFJCDGUVPQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NOQNKAMBARQQ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LEBENADUNWDW` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WCCGGPOESKUN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/UUSSSRNDQRJC` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OMXZWVUSMEHM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/FHEENQFCWVOW` Europe (London) `arn:aws:controltower:eu-west-2::control/USADZKONGEWL` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MEMSFTMAYJCK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UISDXWFZEJHE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GGUAQQTUTLEX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UNJPGFUAUMTM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZIKCBMBKOYQG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/APIPOBXRVOAY` US East (Ohio) `arn:aws:controltower:us-east-2::control/XNOPTYHHXQYF` US West (N. California) `arn:aws:controltower:us-west-1::control/QMZEDTMMIZLU` US West (Oregon) `arn:aws:controltower:us-west-2::control/YNHFAJNIYTDT`

SH.RDS.23

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.23	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(5) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/FMQJQDYXLIPD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/YCQVDRIRRUGR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HIWFHIFSZSKM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VIWCZSTJLLWW` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/EMZXHYBDVJFN` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/FAFQHCERANWF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VHOLYEWSVJVE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/QXHTVIIKMWTW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZRQKSDQFNGQJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RHRTMFCHWRUP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/CCMIWQUTDLEM` Canada (Central) `arn:aws:controltower:ca-central-1::control/WSSFKIXFVIRY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/APWZIGZHVARG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VXAKLAUIEPMU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JENQBWKPZFIU` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IVCTUYYNHZKS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZYLXYWQSWXKI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LQFJNXNUIXMT` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RASOHQDBMGUM` Europe (London) `arn:aws:controltower:eu-west-2::control/PLKDXQODKBCM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XNDQOTSALSLX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/EHPQJUMQFNSB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NKHGOKXNOTRZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VMKHOIDLDUDN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WGAKCUZZVTHP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YMXSTCEYXBPV` US East (Ohio) `arn:aws:controltower:us-east-2::control/BMHOKULQTGAT` US West (N. California) `arn:aws:controltower:us-west-1::control/YMDPRQFAXKCO` US West (Oregon) `arn:aws:controltower:us-west-2::control/TJALNCJQYRFH`

SH.RDS.25

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.25	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/RXRPJZOLYGLO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XYHWAITRDXYF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GFQGKQGMTLQT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YFLHZPIZNNYT` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XFXJXQAKLQGF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/AWJUNDMLTRRD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IWFKNJUECFCP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NDCFQRXZYLGR` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/BGPIYTQZCFXL` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GFEOLBSVFOQY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WGXPMECRJTPT` Canada (Central) `arn:aws:controltower:ca-central-1::control/HKYZMPYFMAFO` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MTVFYPLVBWLF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GROVJRZIBJCL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CHTWRJUMWMBB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ONRGZMZOPBUF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IEUZYOOMVIEA` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NVVJDJHEYBII` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/MZHTGUBEWDXJ` Europe (London) `arn:aws:controltower:eu-west-2::control/RVSFMKXOOBZS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QBJWHTMNMSRR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AXHRFFFVYJMY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/MILBYVWTMEPW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VHUGHQRWLGFA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PWFHIJDDFBFT` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BBSLGPRKDCNJ` US East (Ohio) `arn:aws:controltower:us-east-2::control/RLYGPPANIDPZ` US West (N. California) `arn:aws:controltower:us-west-1::control/XIDGGFKVQTBY` US West (Oregon) `arn:aws:controltower:us-west-2::control/QCWMEMJPWTVG`

SH.RDS.27

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.27	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MLFCXDBXSHLS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JIZLYPRPBUCH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DRFBXTXBNCRS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/ONFIOHPFSHGK` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BGKJBIGOSQFD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VLLLLYEMUGOC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EZIWLTXOAQHH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/UEUHZXQNABCQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YIQWYGANUPYO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HSKEFGEVSJIT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XLMGDIAWVKYE` Canada (Central) `arn:aws:controltower:ca-central-1::control/HYHWKJXEPHPS` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YPRYYKPLDBOZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YHFDAYZPEVWO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BKFQQBXEMFDJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SHKEUJZRGZDP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IWCFMQFHLRGM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DWJFDOXIWDDO` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SMQWYFRNIEJB` Europe (London) `arn:aws:controltower:eu-west-2::control/TZIPAEKMFTMH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DJZYDUIVJLQI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GEHUPROEHLQN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GTZTTZZHOETD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WIEKQNJQWREN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WAAVLKURPRRQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DROQPQLJBTES` US East (Ohio) `arn:aws:controltower:us-east-2::control/YOTEPOZWWVTA` US West (N. California) `arn:aws:controltower:us-west-1::control/WCSGBVJYKJKB` US West (Oregon) `arn:aws:controltower:us-west-2::control/AEXJPTLILJTV`

SH.RDS.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.3	CIS AWS Benchmark 1.4 2.3.1 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XMSHQGVBLMND` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/RCZFGXTPCMTW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ICYIAUGUTWUB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VMJOVSBQHNLI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UIENYOBUJNSA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QLBPHXRQYFTE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZFZWGXZMMOGH` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DUPIMTBMZJBD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OKWMNXYZRUVG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DKXKBEZZINHA` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RGJCTKFEWLDP` Canada (Central) `arn:aws:controltower:ca-central-1::control/KAZMYJAUZYSY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YSNWXTIUMIGT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KNPNIWDEVEJG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/WHUKMYNGKRGZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QGGSRCNFPBON` Europe (Milan) `arn:aws:controltower:eu-south-1::control/CEBRILWKVQTH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CCUIBNHINNCJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HBTSVIZWIAQY` Europe (London) `arn:aws:controltower:eu-west-2::control/ZQCGVRDNLZEK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ABSIYZAIAWCN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QCFSVIXBTGYO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/SBHVAYWWPWIH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AEMLMVWSSSKF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WWDYZRWIDTXW` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/VGWJZZHSYIBM` US East (Ohio) `arn:aws:controltower:us-east-2::control/VCGAQSCJVXRX` US West (N. California) `arn:aws:controltower:us-west-1::control/TGJXCMCDKMXP` US West (Oregon) `arn:aws:controltower:us-west-2::control/NMQXECEAQCBC`

SH.RDS.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DZBAIXNSCZFE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JJVRNEASBZXR` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/CLRBHZMKGNHA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TXZGWWJTMYAS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UVPKESVWKVJK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DACICEFQAULS` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HKMXDLJBUVEL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/SWWDMMPJTVUT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UOCQAVOKOBTP` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YWNABTEYPHEN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EQBPROLCJSOO` Canada (Central) `arn:aws:controltower:ca-central-1::control/VXUOLNFZHRXA` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/GDEIRHHCESVA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/KZAQFIPMORTE` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IUKIRAVTQVID` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BBVSFCJBDKUZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BUXWNDAJAFBH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OWXPUPKMUXXF` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LREEKQPJSYDJ` Europe (London) `arn:aws:controltower:eu-west-2::control/CZGUUSLYJXEQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/BKZVWTBCYGUF` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KTRZLFBOMDTY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/GVDVDBATDISQ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ORSOWOCSURYI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/RZHJRUQRPWRV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BZBLCONTBAMD` US East (Ohio) `arn:aws:controltower:us-east-2::control/JFTFUHKRKVSA` US West (N. California) `arn:aws:controltower:us-west-1::control/NOZHCDEDTOTS` US West (Oregon) `arn:aws:controltower:us-west-2::control/OGAIZAJBSGBT`

SH.RDS.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.5	NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 SC-36 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5)	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OSJKXCQTLDPE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FSAFMCYSWUJT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/OTHPZRZHRYNM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QSPRBKYKNWKM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/MNAKGBRDVTIU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/GPUFSACIRWXI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UYYASMITIUQI` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NNYNUMCTQZCZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IRSIBRZRNPGJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LXXGNLOIMFBI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JQEDTWOXFGAN` Canada (Central) `arn:aws:controltower:ca-central-1::control/XMPOBIWVBCBI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TQWYECSCTERF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RDRYYIDEWYNY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/XPGVZVPCVYIE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YREOQGNQKBLJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/BFFOSTRHRWNH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/DRTTENXJKSKK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ABTYUCPXKSGJ` Europe (London) `arn:aws:controltower:eu-west-2::control/HKTFGMWLCXVS` Europe (Paris) `arn:aws:controltower:eu-west-3::control/SEMODNJPIZDI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QFRCOLDKBAIH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/WLMVDIGPJJDC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/UFMIVMYGSVXW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/HDDRWBVHAVWK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WAIDVEUJUPWI` US East (Ohio) `arn:aws:controltower:us-east-2::control/NTFDQTWLGZWO` US West (N. California) `arn:aws:controltower:us-west-1::control/IXXVGFGVMRZK` US West (Oregon) `arn:aws:controltower:us-west-2::control/WQRKCNCGXMEZ`

