@cyberstrike-io/cyberstrike 1.1.9 → 1.1.10-beta.1

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.10/SKILL.md

@@ -0,0 +1,106 @@
+---
+name: cis-aws-compute-2.10
+description: "Ensure unused ENIs are removed"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, eni, network-interfaces, unused, cleanup]
+cis_id: "2.10"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.7, cis-aws-compute-2.2.4]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure unused ENIs are removed
+
+## Description
+
+Identify and delete any unused Amazon AWS Elastic Network Interfaces in order to adhere to best practices and to avoid reaching the service limit. An AWS Elastic Network Interface (ENI) is pronounced unused when is not attached anymore to an EC2 instance.
+
+## Rationale
+
+Removing unused ENIs helps maintain a clean environment, reduces potential attack surface, and avoids reaching service limits.
+
+## Impact
+
+Deleting an ENI is permanent. Ensure the ENI is truly unused before removal.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run describe-network-interfaces command:
+
+```bash
+aws ec2 describe-network-interfaces --region us-east-1 --output json --filters Name=status,Values=available --query "NetworkInterfaces[*].{ENI:NetworkInterfaceId}"
+```
+
+2. The command output should return an empty list if no unused ENIs exist.
+3. If there is a list of ENI IDs then refer to the remediation below.
+4. Repeat steps 1 - 3 to determine the current status for any other `ENIs` within the current region.
+
+NOTE Repeat the audit process for all other regions used.
+
+### Using AWS Console
+
+1. Login to EC2 using https://console.aws.amazon.com/ec2/
+2. On the left Click `NETWORK & SECURITY`, click `Network Interfaces`.
+3. Select the ENI that you want to review.
+4. Go to the Details tab.
+5. Check the value set for the Status attribute.
+6. If it says `available`, refer to the remediation below.
+7. Repeat steps 3 - 6 to determine the current status for any other `ENIs` within the current region.
+
+NOTE Repeat the audit process for all other regions used.
+
+## Expected Result
+
+The CLI command should return an empty list, indicating no ENIs are in the `available` (unattached) state.
+
+## Remediation
+
+### Using AWS CLI
+
+1. Run the delete-network-interface command with the ENI names collected above in the audit:
+
+```bash
+aws ec2 delete-network-interface --region us-east-1 --network-interface-id eni-1234abcd
+```
+
+2. This will remove the ENI that is not being used.
+3. Repeat steps 1 - 2 for any `ENIs` within the current region.
+
+NOTE Repeat the audit process for all other regions used.
+
+### Using AWS Console
+
+1. Login to EC2 using https://console.aws.amazon.com/ec2/
+2. On the left Click `NETWORK & SECURITY`, click `Network Interfaces`.
+3. Select the ENI that you want to remove.
+4. Click 'Actions', then 'delete'.
+5. Click `Delete`.
+6. Repeat steps 3 - 5 any other `ENIs` listed in the audit within the current region.
+
+NOTE Repeat the audit process for all other regions used.
+
+## Default Value
+
+ENIs are not automatically cleaned up when detached from instances.
+
+## References
+
+No specific references provided in the benchmark for this control.
+
+## CIS Controls
+
+| Controls Version | Control                                                            | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------------------------ | ---- | ---- | ---- |
+| v8               | 12.2 Establish and Maintain a Secure Network Architecture          |      | x    | x    |
+| v7               | 11.1 Maintain Standard Security Configurations for Network Devices |      | x    | x    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.11/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: cis-aws-compute-2.11
+description: "Ensure instances stopped for over 90 days are removed"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, stopped-instances, cleanup, lifecycle]
+cis_id: "2.11"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.5, cis-aws-compute-2.12]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure instances stopped for over 90 days are removed
+
+## Description
+
+Enable this rule to help with the baseline configuration of Amazon Elastic Compute Cloud (Amazon EC2) instances by checking whether Amazon EC2 instances have been stopped for more than the allowed number of days, according to your organization's standards.
