CIS AWS Foundations Benchmark
The Center for Internet Security (CIS) AWS Foundations Benchmark serves as a set of security configuration best practices for AWS. These industry-accepted best practices provide you with clear, step-by-step implementation and assessment procedures. Ranging from operating systems to cloud services and network devices, the controls in this benchmark help you protect the specific systems that your organization uses.
AWS Security Hub supports CIS AWS Foundations Benchmark v3.0.0, 1.4.0, and v1.2.0.
This page lists the security controls that each version supports and provides a comparison of the versions.
CIS AWS Foundations Benchmark v3.0.0
Security Hub supports version 3.0.0 of the CIS AWS Foundations Benchmark.
Security Hub has satisfied the requirements of CIS Security Software Certification and has been awarded CIS Security Software Certification for the following CIS Benchmarks:
-
CIS Benchmark for CIS AWS Foundations Benchmark, v3.0.0, Level 1
-
CIS Benchmark for CIS AWS Foundations Benchmark, v3.0.0, Level 2
Controls that apply to CIS AWS Foundations Benchmark v3.0.0
[Account.1] Security contact information should be provided for an AWS account
[CloudTrail.2] CloudTrail should have encryption at-rest enabled
[CloudTrail.4] CloudTrail log file validation should be enabled
[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
[Config.1] AWS Config should be enabled and use the service-linked role for resource recording
[EC2.2] VPC default security groups should not allow inbound or outbound traffic
[EC2.6] VPC flow logging should be enabled in all VPCs
[EC2.7] EBS default encryption should be enabled
[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)
[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389
[EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS
[IAM.2] IAM users should not have IAM policies attached
[IAM.3] IAM users' access keys should be rotated every 90 days or less
[IAM.4] IAM root user access key should not exist
[IAM.5] MFA should be enabled for all IAM users that have a console password
[IAM.6] Hardware MFA should be enabled for the root user
[IAM.9] MFA should be enabled for the root user
[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater
[IAM.16] Ensure IAM password policy prevents password reuse
[IAM.18] Ensure a support role has been created to manage incidents with AWS Support
[IAM.22] IAM user credentials unused for 45 days should be removed
[IAM.26] Expired SSL/TLS certificates managed in IAM should be removed
[IAM.27] IAM identities should not have the AWSCloudShellFullAccess policy attached
[IAM.28] IAM Access Analyzer external access analyzer should be enabled
[KMS.4] AWS KMS key rotation should be enabled
[RDS.3] RDS DB instances should have encryption at-rest enabled
[RDS.13] RDS automatic minor version upgrades should be enabled
[S3.1] S3 general purpose buckets should have block public access settings enabled
[S3.5] S3 general purpose buckets should require requests to use SSL
[S3.8] S3 general purpose buckets should block public access
[S3.20] S3 general purpose buckets should have MFA delete enabled
[S3.22] S3 general purpose buckets should log object-level write events
[S3.23] S3 general purpose buckets should log object-level read events
CIS AWS Foundations Benchmark v1.4.0
Security Hub supports v1.4.0 of the CIS AWS Foundations Benchmark.
Controls that apply to CIS AWS Foundations Benchmark v1.4.0
[CloudTrail.2] CloudTrail should have encryption at-rest enabled
[CloudTrail.4] CloudTrail log file validation should be enabled
[CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs
[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible
[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
[CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user
[CloudWatch.4] Ensure a log metric filter and alarm exist for IAM policy changes
[CloudWatch.5] Ensure a log metric filter and alarm exist for CloudTrail AWS Configuration changes
[CloudWatch.8] Ensure a log metric filter and alarm exist for S3 bucket policy changes
[CloudWatch.9] Ensure a log metric filter and alarm exist for AWS Config configuration changes
[CloudWatch.10] Ensure a log metric filter and alarm exist for security group changes
[CloudWatch.12] Ensure a log metric filter and alarm exist for changes to network gateways
[CloudWatch.13] Ensure a log metric filter and alarm exist for route table changes
[CloudWatch.14] Ensure a log metric filter and alarm exist for VPC changes
[Config.1] AWS Config should be enabled and use the service-linked role for resource recording
[EC2.2] VPC default security groups should not allow inbound or outbound traffic
[EC2.6] VPC flow logging should be enabled in all VPCs
[EC2.7] EBS default encryption should be enabled
[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389
[IAM.1] IAM policies should not allow full "*" administrative privileges
[IAM.3] IAM users' access keys should be rotated every 90 days or less
[IAM.4] IAM root user access key should not exist
[IAM.5] MFA should be enabled for all IAM users that have a console password
[IAM.6] Hardware MFA should be enabled for the root user
[IAM.9] MFA should be enabled for the root user
[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater
[IAM.16] Ensure IAM password policy prevents password reuse
[IAM.18] Ensure a support role has been created to manage incidents with AWS Support
[IAM.22] IAM user credentials unused for 45 days should be removed
[KMS.4] AWS KMS key rotation should be enabled
[RDS.3] RDS DB instances should have encryption at-rest enabled
[S3.1] S3 general purpose buckets should have block public access settings enabled
[S3.5] S3 general purpose buckets should require requests to use SSL
[S3.8] S3 general purpose buckets should block public access
[S3.20] S3 general purpose buckets should have MFA delete enabled
Center for Internet Security (CIS) AWS Foundations Benchmark v1.2.0
Security Hub supports version 1.2.0 of the CIS AWS Foundations Benchmark.