SH.RDS.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.6	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/JLAGJWEAHVGN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LXWPUHEDQXWD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BKCRQHWTOIDQ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MEYNQQLIBFVH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/THTGPLTZHLGJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VHPWTYRBFSMR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/NXIOMPYTREVL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/WGVCYIMZTDAK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LJQFIHVOJEWC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/IOAHXWFQCEYK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SMAOIHUTMJYJ` Canada (Central) `arn:aws:controltower:ca-central-1::control/DKSRZCXJNFHQ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/DRROPVKSAWJV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/JKBKECQARADY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/RAPLSUSAZPCK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OITUKLCXALQI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/WGPCRMJRNFDZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TFIUHIPWSDSA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OEPIOAXLVVJQ` Europe (London) `arn:aws:controltower:eu-west-2::control/FUVWSPBRWRMJ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XOMAAMMDKJSN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DURQYXBVWAZL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RHOJEGQZRCFT` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/PLVEDLZNNFIP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KLAQLDQDNQCO` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/CQFNSAHGKXYR` US East (Ohio) `arn:aws:controltower:us-east-2::control/QJCUZIBGHFIW` US West (N. California) `arn:aws:controltower:us-west-1::control/EAZJCJVTNTTK` US West (Oregon) `arn:aws:controltower:us-west-2::control/EYAIAJPSQRWR`

SH.RDS.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.8	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-3 NIST 800-53 Rev 5 SC-5(2) PCI DSS version 3.2.1 2.2	Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GQJZUPZPTKIJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QDPHQYFRMDJH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KVSVIPSIZPAS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EWKOXIOSNJCZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VUWZFVXFQGYH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LWZRQWERBHQG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FOOGUWKUSIQL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GINLEIXHNSYL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CDKCDVDPAZJE` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/QLTLLZEDFQHY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OABGKDZQGHGI` Canada (Central) `arn:aws:controltower:ca-central-1::control/WFLIUEPSIAYX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VSGKSFJGUANX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SQHTJKLMQJGB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YEKVJFVVEYXE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NMWOUPNACHOL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/QKJTZGDBTMKW` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UHWNSWIYTZTK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XBIZWFFXCCON` Europe (London) `arn:aws:controltower:eu-west-2::control/VQMCVFXHFAQQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EGERDMSRMFYK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NXAXQFZIPPTD` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YLYPAYIZAGAB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HSJUSDYUHGKC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BQHOIAHINFUY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OHXOGCEUBHHF` US East (Ohio) `arn:aws:controltower:us-east-2::control/CCQXNXARGJAR` US West (N. California) `arn:aws:controltower:us-west-1::control/EPAIKXSPXSCA` US West (Oregon) `arn:aws:controltower:us-west-2::control/EZGQFHTMBAWO`

SH.RDS.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.RDS.9	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.2.6 PCI DSS version 3.2.1 10.2.7 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PCEKTEAGVMFK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/LFDATPUFCXCN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/EIZJBSDXPFGK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/PSHCDLXAFPIZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/HSVGATRQGQFD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KAQQDXQFJYRU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/WYDNYHQQRPHC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TBIMMPTMBJTL` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FPPDNGIQPZQT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XFUBFLKVCSWV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/EJEGABPETHRB` Canada (Central) `arn:aws:controltower:ca-central-1::control/RYUXCWVBRCAD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/NNATLUDVNSCA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GXZYLMFPQWDW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/STYZYDDRXBMJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/REJGKLYPHVDN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZZEFHHUCOIWQ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/LLVNVLTZHWXB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/IIFLSTVTRDZG` Europe (London) `arn:aws:controltower:eu-west-2::control/KMLDOBVZXKCT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HNXTEFHVWVUV` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YVWNDBZWWRNN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZXSTOJRMWPCZ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NTUVNBCELQXB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NDKTXPFKNJXF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BCVVFPDGVISN` US East (Ohio) `arn:aws:controltower:us-east-2::control/OTXQBSYGPGYU` US West (N. California) `arn:aws:controltower:us-west-1::control/IXAUVMTYOJTU` US West (Oregon) `arn:aws:controltower:us-west-2::control/DBSDVNSHWIOG`

SH.Redshift.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MGYCUTBPHKQF` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UIHXRVUVRRAE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/AYTBPCVDXBQV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KUKRAWPCWPWD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SHDEMOBAYZXW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WXXRGRFXMKHZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YDNRUJATZYJE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AWCJAMQENDQO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WVIYUKDGFONY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/NJDFTEIYYWKY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WZSVNCFYCZIN` Canada (Central) `arn:aws:controltower:ca-central-1::control/RSFNTTQDNSXM` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FHMMCMHNDOSS` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/IYGOKELWJWMB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LKCBAPZBOOLQ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LZKIQTREDTFY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AEYSBJAHZAPX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/VAIUYYCCDFGZ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/CCXNECVPVRHL` Europe (London) `arn:aws:controltower:eu-west-2::control/RHXEMVQOGMNY` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XJVAUJAVHWDX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DTLRHZWMGPRZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UUAXRQLDOZEV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VRBRBJYAZYOX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YQJNEMQSMPCG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QGVYRDNRLLPZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/VRMIAJEHXVEF` US West (N. California) `arn:aws:controltower:us-west-1::control/WUADYLMPFVGP` US West (Oregon) `arn:aws:controltower:us-west-2::control/KHOSQGUZDTNH`

SH.Redshift.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.10	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NYCSXUJFVEKD` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WLRENQGKZECD` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LYYELPWNRVLL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/HLTTIBMTADKA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/SWHIEKIVGHHA` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WJWRWAEUMDCO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RXHUUVLKLCVG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FEOOFZLBVNOD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LQIBXYSZTOTD` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VMBHZJXXJUPX` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DPCENEQZMMYY` Canada (Central) `arn:aws:controltower:ca-central-1::control/SFTASJFBQOZK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MXPRRSQPACGF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/APZBNDSLBEGY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LKMRYMWKXBGZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LUUIEVUKWMHU` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GSWBOTIUPYPV` Europe (Spain) `arn:aws:controltower:eu-south-2::control/JCMLQDACVNHK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TZZYEMVXIONE` Europe (London) `arn:aws:controltower:eu-west-2::control/ZVKXZTUNFLSZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TSPTAYOGXSED` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CNSUGWYPILHB` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LJCNNSTJGUGB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NJGXNCTGBIVX` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/KAABMIDGCLBK` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NMNBPYCIYIAW` US East (Ohio) `arn:aws:controltower:us-east-2::control/FGDKUQOJDCQG` US West (N. California) `arn:aws:controltower:us-west-1::control/ENSMMXOHZMQJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/CLQQQXAYJAFH`

SH.Redshift.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.2	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) PCI DSS version 3.2.1 2.3 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YXVVYHGFHDXR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UUZMKQUBIMQT` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ORADMUNKKIYS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QINDHCURJDPR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/XMZVHIQBPEWE` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/NDBMIIUJFYKY` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/LKXXIUFUWSNW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JBOXYUPVWNZO` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ORJWWXAPJACW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RMRXRJQBRECD` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/SBYGIMQNIVUO` Canada (Central) `arn:aws:controltower:ca-central-1::control/YMGGCUBQWEZW` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BMPTTLLYMSCU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HFSIBFFEDEQY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/AXJFPTAKBPDC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QXUXFMMQNNJV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XAZMLYULWCSI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/BVGKVAQUBMZQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BSBJQSWTSRSX` Europe (London) `arn:aws:controltower:eu-west-2::control/BAZMHRYHVCQG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YQJYRYKIWLYT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SWMVEQCZCHLK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RRSONTCKFRNH` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/LOMHJGHIXWKG` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PUKFRLSTCGTP` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/GJLYVQTNPXNP` US East (Ohio) `arn:aws:controltower:us-east-2::control/QZALUPNZSSAE` US West (N. California) `arn:aws:controltower:us-west-1::control/MABMUFJZSIUD` US West (Oregon) `arn:aws:controltower:us-west-2::control/YHXWAUSZWWSC`

SH.Redshift.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.4	NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.2 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.2.5 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ERHGNHMKADER` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SVOOYXKSLPNB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BDVLMXDLACBS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VAONGWDMQJRF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GXQGCUTVKOFX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/JHIVYPBOODHM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/RXLYBMEIXHHY` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FZJIXFLBDRUT` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UNNOEVFPFBMC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KIUKHPLJCUOZ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WPRKUHHGLIWS` Canada (Central) `arn:aws:controltower:ca-central-1::control/JWQMOSWEPUQN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JABKOAJJWOKO` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TXHHSJDORTML` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZCIGCWYKAAZO` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HGPLAVRGKLHM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/FXPEOPUDCSNP` Europe (Spain) `arn:aws:controltower:eu-south-2::control/CQBFSVUDGIVC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WWXRQFACPRHJ` Europe (London) `arn:aws:controltower:eu-west-2::control/JLWRGFBTTBOI` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DTMFZCWWBWBB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DPBAIKUWPTSP` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XADUWJCQBZGA` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QFONFITVCGXS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EYHIRCYXXFHZ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UGPCVGZGVGBN` US East (Ohio) `arn:aws:controltower:us-east-2::control/VVVOXOKKREWD` US West (N. California) `arn:aws:controltower:us-west-1::control/OCZIXJSTBKZD` US West (Oregon) `arn:aws:controltower:us-west-2::control/HREVCGLTRGZP`