+
+## Rationale
+
+Stopped instances that are no longer needed consume resources and may contain outdated configurations or unpatched software. Removing them reduces the attack surface and management overhead.
+
+## Impact
+
+Terminating instances is irreversible. Ensure data on the instance is backed up or no longer needed before termination.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+No specific CLI audit command is provided for this control. Use the console method below.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, click `Instances`, click `Instances`.
+3. Select the Instance for review.
+4. Under the `Details` tab.
+5. Review the `Launch time`.
+
+If the `Launch time` of the selected Instance is greater than 90 days, the Instance has been offline and is considered outdated.
+
+6. Repeat steps no. 3 - 5 to verify the Launch date for the other instances.
+
+Repeat all steps for the other regions.
+Refer to the remediation procedure below if any of the `Launch times` are over 90 days.
+
+## Expected Result
+
+No stopped instances should have a Launch time older than 90 days. All stopped instances beyond this threshold should be terminated.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided for this control. Use the console method below.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, click `Instances`, click `Instances`.
+3. Select the Instance for that hasn't been used for over 90 days.
+4. Under the `Details` tab.
+5. Click `Instance state`, click `Terminate instance`.
+6. Click `Terminate`.
+
+7. Repeat steps no. 3 - 6 the other instances with a launch date equal to or over 90 days.
+
+Repeat all steps for the other regions.
+
+## Default Value
+
+AWS does not automatically terminate stopped instances. They remain in the stopped state indefinitely unless terminated.
+
+## References
+
+1. https://docs.aws.amazon.com/config/latest/developerguide/ec2-stopped-instance.html
+
+## CIS Controls
+
+| Controls Version | Control                                                        | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 1.1 Establish and Maintain Detailed Enterprise Asset Inventory | x    | x    | x    |
+| v7               | 1.4 Maintain Detailed Asset Inventory                          | x    | x    | x    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.12/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: cis-aws-compute-2.12
+description: "Ensure EBS volumes attached to an EC2 instance are marked for deletion upon instance termination"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ebs, delete-on-termination, lifecycle]
+cis_id: "2.12"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.2.4, cis-aws-compute-2.11]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure EBS volumes attached to an EC2 instance are marked for deletion upon instance termination
+
+## Description
+
+This rule ensures that Amazon Elastic Block Store volumes that are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances are marked for deletion when an instance is terminated. If an Amazon EBS volume isn't deleted when the instance that it's attached to is terminated, it may violate the concept of least functionality.
+
+## Rationale
+
+Orphaned EBS volumes after instance termination can contain sensitive data and increase costs. Marking volumes for deletion on termination ensures cleanup.
+
+## Impact
+
+Data on the EBS volume will be permanently lost when the instance is terminated. Ensure important data is backed up before enabling this setting.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run the describe-instances command:
+
+```bash
+aws ec2 describe-instances --region us-east-1 --output json --filters "Name=block-device-mapping.delete-on-termination,Values=false" --query "Reservations[*].Instances[*].{Instance:InstanceId}"
+```
+
+2. The output should be a list of instances that have not set 'Delete on termination'.
+3. Make note of the list of instance ids and refer to the remediation below.
+4. Repeat steps no. 1 -3 with the other `AWS regions`.
+
+### Using AWS Console
+
+1. Login to EC2 using https://console.aws.amazon.com/ec2/
+2. On the left Click `INSTANCES`, click `Instances`.
+3. Select the `EC2 instance` you want to review.
+4. Select the `Storage` tab.
+5. Scroll down until you reach the 'Volume ID' and review the setting for 'Delete on termination'.
+6. If the value is set to `No` refer to the remediation below.
+7. Repeat steps no. 3 - 6 to verify the setting.
+8. Go through the other `AWS regions` and repeat the audit process for all instances.