Security Hub has satisfied the requirements of CIS Security Software Certification and has been awarded CIS Security Software Certification for the following CIS Benchmarks:
-
CIS Benchmark for CIS AWS Foundations Benchmark, v1.2.0, Level 1
-
CIS Benchmark for CIS AWS Foundations Benchmark, v1.2.0, Level 2
Controls that apply to CIS AWS Foundations Benchmark v1.2.0
[CloudTrail.2] CloudTrail should have encryption at-rest enabled
[CloudTrail.4] CloudTrail log file validation should be enabled
[CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs
[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible
[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
[CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user
[CloudWatch.2] Ensure a log metric filter and alarm exist for unauthorized API calls
[CloudWatch.3] Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
[CloudWatch.4] Ensure a log metric filter and alarm exist for IAM policy changes
[CloudWatch.5] Ensure a log metric filter and alarm exist for CloudTrail AWS Configuration changes
[CloudWatch.8] Ensure a log metric filter and alarm exist for S3 bucket policy changes
[CloudWatch.9] Ensure a log metric filter and alarm exist for AWS Config configuration changes
[CloudWatch.10] Ensure a log metric filter and alarm exist for security group changes
[CloudWatch.12] Ensure a log metric filter and alarm exist for changes to network gateways
[CloudWatch.13] Ensure a log metric filter and alarm exist for route table changes
[CloudWatch.14] Ensure a log metric filter and alarm exist for VPC changes
[Config.1] AWS Config should be enabled and use the service-linked role for resource recording
[EC2.2] VPC default security groups should not allow inbound or outbound traffic
[EC2.6] VPC flow logging should be enabled in all VPCs
[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22
[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389
[IAM.1] IAM policies should not allow full "*" administrative privileges
[IAM.2] IAM users should not have IAM policies attached
[IAM.3] IAM users' access keys should be rotated every 90 days or less
[IAM.4] IAM root user access key should not exist
[IAM.5] MFA should be enabled for all IAM users that have a console password
[IAM.6] Hardware MFA should be enabled for the root user
[IAM.8] Unused IAM user credentials should be removed
[IAM.9] MFA should be enabled for the root user
[IAM.11] Ensure IAM password policy requires at least one uppercase letter
[IAM.12] Ensure IAM password policy requires at least one lowercase letter
[IAM.13] Ensure IAM password policy requires at least one symbol
[IAM.14] Ensure IAM password policy requires at least one number
[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater
[IAM.16] Ensure IAM password policy prevents password reuse
[IAM.17] Ensure IAM password policy expires passwords within 90 days or less
[IAM.18] Ensure a support role has been created to manage incidents with AWS Support
[KMS.4] AWS KMS key rotation should be enabled
Version comparison for CIS AWS Foundations Benchmark
This section summarizes the differences among the Center for Internet Security (CIS) AWS Foundations Benchmark v3.0.0, v1.4.0, and v1.2.0.
Security Hub supports each of these versions of the CIS AWS Foundations Benchmark, but we recommend using v3.0.0 to stay current on security best practices. You can have multiple versions of the standard enabled at the same time. For instructions on enabling standards, see Enabling a security standard in Security Hub. If you want to upgrade to v3.0.0, it's best to enable it first before disabling an older version. If you use the Security Hub integration with AWS Organizations to centrally manage multiple AWS accounts and you want to batch enable v3.0.0 across all accounts, you can use central configuration.
Mapping of controls to CIS requirements in each version
Understand which controls each version of the CIS AWS Foundations Benchmark supports.
ARNs for CIS AWS Foundations Benchmark
When you enable one or more versions of CIS AWS Foundations Benchmark, you'll begin receiving findings in the AWS Security Finding Format (ASFF). In ASFF, each version uses the following Amazon Resource Name (ARN):
- CIS AWS Foundations Benchmark v3.0.0
arn:aws:securityhub:region::standards/cis-aws-foundations-benchmark/v/3.0.0- CIS AWS Foundations Benchmark v1.4.0
arn:aws:securityhub:region::standards/cis-aws-foundations-benchmark/v/1.4.0- CIS AWS Foundations Benchmark v1.2.0
arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0
You can use the GetEnabledStandards operation of the Security Hub API to find out the ARN of an enabled standard.
The preceding values are for StandardsArn. However, StandardsSubscriptionArn refers to the
standard subscription resource that Security Hub creates when you subscribe to a standard by calling BatchEnableStandards in a Region.
Note
When you enable a version of CIS AWS Foundations Benchmark, Security Hub may take up to 18 hours to generate findings for controls that use the same AWS Config service-linked rule as enabled controls in other enabled standards. For more information about the schedule for generating control findings, see Schedule for running security checks.
Finding fields differ if you turn on consolidated control findings. For more information about these differences, see Impact of consolidation on ASFF fields and values. For sample control findings, see Sample control findings in Security Hub.
CIS requirements that aren't supported in Security Hub
As noted in the preceding table, Security Hub doesn't support every CIS requirement in every version of the CIS AWS Foundations Benchmark. Many of the unsupported requirements can be evaluated only manually by reviewing the state of your AWS resources.