SH.Redshift.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.6	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/GOEURHCKUXUN` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/GBHAWLMJRHVZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UOQTHHTKOQAJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LJCQVRORIRSP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RUVNVNPSHCCK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WWTYVIKOAEOM` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FAGGYDXNZBUM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DKJZUWRTDLHV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WMXBZOHRKUOQ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/XHRBYLKYBNST` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/DLRYZSWNWHCM` Canada (Central) `arn:aws:controltower:ca-central-1::control/MWBNTMMYOBQK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KYXMNSODRWRC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TMJCFUASVOFO` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CNCWVLLBBBXD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YRROEFOYJQLY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PKELBKMISAKL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XXFLJMKEEENK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SNCYQNOVQMMH` Europe (London) `arn:aws:controltower:eu-west-2::control/YGTSSKVHAGTU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IOUWEZSPPBNS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZVVMZZYXIOMY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/TCNSYEZXIILX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MACHIHDTZGVY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UGSNUMXXOSJU` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/TKSZMFLVELUE` US East (Ohio) `arn:aws:controltower:us-east-2::control/JHAJNHIIVUZK` US West (N. California) `arn:aws:controltower:us-west-1::control/LGUQERXHEPJH` US West (Oregon) `arn:aws:controltower:us-west-2::control/TTPCFJGMJZSJ`

SH.Redshift.7

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.7	NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ODSWZFJRAGIS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/UYVDUBBFAAKH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DSKLSBLANWJM` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DBIOXKSCYZGD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PXBCJKPOSGVW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QTIUHWEMWAMC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/PNYJYHQJOCGN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RERSLKEIBQHG` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MVNWOYAUMTGJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YLYPATNCYAHF` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JYKBHETTNVGA` Canada (Central) `arn:aws:controltower:ca-central-1::control/VZIZLXFWAEFL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/TMFEHCHQZLNN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HOISPCIAYQCB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MQTJTBBGJWHR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/NDDIAQWLEPTB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/PTKESWKCHTXS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/GYXKUNKHAQOI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WFFFLIKXSJYG` Europe (London) `arn:aws:controltower:eu-west-2::control/FDQXVYALJBAT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/CUGFTMBJPKPT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/GKHWILBJNEDN` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VZJSQNWNNRYX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/XOALSSLNNVMP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/BLCLCFXYBPRV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EFKEWIIFDJEZ` US East (Ohio) `arn:aws:controltower:us-east-2::control/LRZEWAWVMSHF` US West (N. California) `arn:aws:controltower:us-west-1::control/PKUZKCMQQKRR` US West (Oregon) `arn:aws:controltower:us-west-2::control/JSLNDFAYMRXF`

SH.Redshift.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.8	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IAEUTKKUZCTC` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IPYUFDSEGTZV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HQIOVIJMPDMP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/KHSJIQXMKUKN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/OJBWSVMSVCCG` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LNLPIBKGAUQR` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EXPZXDYXQYVE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/FREYXDZYZTBB` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XIDWPGTUKALT` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MVNLITWIZKCP` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/JSJHYAACFAKF` Canada (Central) `arn:aws:controltower:ca-central-1::control/OUMGXBPLINOD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/HXMPTFTMXMAC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/XFBMDQEICXZM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/TRDFIPDHZVOG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ABEXBGLMXTJB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KOWQSITVZSRZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SVCSXDWBVAQA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/ROJQXUSTAPYS` Europe (London) `arn:aws:controltower:eu-west-2::control/DIPEQYZCPMLE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ZLWJDNJODZNI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JDKPSOMCQPDW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OGDOBXCPXKMY` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SYYQHPDZNMCL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XIJRAJTVHCJI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/DGHUXCTZEDYI` US East (Ohio) `arn:aws:controltower:us-east-2::control/BEPNPCQCPDWJ` US West (N. California) `arn:aws:controltower:us-west-1::control/OUYAXYKXNKVB` US West (Oregon) `arn:aws:controltower:us-west-2::control/KLCNBPBVPMMD`

SH.Redshift.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.Redshift.9	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 2.1	Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XCIQVCJWIJHS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EDUSZSKCUQIZ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VZUUWSEPMGAG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/VYGTYLRWZYAD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GXGYRHOCDIYX` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DNJVACRRVQMJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/YTWLZGLPAZBF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/THQBUSXDSJML` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TTPOHLOSZBPO` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JOZJPMKUQCXR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/UHJWGXYIYFJT` Canada (Central) `arn:aws:controltower:ca-central-1::control/CSOGIJBMPVER` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JPVFTRICKBXT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/TVVIZSSMLNIT` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PUSUSATQVIJY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UNTIRUWZWUNN` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XESBGUQDSVQL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/OOYHYAXVODLL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XSRKMHENVRZY` Europe (London) `arn:aws:controltower:eu-west-2::control/PMKUADEMALEE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GQRHHERYSAUT` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/WCFOVEOSWHTI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/HULNSRQTHHZD` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/KRXQXXNNOQCL` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GMLYQLDUQHXH` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SMGEELXNDBKM` US East (Ohio) `arn:aws:controltower:us-east-2::control/OVOHLKXBVPQL` US West (N. California) `arn:aws:controltower:us-west-1::control/XFUBODJYVTNX` US West (Oregon) `arn:aws:controltower:us-west-2::control/UQQKZEWILTCV`

SH.S3.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.1	CIS AWS Benchmark 1.4 2.1.5 NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-13(5) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(4) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 11.5 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2 PCI DSS version 3.2.1 3.1 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.3 PCI DSS version 3.2.1 8.2.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YBCEKEQVJCXE` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/KDIIRAYKEQZB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/VRHOXLIGOOYV` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/AGLATCNIJPRQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IAKKQRDDMKUI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DDFXZZZGUALP` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HPVGBWBPNSKL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TFBJICHQSQCX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/UBQSERAFQQLI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/OHTAXSNBBKOR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/KOFEXGZOKREC` Canada (Central) `arn:aws:controltower:ca-central-1::control/ARAAXROCJLMK` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/XSWLPZICARQG` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UJQJNPZSGLTA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/MMBNCNMNMWZS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/DHADSFAEUWZS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/HWDRKTOHYQGD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/AZWIUOZBVEZB` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LSUJTPCOEECR` Europe (London) `arn:aws:controltower:eu-west-2::control/BFOHYIZSLOKR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ECBYLUUJDHST` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FQSHGSRFIVHH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/JAYWMLKFCGMB` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/AUZQRVCYRYZW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EYOPEGKZSTTF` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/XKHROGVFBBHP` US East (Ohio) `arn:aws:controltower:us-east-2::control/JRCVWAZSRAPY` US West (N. California) `arn:aws:controltower:us-west-1::control/XWNNIUOSTDBE` US West (Oregon) `arn:aws:controltower:us-west-2::control/PSJEDKJBNWNR`

SH.S3.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.10	NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Optimize costs Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OSRTWGPGUMAO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/SQVRYHXLKMHG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BKQZDJRIPDCH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LRFQVSXHRYQU` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GZPXOIKGOEPW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/KPCTMBEDXBVA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CNNAWRQANXRD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GEKKTSNJMQZE` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/OEWTPHSMPPGY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CLOURZRNHDTT` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GDTHPZVCAJIM` Canada (Central) `arn:aws:controltower:ca-central-1::control/MVWRAOTEOGZF` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/UOUOUJZPPLPU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CGPVJAMLPNCD` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/KKOBXZDOUWQC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UFOIHGFEAASV` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GTJSSVDVIRLB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QIJRNMJTMRTW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/WYRBYRJBCFGJ` Europe (London) `arn:aws:controltower:eu-west-2::control/JDVMZOQVCGKE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IPTDZHPYCLJX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/NGCXCLBWKEJW` Middle East (UAE) `arn:aws:controltower:me-central-1::control/YCXJWJWGLEFX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/VBUTWBBCULWY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZBNPDNBGPNYX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/YXSHBLNRJEIL` US East (Ohio) `arn:aws:controltower:us-east-2::control/RYZTTCAMHLSE` US West (N. California) `arn:aws:controltower:us-west-1::control/POQFEOOGZRPP` US West (Oregon) `arn:aws:controltower:us-west-2::control/NNKPEWEOGGGE`

