CIS AWS Foundations Benchmark and connectors
Which connectors provide evidence for CIS AWS Foundations Benchmark, for which controls, and how to connect them.
Safeguard's automated tests map to 41 recommendations of CIS Amazon Web Services Foundations Benchmark v3.0.0. 41 tests apply: 41 read a connected system, and 0 read Safeguard's own records (policies, people, training and devices), so they need no connector. A passing result is evidence toward a control, not proof that the control is met on its own.
A CIS benchmark is a catalogue mapping: results show on the tests, filters and evidence with their recommendation numbers, and the benchmark is not a framework in your library.
How to connect for this framework
- Connect the systems you run from the table below. Each connector links to its setup steps.
- Open Compliance › Tests and filter by the benchmark to see its results.
- Tests run on their schedule, or straight away with Run now on Compliance › Tests. A passing test counts toward its controls once its preview period has ended.
Automated tests are switched on per workspace by the Safeguard team.
Connectors with automated evidence (1)
| Connector | Controls it provides evidence for | Tests |
|---|---|---|
| Amazon Web Services (also AWS GovCloud, AWS CodeCommit, AWS Inspector, Amazon CloudWatch, Amazon S3, AWS Security Hub) | 1.1, 1.11, 1.13, 1.15, 1.16, 1.17, 1.18, 1.19, 1.2, 1.20, 1.21, 1.22, 1.6, 1.7, 2.1.1, 2.1.2, 2.1.3, 2.3.2, 2.4.1, 3.4, 3.8, 3.9, 4.1, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 5.1, 5.4, 5.6 | 41 |
Recommendations (41)
| Recommendation | Title | Automated tests | Connectors |
|---|---|---|---|
1.1 | Account contact details are current | 1 | 7 |
1.2 | A security contact is registered for the account | 1 | 7 |
1.6 | Root MFA is hardware-backed | 1 | 7 |
1.7 | Root is not used for everyday tasks | 1 | 7 |
1.11 | No unused access key from user setup | 1 | 7 |
1.13 | An IAM user holds at most one active access key | 1 | 7 |
1.15 | IAM users get permissions through groups only | 1 | 7 |
1.16 | No custom policy grants full admin | 1 | 7 |
1.17 | A role can work with AWS Support | 1 | 7 |
1.18 | EC2 instances reach AWS through an instance role | 1 | 7 |
1.19 | Expired IAM server certificates are removed | 1 | 7 |
1.20 | Access Analyzer is on in every region | 1 | 7 |
1.21 | People sign in through federation | 1 | 7 |
1.22 | CloudShell full access is restricted | 1 | 7 |
2.1.1 | S3 bucket policies deny non-TLS requests | 1 | 7 |
2.1.2 | MFA Delete on S3 buckets | 1 | 7 |
2.1.3 | Macie discovers sensitive S3 data | 1 | 7 |
2.3.2 | RDS instances apply minor engine upgrades automatically | 1 | 7 |
2.4.1 | EFS is encrypted at rest | 1 | 7 |
3.4 | The CloudTrail bucket has access logging | 1 | 7 |
3.8 | S3 object writes are logged | 1 | 7 |
3.9 | S3 object reads are logged | 1 | 7 |
4.1 | Unauthorized API calls are alerted on | 1 | 7 |
4.2 | Console sign-in without MFA is alerted on | 1 | 7 |
4.3 | Root user activity is alerted on | 1 | 7 |
4.4 | IAM policy changes are alerted on | 1 | 7 |
4.5 | CloudTrail configuration changes are alerted on | 1 | 7 |
4.6 | Failed console sign-ins are alerted on | 1 | 7 |
4.7 | Disabling or deleting a customer-managed key is alerted on | 1 | 7 |
4.8 | S3 bucket policy changes are alerted on | 1 | 7 |
4.9 | AWS Config changes are alerted on | 1 | 7 |
4.10 | Security group changes are alerted on | 1 | 7 |
4.11 | Network ACL changes are alerted on | 1 | 7 |
4.12 | Network gateway changes are alerted on | 1 | 7 |
4.13 | Route table changes are alerted on | 1 | 7 |
4.14 | VPC changes are alerted on | 1 | 7 |
4.15 | AWS Organizations changes are alerted on | 1 | 7 |
4.16 | Security Hub is enabled | 1 | 7 |
5.1 | Network ACLs block internet admin ports | 1 | 7 |
5.4 | Default security groups allow no traffic | 1 | 7 |
5.6 | Instance metadata requires session tokens (IMDSv2) | 1 | 7 |
CIS Oracle Cloud Infrastructure Foundations Benchmark and connectors
Which connectors provide evidence for CIS Oracle Cloud Infrastructure Foundations Benchmark, for which controls, and how to connect them.
CIS Microsoft Azure Foundations Benchmark and connectors
Which connectors provide evidence for CIS Microsoft Azure Foundations Benchmark, for which controls, and how to connect them.