+
+## Expected Result
+
+The CLI command should return an empty list, indicating all EBS volumes attached to instances have `DeleteOnTermination` set to `true`.
+
+## Remediation
+
+### Using AWS CLI
+
+1. Run the modify-instance-attribute command using the list of instances collected in the audit:
+
+```bash
+aws ec2 modify-instance-attribute --instance-id i-123456abcdefghi0 --block-device-mappings "[{\"DeviceName\": \"/dev/sda\",\"Ebs\":{\"DeleteOnTermination\":true}}]"
+```
+
+2. Repeat steps no. 1 with the other instances discovered in all `AWS regions`.
+
+**Note:** If you get any errors running the modify-instance-attribute command confirm the instance id and the Device Name for that instance is correct. The above command is referencing the typical default device name.
+
+### Using AWS Console
+
+1. At this time the `delete on termination` setting for existing instances can only be changed using AWS CLI.
+
+## Default Value
+
+By default, the root EBS volume is marked for deletion on termination, but additional attached volumes are not.
+
+## References
+
+1. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html
+2. https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
+
+## CIS Controls
+
+| Controls Version | Control                                                        | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 1.1 Establish and Maintain Detailed Enterprise Asset Inventory | x    | x    | x    |
+| v7               | 1.4 Maintain Detailed Asset Inventory                          | x    | x    | x    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.13/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: cis-aws-compute-2.13
+description: "Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, user-data, secrets, sensitive-data, secrets-manager]
+cis_id: "2.13"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.8]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data
+
+## Description
+
+User Data can be specified when launching an ec2 instance. Examples include specifying parameters for configuring the instance or including a simple script.
+
+## Rationale
+
+The user data is not protected by authentication or cryptographic methods. Therefore, sensitive data, such as passwords or long-lived encryption keys should not be stored as user data.
+
+## Impact
+
+Anyone who has access to the instance and configuration can view the user data. Removing secrets from user data may require changes to instance bootstrapping processes.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run `aws ec2 describe-instances` to retrieve information about all instances in the AWS region. The output will include instance ids.
+
+2. Run `aws ec2 describe-instance-attribute` for each instance in AWS account:
+
+```bash
+aws ec2 describe-instance-attribute --instance-id "ID of instance" --attribute userData
+```
+
+Note: User Data may be Base64 encoded. Decode the output as necessary.
+
+3. Review user data to ensure no secrets or sensitive information are stored.
+4. Repeat the Audit for all the other AWS regions.
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com
+2. Click `All services` and click `EC2` under Compute.
+3. Click on `Instances`.
+4. For each instance, click `Actions` -> `Instance Settings` -> `Edit user data`.
+5. For each instance, review the user data to ensure there are no secrets or sensitive data stored.
+6. If secrets or sensitive data is found, refer to the remediation below.
+7. Repeat steps 2-7 for all regions used.
+
+## Expected Result
+
+No EC2 instance user data should contain secrets, passwords, API keys, or other sensitive information. User data should only contain non-sensitive configuration parameters or scripts that retrieve secrets from a secure source like AWS Secrets Manager.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided for this control. Use the console method below.
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com
+2. Click `All services` and click `EC2` under Compute.
+3. Click on `Instances`.
+4. If the instance is currently running, stop the instance first.
+
+Note: ensure there is no negative impact from stopping the instance prior to stopping the instance.
+
+5. For each instance, click `Actions` -> `Instance Settings` -> `Edit user data`.
+6. For each instance, edit the user data to ensure there are no secrets or sensitive data stored. A Secret Management solution such as AWS Secrets Manager can be used here as a more secure mechanism of storing necessary sensitive data.
+7. Repeat this remediation for all the other AWS regions.
+
+Note: If the ec2 instances are created via automation or infrastructure-as-code, edit the user data in those pipelines and code.
+
+## Default Value
+
+EC2 user data is empty by default unless specified during instance launch.