SH.S3.11

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.11	NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4 NIST 800-53 Rev 5 SI-4(4) PCI DSS version 3.2.1 11.5	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/ORMRUCPQEXXA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/HYCIHHGWVRLO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/UWDNCNQHITXR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LDPZBYDVREOG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/GMCJNVYGHDYD` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/RFTVXUXSDPBJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JFWVBWPMAILF` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DCZQYLXVSENF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HYDZJVQVOSSG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HPHXBRWQFGST` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NWMNKUEOUFVH` Canada (Central) `arn:aws:controltower:ca-central-1::control/ITNNRYBVJGNI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZPSKBXNYHZNL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VPORJKPKMJTX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FTTEIDAMAJYT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/BOYXQVGZIHKY` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ABYCSYXNCYVX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UBWXQGGVDZKN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JGYTWTUCDJRI` Europe (London) `arn:aws:controltower:eu-west-2::control/JQLFNEUIAMQV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IFMFFIFRXKSP` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/XPVJDTXDPMDE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DVCHAQDOZMFI` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EGLWWTVKZTHM` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/GMKHBZANUDII` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NMYTVSNCIAIE` US East (Ohio) `arn:aws:controltower:us-east-2::control/KTXZKUGOIOZB` US West (N. California) `arn:aws:controltower:us-west-1::control/ZOLMKQEAFZIO` US West (Oregon) `arn:aws:controltower:us-west-2::control/YEESXUDJFQTY`

SH.S3.12

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.12	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.3	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VVPIILTHZXIA` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/EVQSJKTXBSKO` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/WMGHTZRZASZI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UWBLTNMBDOOX` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RAYJBDOADZRY` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QYSZQBRLIVHX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TURQGBBHGEMZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LEZPLYTTTVHV` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/IYZUNEUFKEBY` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RHHGHSMPTLSR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PSJBVGZGYSCZ` Canada (Central) `arn:aws:controltower:ca-central-1::control/UNGOCLMLKNAH` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WITLGPFCOFJV` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/CHIDBJOCXIKM` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/HTNXOQNSELBJ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/WYYTZOHUUUIA` Europe (Milan) `arn:aws:controltower:eu-south-1::control/KAKRCVPQXXHH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/WTYHDWUXJZYN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/OCMEJBXKCWSF` Europe (London) `arn:aws:controltower:eu-west-2::control/WQICVAPWAYEZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/VXTCTFSIHMVK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AWPBCYFYRBUK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DSUOTBFKQDOK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/SKJBJZDQLVXI` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NXKTRBNXNLUY` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BKLSQSHMCKWE` US East (Ohio) `arn:aws:controltower:us-east-2::control/KTPCIMELTXVN` US West (N. California) `arn:aws:controltower:us-west-1::control/KLISLUUHUYPN` US West (Oregon) `arn:aws:controltower:us-west-2::control/SDRCGUUWECWP`

SH.S3.13

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.13	NIST 800-53 Rev 5 AU-9(2) NIST 800-53 Rev 5 CP-10 NIST 800-53 Rev 5 CP-6(2) NIST 800-53 Rev 5 CP-9 NIST 800-53 Rev 5 SC-5(2) NIST 800-53 Rev 5 SI-13(5) PCI DSS version 3.2.1 10.5.3 PCI DSS version 3.2.1 10.5.4 PCI DSS version 3.2.1 10.7 PCI DSS version 3.2.1 3.1	Optimize costs Improve availability	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/OVGJVOBDCORO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/DERITHIRDAFA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IIUTDTJVTRUB` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MNDGHSQGIHSP` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/IAMWVVWBFLWO` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/EKXYSHHNTFGF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EBKIHBUPXXDZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/GCYHDAOAZEZQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/TWWHDSTFPQWH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KKDSEFIHLQPI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AMRZQPIWFIFL` Canada (Central) `arn:aws:controltower:ca-central-1::control/KPNAKOZEARRB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/REFDZRKJECMI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/GYGNCQLCYPEX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FSRGMCSBPTWZ` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LIVWOXMJIWLK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AUTPFILOWGWT` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HRKBZPPCEWOQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QPEXOFWNQEZY` Europe (London) `arn:aws:controltower:eu-west-2::control/TWVXCPMNSEVC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/HVDXLVVRSLWK` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JBOVXTPLCOTY` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LUDYEVLGJCJM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/YJTXNSCEGYZT` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XZDSAKGUPOCB` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/UDFSBDLMCKHG` US East (Ohio) `arn:aws:controltower:us-east-2::control/DDDWXYAMKSZD` US West (N. California) `arn:aws:controltower:us-west-1::control/BZWMUSQKKNPY` US West (Oregon) `arn:aws:controltower:us-west-2::control/URNEOQLNCGXG`

SH.S3.17

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.17	NIST 800-53 Rev 5 AU-9 NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-12(2) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 10.5 PCI DSS version 3.2.1 10.5.2 PCI DSS version 3.2.1 3.4 PCI DSS version 3.2.1 3.5.3 PCI DSS version 3.2.1 8.2.1	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PHXLSXKYGBUB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/NZORZZDLGZIG` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IHEVZGGQGBKX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/CCDJWQAZRABA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QDFZKAFTLCWU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/QKQSGBKTQTNI` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MIXOKFKWXVEG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZMDRQJPWIBDD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RAKBNMGBWPVK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GODQMDIZNGCW` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/HCKZPQHSQIWP` Canada (Central) `arn:aws:controltower:ca-central-1::control/QXTWLYUXVMIE` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/RIWSUULDEGDH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/DGETTAJQXVAU` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/BEWBAGRYSEVL` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ITYNEBUPBYGG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SRVMFZGRKBYD` Europe (Spain) `arn:aws:controltower:eu-south-2::control/UNYIXFOWMFRA` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LLSGHRBQBSES` Europe (London) `arn:aws:controltower:eu-west-2::control/SVUZWOTRLCSO` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MMSBTMNRGYRJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/YPEFGWLXAAGZ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ZVTKFLYEDLLC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WSQUQOVYFOIS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WENBEBLVIRFQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HAATLCRYJXSX` US East (Ohio) `arn:aws:controltower:us-east-2::control/KKYBUSWNADNE` US West (N. California) `arn:aws:controltower:us-west-1::control/TPDYJNOFYPSU` US West (Oregon) `arn:aws:controltower:us-west-2::control/BPJKDXJRCEBE`

SH.S3.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.2	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WBZIGEUGYWHR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FXDKWRWGOOAA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FNAGBSJDNSMR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/JVTGANIDGRYD` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BAFBYGBLCFSK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/WQFTUQOYEPUO` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/BZDJGTONQXPO` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LBKNUOHEWDPK` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/WUHZWRYEJOUJ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MPVTFRLVMLJV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/RNBXPQMMVWXB` Canada (Central) `arn:aws:controltower:ca-central-1::control/BPFIVHGTXOGG` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/OPQUJAVSZOIL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UXNOYWDDKLNL` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LFCZJISGPWBK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/OELOVGEWUICF` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TXLSFIGQFITI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SOIHHGNAQRSL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RNRFWUNSMVZO` Europe (London) `arn:aws:controltower:eu-west-2::control/TNVEODWBLGQT` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DNOPTVOVRECR` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/DEIFRDOQSCMC` Middle East (UAE) `arn:aws:controltower:me-central-1::control/OQKLKLQMKKRN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/DDGOOFCDMJQK` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LEZLNXWHNOBS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EUQZPHPTYCGS` US East (Ohio) `arn:aws:controltower:us-east-2::control/UWARQHCUKTWT` US West (N. California) `arn:aws:controltower:us-west-1::control/EUHTMNOVXIUP` US West (Oregon) `arn:aws:controltower:us-west-2::control/KCEBTQBTPXWJ`

SH.S3.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.3	CIS AWS Benchmark 1.4 3.3 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WPPSHSVFUYCG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AGUZPQVPKUAN` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IOXTWTJPAGNK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UQFGRBNKRVKM` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/RSTGAIEOPGOK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MUMHADVUHEXE` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/FHOVMJKVMUQN` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LEHHNNZDYPSC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YJQGDKELZCKA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/VFIDZDNLSOFJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/MCAEFDBBIUNT` Canada (Central) `arn:aws:controltower:ca-central-1::control/AQQIXVCNLDYX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YTWTOKFPQVHP` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/ZTSEFWNWFBFI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FTOPSFQKGNTG` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LTIVGDFURRIH` Europe (Milan) `arn:aws:controltower:eu-south-1::control/JGZDYQZJRLXH` Europe (Spain) `arn:aws:controltower:eu-south-2::control/NKJSIHFRFJQN` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/DUWNOGUJJEYE` Europe (London) `arn:aws:controltower:eu-west-2::control/ZQLFSFHMBNQF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NCGLTHGVRQUZ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZCUKBZPOUYXJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NXYKGBHDKYZE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FELTCVVNKVCN` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/NQYKUEVXJMTQ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/OXQICLGDWVUS` US East (Ohio) `arn:aws:controltower:us-east-2::control/NRDDEBVYUWNQ` US West (N. California) `arn:aws:controltower:us-west-1::control/LQHXMDREDMHB` US West (Oregon) `arn:aws:controltower:us-west-2::control/TSWBJXBIHDPI`

SH.S3.5

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.5	CIS AWS Benchmark 1.4 2.1.2 NIST 800-53 Rev 5 AC-17(2) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 IA-5(1) NIST 800-53 Rev 5 SC-12(3) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-23 NIST 800-53 Rev 5 SC-23(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-8 NIST 800-53 Rev 5 SC-8(1) NIST 800-53 Rev 5 SC-8(2) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 4.1 PCI DSS version 3.2.1 8.2.1	Encrypt data in transit	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/MTODXGKQRVLW` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ADPATUGOSUGW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/URNKTBOWAHSH` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OVTXWKOBZPZR` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LKWDHYZPQSZW` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OJXAXIGHYFQW` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/COQIWEDTNDTE` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/BIELWGHJKGPA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/MYWMNVQHDBPC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JPSIACOPUSZU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FCVFZUVOREFP` Canada (Central) `arn:aws:controltower:ca-central-1::control/RQKKRCVIIKYW` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VBWZPQJLACPR` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/AAUHCKLBMUEV` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/QLZBBEKWCTIC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/VDLZMBUFATGB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZMWSBCLIHOSX` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YLVYNCBLRGJS` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/BPQXZTSPWVVX` Europe (London) `arn:aws:controltower:eu-west-2::control/PRNYXIYGVRXN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ULMDATXUHGXD` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/BSNJHYTFBAFK` Middle East (UAE) `arn:aws:controltower:me-central-1::control/NVDVLXBOSHEW` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GPOXKQCSLIEZ` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UZYVCOLSTZUL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QPIQHVFRBWEY` US East (Ohio) `arn:aws:controltower:us-east-2::control/PZTPBSALVUYK` US West (N. California) `arn:aws:controltower:us-west-1::control/PNULPQNUPXRO` US West (Oregon) `arn:aws:controltower:us-west-2::control/HYHJNWCTPBFR`

SH.S3.6

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.6	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.2.3	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/BEBMMZMNSZVS` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/AHCOZYYLTKCQ` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/XUHLFSNTEWFP` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/QJAYYWXCXHDN` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PJYKAMYFSFUP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DBISINHULBGV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/CKZTFDBAWSEX` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/AZGSOSZUWIKH` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FGNEAZJPHZUU` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/YXFWDBZKVQSQ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/WHNUFZLANZBQ` Canada (Central) `arn:aws:controltower:ca-central-1::control/TSCSMHZBPAOD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FSDPEZAFNOFH` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QNJWDZCIVDCH` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/YRFABFWWLJQD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QKUSDPWBMHZG` Europe (Milan) `arn:aws:controltower:eu-south-1::control/EXMMPUCVRYIK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XBGWNWDVLIWD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XMWBZXRYGTMC` Europe (London) `arn:aws:controltower:eu-west-2::control/MGOBAFXHHMUH` Europe (Paris) `arn:aws:controltower:eu-west-3::control/AARUNPWJDELC` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QRRYDAWHBOEI` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FLUPMDXKOIBJ` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WZNOMCSEVATF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/WKWUMSNSAANN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KTMNKSWVOVXN` US East (Ohio) `arn:aws:controltower:us-east-2::control/FZXEOILVPPYH` US West (N. California) `arn:aws:controltower:us-west-1::control/WIYZFXURQWZS` US West (Oregon) `arn:aws:controltower:us-west-2::control/TIXQXDCZZIOI`

SH.S3.8

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.8	CIS AWS Benchmark 1.4 2.1.5 NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/AUHXJXHKBBKZ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ONKXJNALDZDW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LUJLEEORWUBI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/LNGHEQDYEQLV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UNLUZEMLMIDM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/HTLHSBYDSNKX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IYWNMIENLKQL` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NAQFFFPSERVD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HISIOKDAAMQR` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HLZDJZXLBXSV` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AYHAAWZDHPJT` Canada (Central) `arn:aws:controltower:ca-central-1::control/RXZJMQEOLMGW` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/YLOXMSLSLESQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OGUOLZTXJTVW` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CYBUMWBTIODB` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/YUTTRNVCQCIJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XQOQRAKJTPVU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/STJPUTHVQGSC` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/SYIHFFPXEMOL` Europe (London) `arn:aws:controltower:eu-west-2::control/LMEJYAPAVGXW` Europe (Paris) `arn:aws:controltower:eu-west-3::control/PNWCPAETGOAL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/SEKSWVCPZTWT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/FFZWQAZXXBLN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/ZYYLFRUXUHFD` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YFMJMXPVFUKX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/BPQJQKFITSWH` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZAAZUIGROKPH` US West (N. California) `arn:aws:controltower:us-west-1::control/RTJHMNHBMMAJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/PDKYAANJEWJE`

SH.S3.9

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.S3.9	CIS AWS Benchmark 1.4 3.6 NIST 800-53 Rev 5 AC-2(4) NIST 800-53 Rev 5 AC-4(26) NIST 800-53 Rev 5 AC-6(9) NIST 800-53 Rev 5 AU-10 NIST 800-53 Rev 5 AU-12 NIST 800-53 Rev 5 AU-2 NIST 800-53 Rev 5 AU-3 NIST 800-53 Rev 5 AU-6(3) NIST 800-53 Rev 5 AU-6(4) NIST 800-53 Rev 5 CA-7 NIST 800-53 Rev 5 SC-7(9) NIST 800-53 Rev 5 SI-3(8) NIST 800-53 Rev 5 SI-4(20) NIST 800-53 Rev 5 SI-7(8) PCI DSS version 3.2.1 10.1 PCI DSS version 3.2.1 10.2.1 PCI DSS version 3.2.1 10.2.3 PCI DSS version 3.2.1 10.2.4 PCI DSS version 3.2.1 10.3.1 PCI DSS version 3.2.1 10.3.2 PCI DSS version 3.2.1 10.3.3 PCI DSS version 3.2.1 10.3.4 PCI DSS version 3.2.1 10.3.5 PCI DSS version 3.2.1 10.3.6 PCI DSS version 3.2.1 2.2	Establish logging and monitoring	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LAHMBFBXGUGH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XQBAFSLADIAE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KHOWWKTFVNWS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/XKQRAYJCRJRS` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZWTDGBKHAEQM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/THYMKLHAVMWC` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/JWXSMMOZOPSV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MXLTHQZBCTDQ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZPOEOPATKJIC` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/BDDPOSOADNHN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/PRFYAYCKCFSC` Canada (Central) `arn:aws:controltower:ca-central-1::control/GFOFPVBQVUFV` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/BRRVGCIDRXLW` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YWWKSWSZNPSI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IDXDMPTTSUJE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/FSDRKINNPPBD` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MYOGIXBLFVLU` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XFZTRADKKJDW` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HVKIHTICWHEL` Europe (London) `arn:aws:controltower:eu-west-2::control/TZQIUGSNXXNG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/XEVOZIAAWYKS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ZCJHXOEVVLSG` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LRCOGMUPFPAK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/GURAFGBEYLTS` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/YZMEODWAHVDL` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QMWZZISJNGVG` US East (Ohio) `arn:aws:controltower:us-east-2::control/XEYTESFJJVRU` US West (N. California) `arn:aws:controltower:us-west-1::control/ZJRFWTNSWEVB` US West (Oregon) `arn:aws:controltower:us-west-2::control/UMKAXUFOAXGS`

SH.SQS.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SQS.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-3(6) NIST 800-53 Rev 5 SC-13 NIST 800-53 Rev 5 SC-28 NIST 800-53 Rev 5 SC-28(1) NIST 800-53 Rev 5 SC-7(10) NIST 800-53 Rev 5 SI-7(6) PCI DSS version 3.2.1 3.4	Encrypt data at rest	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NVEKDWVEAMCR` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/COZOHULQNMCP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/ZDMVZWYXPYNG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/EAUIYIPCCXXZ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ZWNYBXFXQEEJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/OCRDEAEBDMNJ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HJXEXGPJNSBD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NZDJTQADTXGS` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ENSHCNPLXZHX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/JZFYRWTOBBSR` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VBIDJQZGKRYL` Canada (Central) `arn:aws:controltower:ca-central-1::control/YNRXRVWROTER` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZUFDBJAKCHYT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/SDQYTAUTUONG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LCBBKNXZWNAC` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KBKQAWGKVVBK` Europe (Milan) `arn:aws:controltower:eu-south-1::control/LPYJURCUYIKS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ZOPCUJOYLJNH` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KKBOVJBZKRXH` Europe (London) `arn:aws:controltower:eu-west-2::control/AREAYHKBSDVF` Europe (Paris) `arn:aws:controltower:eu-west-3::control/EMOPJHNXCSWH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HPWJBABRMGVE` Middle East (UAE) `arn:aws:controltower:me-central-1::control/XPMFHRPSYSWX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QSEXECGUWKZY` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/XCTLDMBSISCM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/AQPZJAICUMOX` US East (Ohio) `arn:aws:controltower:us-east-2::control/FSJSXWXDXTQG` US West (N. California) `arn:aws:controltower:us-west-1::control/NKGRFJUHQFGJ` US West (Oregon) `arn:aws:controltower:us-west-2::control/DVIYOYZQQBHZ`