+
+## References
+
+1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
+
+## CIS Controls
+
+| Controls Version | Control                                     | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.2 Establish and Maintain a Data Inventory | x    | x    | x    |
+| v8               | 3.3 Configure Data Access Control Lists     | x    | x    | x    |
+| v7               | 1.5 Maintain Asset Inventory Information    |      | x    | x    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.14/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: cis-aws-compute-2.14
+description: "Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, auto-scaling, tags, propagation, compliance]
+cis_id: "2.14"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.3, cis-aws-compute-2.4]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches
+
+## Description
+
+Tags can help with managing, identifying, organizing, searching for, and filtering resources. Additionally, tags can help with security and compliance. Tags can be propagated from an Auto Scaling group to the EC2 instances that it launches.
+
+## Rationale
+
+Without tags, EC2 instances created via Auto Scaling can be without tags and could be out of compliance with security policy.
+
+## Impact
+
+No negative impact. Enabling tag propagation ensures all instances launched by Auto Scaling groups inherit the group's tags automatically.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run `aws autoscaling describe-auto-scaling-groups`:
+
+```bash
+aws autoscaling describe-auto-scaling-groups
+```
+
+2. Ensure `PropagateAtLaunch` is `true` under `Tags` for each Tag for the Auto Scaling Group.
+3. Repeat Steps 1-2 for each AWS Region used.
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com
+2. Click All services and click EC2 under Compute.
+3. Select Auto Scaling Groups.
+4. For each Auto Scaling Group's Details, ensure that all tags have `Tag new instances` set to `Yes`.
+5. Repeat Steps 1-4 for each AWS Region used.
+
+## Expected Result
+
+All tags in every Auto Scaling Group should have `PropagateAtLaunch` set to `true`. In the console, all tags should show `Tag new instances` set to `Yes`.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided for this control. Use the console method below.
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com
+2. Click All services and click EC2 under Compute.
+3. Select Auto Scaling Groups.
+4. Click `Edit` for each Auto Scaling Group.
+5. Check the `Tag new instances` Box for the Auto Scaling Group.
+6. Click `Update`.
+7. Repeat Steps 1-6 for each AWS Region used.
+
+## Default Value
+
+By default, Auto Scaling group tags are not automatically propagated to launched instances unless `PropagateAtLaunch` is set to `true`.
+
+## References
+
+No specific references provided in the benchmark for this control.
+
+## CIS Controls
+
+| Controls Version | Control                    | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------- | ---- | ---- | ---- |
+| v7               | 5.2 Maintain Secure Images |      | x    | x    |
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.2.1/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: cis-aws-compute-2.2.1
+description: "Ensure EBS volume encryption is enabled"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ebs, encryption, volumes]
+cis_id: "2.2.1"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.2, cis-aws-compute-2.2.3]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure EBS volume encryption is enabled
+
+## Description
+
+Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.
+
+## Rationale
+
+Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.
+
+## Impact
+
+Enabling EBS encryption by default applies to all new volumes. Existing unencrypted volumes are not affected. This is configured per region.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run:
+
+```bash
+aws --region <region> ec2 get-ebs-encryption-by-default
+```
+
+2. Verify that `"EbsEncryptionByDefault": true` is displayed.
+3. Review every region in-use.
+
+Note: EBS volume encryption is configured per region.
+
+### Using AWS Console
+
+1. Login to the EC2 console using https://console.aws.amazon.com/ec2/
+2. Under `Account attributes`, click `EBS encryption`.
+3. Verify `Always encrypt new EBS volumes` displays `Enabled`.
+4. Review every region in-use.
+
+Note: EBS volume encryption is configured per region.
+
+## Expected Result
+
+The CLI should return `"EbsEncryptionByDefault": true` for every region in use. In the console, `Always encrypt new EBS volumes` should display `Enabled`.