SH.SSM.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SSM.1	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-8 NIST 800-53 Rev 5 CM-8(1) NIST 800-53 Rev 5 CM-8(2) NIST 800-53 Rev 5 CM-8(3) NIST 800-53 Rev 5 SA-15(2) NIST 800-53 Rev 5 SA-15(8) NIST 800-53 Rev 5 SA-3 NIST 800-53 Rev 5 SI-2(3) PCI DSS version 3.2.1 2.4	Manage vulnerabilities Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XZLLEKBIURBH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XQFVCDXEAMNM` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HGKHLYMQCWXZ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SOADYNVMUUSE` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/NANAQQREIGVM` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ISTITQJTNGSD` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/TBSRQZQYDGHC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/NWSTAJGOQBJJ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RLRUQAVPCAZI` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RMEMMANEFBWK` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/AUFDPRZPMXPB` Canada (Central) `arn:aws:controltower:ca-central-1::control/XOUNWPBZJNVB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FHHJLCZARJOF` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/RAPYUEVJEJBI` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZRZNFFXDWGTV` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/KSKCLFWRTEJP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MOGSUWPPKVSO` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QNFAZRZFXKKD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/RXNTSMQLKTSN` Europe (London) `arn:aws:controltower:eu-west-2::control/ZQSTFGETEWJA` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QHTLZMCZKVAA` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CZVJXJACDKCQ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DNSLRHWDFOPX` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NKTATZELQAOC` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/PWIULRITCIKD` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/LYPKGNLPNWHL` US East (Ohio) `arn:aws:controltower:us-east-2::control/STNJGGCQJCIW` US West (N. California) `arn:aws:controltower:us-west-1::control/AHGSLJBGGRQD` US West (Oregon) `arn:aws:controltower:us-west-2::control/MJMHFBPPWLJA`

SH.SSM.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SSM.2	NIST 800-53 Rev 5 CM-8(3) NIST 800-53 Rev 5 SI-2 NIST 800-53 Rev 5 SI-2(2) NIST 800-53 Rev 5 SI-2(3) NIST 800-53 Rev 5 SI-2(4) NIST 800-53 Rev 5 SI-2(5) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 6.2	Manage vulnerabilities	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NENYSAPQRPWV` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XOCNFUYTUQGB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/GYGBASAIOIXS` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YPZMNGTROKXV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QEQAHOKBWZWT` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CWXNZUPFQUJG` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UILIWENKCRXM` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ZAEIEMPTKSGD` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LARTAAZXHQGH` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MVMGSSOZTDTL` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/TRWTZCIERHHI` Canada (Central) `arn:aws:controltower:ca-central-1::control/NMLXRBHLMGSL` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/LGJXLIZVLCNZ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/HSENLNFBIHTF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/FTHUPKHIRIWY` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/UAFFTPQZIXDJ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/OGDHJDGTSSLR` Europe (Spain) `arn:aws:controltower:eu-south-2::control/HXZOQJUOQJGQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KUSFIFXCWYPN` Europe (London) `arn:aws:controltower:eu-west-2::control/OMNUMQWSKXCR` Europe (Paris) `arn:aws:controltower:eu-west-3::control/NZGSDZDQPQIL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HLJJMTSZDMPL` Middle East (UAE) `arn:aws:controltower:me-central-1::control/DJFZIILZBRYE` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/CGFHJDMJYPHE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LNHSBYVRSTVG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RDSQHZJJNJDY` US East (Ohio) `arn:aws:controltower:us-east-2::control/JSMHJHLHELYO` US West (N. California) `arn:aws:controltower:us-west-1::control/OCZSGXLBRYOH` US West (Oregon) `arn:aws:controltower:us-west-2::control/FFOYUQFIGGQM`

SH.SSM.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SSM.3	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 NIST 800-53 Rev 5 CM-2(2) NIST 800-53 Rev 5 CM-8 NIST 800-53 Rev 5 CM-8(1) NIST 800-53 Rev 5 CM-8(3) NIST 800-53 Rev 5 SI-2(3) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 6.2	Manage vulnerabilities Protect configurations	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/NPLXYIQFQRHU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/IGLAUERYXSIE` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/KPMCXMAZTWYO` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UAWRVXEHXONI` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/ALYHFSQFGAZU` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/CVEGWZBOLQVU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IVLBNAWZAFVP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DWXVJLGLHICA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/SFESCRTZJFXB` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/PEJUJWOTFHGM` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/URXRYIIWHPCX` Canada (Central) `arn:aws:controltower:ca-central-1::control/FVQFKOJUNLOY` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/ZIBANFCOCFEQ` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/BUFFWCQVUNMG` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/NIBUMLERRCDE` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SLNLDXNHYMTS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/GAWOKYZFKDQK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PPNVBEXPXLNG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/EQMJTEGXWFOU` Europe (London) `arn:aws:controltower:eu-west-2::control/ICKTKXTHFZDK` Europe (Paris) `arn:aws:controltower:eu-west-3::control/OBWPGGUSJHOL` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KLNDJWQOZEXA` Middle East (UAE) `arn:aws:controltower:me-central-1::control/VTLJCNGLHOZK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/OORIBBNGXKBB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/DQOIXCSNNCLV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KBRZYOMGLHXE` US East (Ohio) `arn:aws:controltower:us-east-2::control/FUUFUNICZWAN` US West (N. California) `arn:aws:controltower:us-west-1::control/NRHVHBLWZMMA` US West (Oregon) `arn:aws:controltower:us-west-2::control/RDXQFIOFSBGG`

SH.SSM.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SSM.4	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WHXGWOHYTIQK` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/ZPDDGCUOPDGW` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IUFHQEARVUHK` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/UDAQAMUOGDDV` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/FEIJPRQZBHKI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/XRDYUTEVYMMA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/HZAJYQSOBHUC` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/JGSYATCRDPGX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/RKBCVEOAAXFA` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/UIPMXTCDQPMG` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GKIJINHKAEWB` Canada (Central) `arn:aws:controltower:ca-central-1::control/CRPLDMSGZVNX` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/MLFKHLBNRHCA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VAYHIYPPEEDS` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LLGRYYQUJZAP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/SAGBQDVUTVPI` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MRZGJXNMFJGS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/QTYXURYKBTZI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/VWFNFRROBVOX` Europe (London) `arn:aws:controltower:eu-west-2::control/VJYRNGSBXCNM` Europe (Paris) `arn:aws:controltower:eu-west-3::control/ATGIDTBHLUTW` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/MQKOFBLYJGNO` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UJAMAAJWHHXC` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/NNTWGBBTYOHE` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/ZGSGXXWGZYKA` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QPOQERPDKUUL` US East (Ohio) `arn:aws:controltower:us-east-2::control/NGXEGNPKLRFM` US West (N. California) `arn:aws:controltower:us-west-1::control/MNCPCUXYPLYN` US West (Oregon) `arn:aws:controltower:us-west-2::control/FBHANBZBEATL`

SH.SageMaker.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SageMaker.1	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/DEMYRMWAMTBO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/MSGZHALHHMMH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/JICNYNFRVRQX` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SNGBHAIQCTEF` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QDWTOACBZUOJ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DGBAJFFOFTUB` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QBYEHQVHOZKW` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/OIWALMEQVBYZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LYBVPJQFKFUM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/ZIIJBMJEHKKH` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OKQCLSCHJHMT` Canada (Central) `arn:aws:controltower:ca-central-1::control/SQZAFTGIIXLN` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/UMWHBDYYBSPI` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/WRTYZGZDWCOY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/OMMZPVNZUWHF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XDTALWADUVAQ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/ZEDLGHMSOKDB` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RQLBVHPQVAJM` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/NUSFXDTJWGYD` Europe (London) `arn:aws:controltower:eu-west-2::control/TUIOOPQFSYBC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/IPWMCVULQVXI` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/LGOEWPUPESFJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PDIGNGJGRBYN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EXTCZTIUDCUR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/LXFEKJNOJXFJ` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/RKGYZUOFZLRQ` US East (Ohio) `arn:aws:controltower:us-east-2::control/TMAFWQWAQOAY` US West (N. California) `arn:aws:controltower:us-west-1::control/YMPZFEHCRVWM` US West (Oregon) `arn:aws:controltower:us-west-2::control/KSWIOQETFUQN`

SH.SageMaker.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SageMaker.2	NIST 800-53 Rev 5 AC-21 NIST 800-53 Rev 5 AC-3 NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-4 NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(20) NIST 800-53 Rev 5 SC-7(21) NIST 800-53 Rev 5 SC-7(3) NIST 800-53 Rev 5 SC-7(4) NIST 800-53 Rev 5 SC-7(9) PCI DSS version 3.2.1 1.2.1 PCI DSS version 3.2.1 1.3 PCI DSS version 3.2.1 1.3.1 PCI DSS version 3.2.1 1.3.2 PCI DSS version 3.2.1 1.3.4 PCI DSS version 3.2.1 1.3.6 PCI DSS version 3.2.1 2.2.2	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/PJVJTDOVMSCI` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CRXRXBMIQIOY` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/MCLMAWQKBWTG` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/OIKBJXEOZOYQ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/QQKZPVCVPMEF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/PLPATENUQNNZ` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/AZNKRLXOZUML` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TTNXTLKRLUQI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/XWKDVYDAVXSW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/DARLYRBBXIRE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FDUVQJXVPDMG` Canada (Central) `arn:aws:controltower:ca-central-1::control/RAPZNYOHIVYB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/JXNVRGNDRWPD` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/UNUXXNVPKDKY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ETOBDMURUWRS` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/XJUIETBSJOWP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/IWISABHXWCXZ` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YHWGYZKGRUKD` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/TLNAQJQANTYZ` Europe (London) `arn:aws:controltower:eu-west-2::control/CQECIKKXJUJN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QRSGKHDVZGRN` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/KEYAGLYTZALU` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PAREKPJOKJPV` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FWESVBOVNHUB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UUWNUMSGTIYI` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/PMUACTTBWUIR` US East (Ohio) `arn:aws:controltower:us-east-2::control/VDBLYABRAGVK` US West (N. California) `arn:aws:controltower:us-west-1::control/PLVBDYQNQDLK` US West (Oregon) `arn:aws:controltower:us-west-2::control/EVWTVVCSKQMU`

SH.SageMaker.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SageMaker.3	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) NIST 800-53 Rev 5 AC-3(7) NIST 800-53 Rev 5 AC-6 NIST 800-53 Rev 5 AC-6(10) NIST 800-53 Rev 5 AC-6(2) PCI DSS version 3.2.1 2.2 PCI DSS version 3.2.1 7.1.1 PCI DSS version 3.2.1 7.1.2 PCI DSS version 3.2.1 7.2.1 PCI DSS version 3.2.1 7.2.2 PCI DSS version 3.2.1 8.1.1	Enforce least privilege	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YKNYGMGGDGCJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/XVBSAGVXANJX` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/HLEUYIBPLNQU` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GRZCUFGQEKEG` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YPBYWISEJCGZ` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LMYFYNKDCOKV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/MKINKHFXUOJJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/HPLWOBUPSFSF` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/GHYJJWOGIPDS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/EWZDEVNROUUU` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/NDSZNXBOTSYG` Canada (Central) `arn:aws:controltower:ca-central-1::control/GBJUIOMQLVOT` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/QJGTWRYGWONT` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/OJPMWQSLZIGR` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/VJTCGDNOUHLD` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/QOYZOFZYUVBP` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NMETXDIQMQOF` Europe (Spain) `arn:aws:controltower:eu-south-2::control/RWYSGRIPZBSI` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/QTVCTBLIKXTQ` Europe (London) `arn:aws:controltower:eu-west-2::control/PHGBYKRHRVZN` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YRYFWFSNQQEB` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/JELYYUXAXNBT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UNICNHDULQKP` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MGDDEFIIJLDU` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VUPWZBFWTBDM` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/FLKLKRSKSRQR` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZYWOLSUFYNHX` US West (N. California) `arn:aws:controltower:us-west-1::control/JBTRXDPZMKNW` US West (Oregon) `arn:aws:controltower:us-west-2::control/LWNZCRKRHHIB`

SH.SecretsManager.1

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SecretsManager.1	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) PCI DSS version 3.2.1 8.2.4	Manage secrets	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/YQAHHZNJSUOY` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/FQMKOCBUONFH` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/LSEQYMIVIBNA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GPALVEMMRYOJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/YJLXPXMMEEUP` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/VCDOMBQOZAKF` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/IOLFUATPJHKV` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ABWGMGKAZWBZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PIPRTUKNSOCX` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/GTSKBRHBWRQI` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/GEAWYDVBNIXE` Canada (Central) `arn:aws:controltower:ca-central-1::control/ABZHCDTAXCTD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SEBWOEVOFOUY` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VPLLFHIVPDDZ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/LJVIJOVOFKMT` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/CKUSCVVHKNIR` Europe (Milan) `arn:aws:controltower:eu-south-1::control/NRLKQQDFPMKS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/EXFSNOCLYCLG` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/PPXTTTZIQJWC` Europe (London) `arn:aws:controltower:eu-west-2::control/PAPTNHXGBYVU` Europe (Paris) `arn:aws:controltower:eu-west-3::control/DZAFJWOHCCOH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/AKLXIOZMGDYX` Middle East (UAE) `arn:aws:controltower:me-central-1::control/RINUFBSILRWN` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/JTEIDGHIWJJA` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/IHQTQRKAFULV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/NVINDDWBCJID` US East (Ohio) `arn:aws:controltower:us-east-2::control/YRBOLGMRVCTS` US West (N. California) `arn:aws:controltower:us-west-1::control/NPFKTIKTONEU` US West (Oregon) `arn:aws:controltower:us-west-2::control/FSFKVERCZULZ`

SH.SecretsManager.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SecretsManager.2	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) PCI DSS version 3.2.1 8.2.4	Manage secrets	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/WVYYGKQOFPBG` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/WHHSYRQAKNNF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FEQZVIIMFICA` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/GIGGAHAENDHH` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/LJRRWQEVNAYS` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/LOGBIWTPOFLX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/DMPQMNZVHVLD` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/ODPPJQBZCOTX` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/HOQMRBMNIKAW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/KPKKWBORDNQE` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/ZKUJNAVKDDTV` Canada (Central) `arn:aws:controltower:ca-central-1::control/STQSZAQDRYTI` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/GSKXDXTYJNJN` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/NNBWANKZRGIB` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/PVGEKAUNLDDK` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZASYFRCXDOII` Europe (Milan) `arn:aws:controltower:eu-south-1::control/APSJDYWODCWM` Europe (Spain) `arn:aws:controltower:eu-south-2::control/TOKZIKVZIWDJ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/STHNSKDZTLYY` Europe (London) `arn:aws:controltower:eu-west-2::control/HKCSAHJCYOBE` Europe (Paris) `arn:aws:controltower:eu-west-3::control/MPJHRSESKKPX` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/ORGXYIREPEHH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/QCCZWOTSKXFG` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/MLMWHIERVLCF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/VYULRBMPXUKV` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/WMGPNBVAGVFK` US East (Ohio) `arn:aws:controltower:us-east-2::control/NBCDBWRQFNMA` US West (N. California) `arn:aws:controltower:us-west-1::control/YRFKOYUPIDDR` US West (Oregon) `arn:aws:controltower:us-west-2::control/MEFMYKVDMILQ`

SH.SecretsManager.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SecretsManager.3	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) PCI DSS version 3.2.1 8.1.4	Manage secrets	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/XRNUVTPVPTUH` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/OOWOTLCNTLZP` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/FNOJORYKEHUT` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/MSPQXYBGOSXA` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JDJWASVUDGGR` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DRWDDUMJXGDX` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/UHOYPEEDLWGZ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/DVRPVFHGPOQI` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/FNKXYQSZMWQM` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/RIXZUJWWGECJ` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/XYPJSPOFGTSP` Canada (Central) `arn:aws:controltower:ca-central-1::control/ZKLBBEFBUMDR` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/KMDBCTANMSXA` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/PXRUQAQCPSNY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/IFSPOTJZCKDF` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/GIFLRYEYHEHL` Europe (Milan) `arn:aws:controltower:eu-south-1::control/XJVHIHEQJVXK` Europe (Spain) `arn:aws:controltower:eu-south-2::control/SMZDFPZYYENL` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KRZOMDMWLCLU` Europe (London) `arn:aws:controltower:eu-west-2::control/HLNBTXEOYZHV` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GEOKFDUAKJVU` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UPLCDIUBIMDR` Middle East (UAE) `arn:aws:controltower:me-central-1::control/PDGHLNSCIVLK` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/EWNUGSXZEQLB` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SXONJYJKZCIN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/QQURRKYALIYF` US East (Ohio) `arn:aws:controltower:us-east-2::control/DPKZCRDWWFPC` US West (N. California) `arn:aws:controltower:us-west-1::control/LXFYEIRGOXXV` US West (Oregon) `arn:aws:controltower:us-west-2::control/IVSZZVBQUNGM`

SH.SecretsManager.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.SecretsManager.4	NIST 800-53 Rev 5 AC-2(1) NIST 800-53 Rev 5 AC-3(15) PCI DSS version 3.2.1 8.2.4	Manage secrets	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/KLZBMNYVVQHU` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/CAQLKGZTNDXV` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/IIHPFCYMQEGJ` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/DZWYNEXSLLEJ` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/PTFYDGIATBFF` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/MFXRVGDHFFAU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/ZBLIBNBVYFXG` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/LLXUCSEGVUUZ` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/PTCINVDOZREK` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/MEGGKAMEPGYY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VNQVUCEENIMY` Canada (Central) `arn:aws:controltower:ca-central-1::control/BNCSMILPESRZ` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/SRHTUTIDTQAX` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YIDNVPANOFJF` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/EDPIVXYACBXP` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/TIDMOKHUHNBS` Europe (Milan) `arn:aws:controltower:eu-south-1::control/SZIHVFLANSDL` Europe (Spain) `arn:aws:controltower:eu-south-2::control/FRVBJGAGYIPK` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/JKDFTFHBBSEK` Europe (London) `arn:aws:controltower:eu-west-2::control/QNRCHTJKUIIZ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/LXYXKMYBTCEY` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/QEDMGIXMPZNH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/ULOULJOLYROS` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/FVDKTSOPRFTF` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/QARJZOGDUKDN` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/SWGHBAYWQTEU` US East (Ohio) `arn:aws:controltower:us-east-2::control/LVTTSUIMJUHB` US West (N. California) `arn:aws:controltower:us-west-1::control/JVQTGNTBDUZR` US West (Oregon) `arn:aws:controltower:us-west-2::control/WIRZVNDRETYM`