+
+## Remediation
+
+### Using AWS CLI
+
+1. Run:
+
+```bash
+aws --region <region> ec2 enable-ebs-encryption-by-default
+```
+
+2. Verify that `"EbsEncryptionByDefault": true` is displayed.
+3. Repeat every region requiring the change.
+
+Note: EBS volume encryption is configured per region.
+
+### Using AWS Console
+
+1. Login to the EC2 console using https://console.aws.amazon.com/ec2/
+2. Under `Account attributes`, click `EBS encryption`.
+3. Click `Manage`.
+4. Click the `Enable` checkbox.
+5. Click `Update EBS encryption`.
+6. Repeat for every region requiring the change.
+
+Note: EBS volume encryption is configured per region.
+
+## Default Value
+
+EBS encryption by default is disabled. It must be explicitly enabled per region.
+
+## References
+
+1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
+2. https://aws.amazon.com/blogs/aws/new-opt-in-to-default-encryption-for-new-ebs-volumes/
+3. AWS Config rule - ec2_ebs_encryption_by_default
+
+## CIS Controls
+
+| Controls Version | Control                                    | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------ | ---- | ---- | ---- |
+| v8               | 3.11 Encrypt Sensitive Data at Rest        |      | x    | x    |
+| v7               | 14.8 Encrypt Sensitive Information at Rest |      |      | x    |
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.2.2/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: cis-aws-compute-2.2.2
+description: "Ensure Public Access to EBS Snapshots is Disabled"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ebs, snapshots, public-access, permissions]
+cis_id: "2.2.2"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.5, cis-aws-compute-2.2.3, cis-aws-compute-2.2.4]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Public Access to EBS Snapshots is Disabled
+
+## Description
+
+To protect your data disable the public mode of EBS snapshots.
+
+## Rationale
+
+This protects your data so that it is not accessible to all AWS accounts preventing accidental access and leaks.
+
+## Impact
+
+Removing public access from EBS snapshots may affect other AWS accounts that rely on them. Ensure private sharing is configured for any authorized accounts.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. For each snapshot, run:
+
+```bash
+aws ec2 describe-snapshot-attribute \
+    --snapshot-id <snapshot-ID> \
+    --attribute createVolumePermission
+```
+
+2. Validate `Group` is not set to all.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click `Snapshots`.
+3. Select the `snapshot` then click `Actions, Modify Permissions`.
+4. Confirm that the snapshot is set to `Private`.
+5. Repeat for any additional Snapshots, Regions and AWS accounts.
+
+If the snapshot is set to public refer to the remediation below.
+
+## Expected Result
+
+The createVolumePermission attribute should not contain a Group set to "all". In the console, all snapshots should show as Private.
+
+## Remediation
+
+### Using AWS CLI
+
+1. For each snapshot, run:
+
+```bash
+aws ec2 modify-snapshot-attribute \
+    --snapshot-id <snapshot-ID> \
+    --attribute createVolumePermission \
+    --operation remove --group-name all
+```
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click `Snapshots`.
+3. Select the `snapshot` then click 'Actions, Modify Permissions'.
+4. Click the radio button for `Private`.
+5. Click `Save`.
+6. Repeat for any additional Snapshots, Regions and AWS accounts.
+
+## Default Value
+
+By default, EBS snapshots are private when created.
+
+## References
+
+1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html
+2. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshot-attribute.html
+
+## Additional Information
+
+1. Snapshots are constrained to the Region in which they were created. To share a snapshot with another Region, copy the snapshot to that Region.
+2. AWS prevents you from sharing snapshots that were encrypted with your default CMK. Snapshots that you intend to share must instead be encrypted with a customer managed CMK.
+3. The public option is not valid for encrypted snapshots or snapshots with an AWS Marketplace product code.
+
+## CIS Controls
+
+| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
+| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.3 Configure Data Access Control Lists               | x    | x    | x    |
+| v7               | 14.6 Protect Information through Access Control Lists | x    | x    | x    |
+
+## Profile
+
+Level 1 | Automated