SH.WAF.10

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.WAF.10	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/IVBWDWAPNAXJ` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/JWHCDSBNZIMK` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/QJDMOHVCOVCC` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/SDFINEZEUSJY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/JBHOBXTJWHBC` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DZCJRBFWFYZA` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QZOCMLJMPPWJ` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/VTALPZJYLJOC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/ZMFZRNVVUDDS` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/LBWWWRJNESJS` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/POLQKHGHQJOX` Canada (Central) `arn:aws:controltower:ca-central-1::control/KZXBOOIWPJML` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/CKYIXBAXAMOC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/QNQKBYXYJBFJ` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/JFDNFROBFJFN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/IZGQEIGCNXHB` Europe (Milan) `arn:aws:controltower:eu-south-1::control/RYIQEENSWCYS` Europe (Spain) `arn:aws:controltower:eu-south-2::control/YOIYHUICCMTU` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/XTRYNOHVVRZV` Europe (London) `arn:aws:controltower:eu-west-2::control/WWOBBVWWIGZC` Europe (Paris) `arn:aws:controltower:eu-west-3::control/QHQLZNXRMJAS` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/FWKOVZLJEZYT` Middle East (UAE) `arn:aws:controltower:me-central-1::control/UMMYYVWJNQAU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/TDOBDGWLYPZW` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/UXJNMZSDHBJG` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KBBIQTAMWCXK` US East (Ohio) `arn:aws:controltower:us-east-2::control/WUVIEJDDNZKJ` US West (N. California) `arn:aws:controltower:us-west-1::control/KJPOXHOSICGE` US West (Oregon) `arn:aws:controltower:us-west-2::control/AWZLGRLEJATU`

SH.WAF.2

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.WAF.2	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/VPMFQVAPXVAB` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/BZKJAPBKXOSB` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/DLQOSLPESPJR` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/TMCZBYVXVTJL` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/BCLXTNLCZRSI` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/DLOLIYYVEVKV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/EDZVZKACHXPB` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/MCGLKIFMEWCW` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/YJAUIVTCYRJW` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/HLMADHYTAURN` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/VMRQGTHSYRRP` Canada (Central) `arn:aws:controltower:ca-central-1::control/PGGMESVIZFFP` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/VUYRZBHGKRJU` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/YNDAPXATUIOY` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/CWZKNJZNRAJR` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/ZYSHREMBYDPM` Europe (Milan) `arn:aws:controltower:eu-south-1::control/MOKGMZUMGPBG` Europe (Spain) `arn:aws:controltower:eu-south-2::control/XALTTJQCGLEY` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/HOFUVZWJNCCT` Europe (London) `arn:aws:controltower:eu-west-2::control/CBNPHNXPNMZG` Europe (Paris) `arn:aws:controltower:eu-west-3::control/TJGYMRUITIEJ` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/CVXBKYBYDQDJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LOKCQTQBAPUO` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/HZZYDSEYTKAR` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/SRGTMUGMZWSS` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/HMAUVMDCZUKN` US East (Ohio) `arn:aws:controltower:us-east-2::control/IZERZZJXURES` US West (N. California) `arn:aws:controltower:us-west-1::control/YGFAOMXOUWHM` US West (Oregon) `arn:aws:controltower:us-west-2::control/HVPCLRFIDJZZ`

SH.WAF.3

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.WAF.3	NIST 800-53 Rev 5 AC-4(21) NIST 800-53 Rev 5 SC-7 NIST 800-53 Rev 5 SC-7(11) NIST 800-53 Rev 5 SC-7(16) NIST 800-53 Rev 5 SC-7(21) PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/LVKFNONCWMSM` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/QRUYTUFJJKKF` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/YRQAZZKPDDPI` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/YMBNBHLDYVOC` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/VVDTUQGYLWXK` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/BXSAQBULUHIU` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/VGEDMSLMNPYP` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/TFCNQSIYJFYC` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/CYGNEESCWZXG` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/SBZXDDZAMHDY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/OAFJKQCYMDRD` Canada (Central) `arn:aws:controltower:ca-central-1::control/TEFNOEPILSHB` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/WMEFHVGTULJL` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/VNFBLCXUEWUA` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/GQTWMUCIPTMN` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/HOLXVCBPWTJX` Europe (Milan) `arn:aws:controltower:eu-south-1::control/AQJQJICPISCI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/PGOMVQLIZUCQ` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/LSRTYDUWQTAE` Europe (London) `arn:aws:controltower:eu-west-2::control/MUHOVSWIEMKQ` Europe (Paris) `arn:aws:controltower:eu-west-3::control/YPYYCPXNLRIH` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/UKSABFGHCPMJ` Middle East (UAE) `arn:aws:controltower:me-central-1::control/LZDPYOFSCQGU` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/WWBDWCSNZMPV` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/MDUPXZAXTPRC` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/KONSORMMHUGB` US East (Ohio) `arn:aws:controltower:us-east-2::control/KRWNFORBWIPZ` US West (N. California) `arn:aws:controltower:us-west-1::control/BUWKEMZLQXRX` US West (Oregon) `arn:aws:controltower:us-west-2::control/LUZSILPCBBOK`

SH.WAF.4

Control identifier	Framework	Control objective	Control API identifiers, by Region
SH.WAF.4	NIST 800-53 Rev 5 CA-9(1) NIST 800-53 Rev 5 CM-2 PCI DSS version 3.2.1 6.6	Limit network access	Africa (Cape Town) `arn:aws:controltower:af-south-1::control/UTOKGAPGSDAO` Asia Pacific (Hong Kong) `arn:aws:controltower:ap-east-1::control/TMMPCALNHRVA` Asia Pacific (Tokyo) `arn:aws:controltower:ap-northeast-1::control/BEIGEZGMNWRL` Asia Pacific (Seoul) `arn:aws:controltower:ap-northeast-2::control/IVEPLVNECSLY` Asia Pacific (Osaka) `arn:aws:controltower:ap-northeast-3::control/UDVYMOCFOFYH` Asia Pacific (Mumbai) `arn:aws:controltower:ap-south-1::control/ZGIHYMZBHXMV` Asia Pacific (Hyderabad) `arn:aws:controltower:ap-south-2::control/QGMSDIVQBVTA` Asia Pacific (Singapore) `arn:aws:controltower:ap-southeast-1::control/RWKJOQGECYVA` Asia Pacific (Sydney) `arn:aws:controltower:ap-southeast-2::control/LYLUSATWXWGZ` Asia Pacific (Jakarta) `arn:aws:controltower:ap-southeast-3::control/CJHLCCKMNUFY` Asia Pacific (Melbourne) `arn:aws:controltower:ap-southeast-4::control/FXGZUGXQMLIM` Canada (Central) `arn:aws:controltower:ca-central-1::control/WQQNMFDARNQD` Canada West (Calgary) `arn:aws:controltower:ca-west-1::control/FYLOZMSRDYFC` Europe (Frankfurt) `arn:aws:controltower:eu-central-1::control/FXIUUDQLPOOX` Europe (Zurich) `arn:aws:controltower:eu-central-2::control/ZMDYSTDDADWI` Europe (Stockholm) `arn:aws:controltower:eu-north-1::control/LKOWMMBVXXXZ` Europe (Milan) `arn:aws:controltower:eu-south-1::control/TPTNCHGEEQCI` Europe (Spain) `arn:aws:controltower:eu-south-2::control/ICUMBYQFAKFX` Europe (Ireland) `arn:aws:controltower:eu-west-1::control/KGKFNHJFEKZX` Europe (London) `arn:aws:controltower:eu-west-2::control/XKBUFFXZKSUP` Europe (Paris) `arn:aws:controltower:eu-west-3::control/GTNPVMNBKDAE` Israel (Tel Aviv) `arn:aws:controltower:il-central-1::control/HRGNMSQZYVZH` Middle East (UAE) `arn:aws:controltower:me-central-1::control/KCYLSJYOQLBM` Middle East (Bahrain) `arn:aws:controltower:me-south-1::control/QLAIYZCQNPTP` South America (São Paulo) `arn:aws:controltower:sa-east-1::control/EVTLKICADRVX` US East (N. Virginia) `arn:aws:controltower:us-east-1::control/EDXGDDVAPQUE` US East (Ohio) `arn:aws:controltower:us-east-2::control/ZCXGWVXTGXMV` US West (N. California) `arn:aws:controltower:us-west-1::control/IZXJKPGEKAKL` US West (Oregon) `arn:aws:controltower:us-west-2::control/BFJEJSOYYREH`

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Control availability tables by Region

All global identifiers