aws-cis-controls-assessment 1.0.3__py3-none-any.whl

aws_cis_assessment/config/rules/cis_controls_ig1.yaml

@@ -0,0 +1,590 @@
+implementation_group: IG1
+total_rules: 74
+description: Essential cyber hygiene - foundational safeguards for all enterprises
+controls:
+  '1.1':
+    title: Establish and Maintain Detailed Enterprise Asset Inventory
+    weight: 1.0
+    config_rules:
+    - name: eip-attached
+      resource_types:
+      - AWS::EC2::EIP
+      parameters: {}
+      description: Assessment for eip-attached Config rule - ensures Elastic IPs are
+        attached.
+      remediation_guidance: Follow AWS Config rule guidance for eip-attached
+    - name: ec2-stopped-instance
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: Assessment for ec2-stopped-instance Config rule - checks for long-stopped
+        instances.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-stopped-instance
+    - name: vpc-network-acl-unused-check
+      resource_types:
+      - AWS::EC2::NetworkAcl
+      parameters: {}
+      description: Assessment for vpc-network-acl-unused-check Config rule - ensures
+        NACLs are in use.
+      remediation_guidance: Follow AWS Config rule guidance for vpc-network-acl-unused-check
+    - name: ec2-instance-managed-by-systems-manager
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: Assessment for ec2-instance-managed-by-systems-manager Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-instance-managed-by-systems-manager
+    - name: ec2-security-group-attached-to-eni
+      resource_types:
+      - AWS::EC2::SecurityGroup
+      parameters: {}
+      description: Assessment for ec2-security-group-attached-to-eni Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-security-group-attached-to-eni
+  '1.5':
+    title: Control 1.5
+    weight: 1.0
+    config_rules:
+    - name: root-account-hardware-mfa-enabled
+      resource_types:
+      - AWS::IAM::Root
+      parameters: {}
+      description: Assessment for root-account-hardware-mfa-enabled AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for root-account-hardware-mfa-enabled
+  '11.2':
+    title: Control 11.2
+    weight: 1.0
+    config_rules:
+    - name: ebs-optimized-instance
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: Assessment for ebs-optimized-instance AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ebs-optimized-instance
+    - name: dynamodb-in-backup-plan
+      resource_types:
+      - AWS::DynamoDB::Table
+      parameters: {}
+      description: Assessment for dynamodb-in-backup-plan AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for dynamodb-in-backup-plan
+    - name: ebs-in-backup-plan
+      resource_types:
+      - AWS::EC2::Volume
+      parameters: {}
+      description: Assessment for ebs-in-backup-plan AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ebs-in-backup-plan
+    - name: efs-in-backup-plan
+      resource_types:
+      - AWS::EFS::FileSystem
+      parameters: {}
+      description: Assessment for efs-in-backup-plan AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for efs-in-backup-plan
+    - name: db-instance-backup-enabled
+      resource_types:
+      - AWS::RDS::DBInstance
+      parameters: {}
+      description: Assessment for db-instance-backup-enabled AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for db-instance-backup-enabled
+    - name: redshift-backup-enabled
+      resource_types:
+      - AWS::Redshift::Cluster
+      parameters: {}
+      description: Assessment for redshift-backup-enabled AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for redshift-backup-enabled
+    - name: dynamodb-pitr-enabled
+      resource_types:
+      - AWS::DynamoDB::Table
+      parameters: {}
+      description: Assessment for dynamodb-pitr-enabled AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for dynamodb-pitr-enabled
+    - name: elasticache-redis-cluster-automatic-backup-check
+      resource_types:
+      - AWS::ElastiCache::CacheCluster
+      parameters: {}
+      description: Assessment for elasticache-redis-cluster-automatic-backup-check
+        AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for elasticache-redis-cluster-automatic-backup-check
+    - name: s3-bucket-replication-enabled
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: Assessment for s3-bucket-replication-enabled AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-replication-enabled
+  '12.2':
+    title: Control 12.2
+    weight: 1.0
+    config_rules:
+    - name: vpc-default-security-group-closed
+      resource_types:
+      - AWS::EC2::SecurityGroup
+      parameters: {}
+      description: "CIS Control 12.2 - Establish and Maintain a Secure Network Architecture\n\
+        \    AWS Config Rule: vpc-default-security-group-closed\n    \n    Ensures\
+        \ default security groups restrict all traffic to prevent accidental exposure."
+      remediation_guidance: Follow AWS Config rule guidance for vpc-default-security-group-closed
+    - name: restricted-ssh
+      resource_types:
+      - AWS::EC2::SecurityGroup
+      parameters: {}
+      description: "CIS Control 12.2 - Establish and Maintain a Secure Network Architecture\n\
+        \    AWS Config Rule: restricted-ssh\n    \n    Ensures security groups do\
+        \ not allow unrestricted SSH access from 0.0.0.0/0."
+      remediation_guidance: Follow AWS Config rule guidance for restricted-ssh
+  '2.2':
+    title: Ensure Authorized Software is Currently Supported
+    weight: 1.0
+    config_rules:
+    - name: elastic-beanstalk-managed-updates-enabled
+      resource_types:
+      - AWS::ElasticBeanstalk::Environment
+      parameters: {}
+      description: Assessment for elastic-beanstalk-managed-updates-enabled Config
+        rule.
+      remediation_guidance: Follow AWS Config rule guidance for elastic-beanstalk-managed-updates-enabled
+    - name: ecs-fargate-latest-platform-version
+      resource_types:
+      - AWS::ECS::Service
+      parameters: {}
+      description: Assessment for ecs-fargate-latest-platform-version Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ecs-fargate-latest-platform-version
+  2.2.1:
+    title: Control 2.2.1
+    weight: 1.0
+    config_rules:
+    - name: opensearch-in-vpc-only
+      resource_types:
+      - AWS::OpenSearch::Domain
+      parameters: {}
+      description: Assessment for opensearch-in-vpc-only AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for opensearch-in-vpc-only
+  '3.10':
+    title: Encrypt Sensitive Data in Transit
+    weight: 1.0
+    config_rules:
+    - name: elasticsearch-node-to-node-encryption-check
+      resource_types:
+      - AWS::Elasticsearch::Domain
+      parameters: {}
+      description: Assessment for elasticsearch-node-to-node-encryption-check AWS
+        Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for elasticsearch-node-to-node-encryption-check
+  '3.11':
+    title: Encrypt Sensitive Data at Rest
+    weight: 1.0
+    config_rules:
+    - name: cloudwatch-log-group-encrypted
+      resource_types:
+      - AWS::Logs::LogGroup
+      parameters: {}
+      description: "CIS Control 3.11 - Encrypt Sensitive Data at Rest\n    AWS Config\
+        \ Rule: cloudwatch-log-group-encrypted\n    \n    Ensures CloudWatch Log Groups\
+        \ are encrypted with KMS keys."
+      remediation_guidance: Follow AWS Config rule guidance for cloudwatch-log-group-encrypted
+  '3.3':
+    title: Configure Data Access Control Lists
+    weight: 1.0
+    config_rules:
+    - name: s3-bucket-ssl-requests-only
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: s3-bucket-ssl-requests-only\n    \n    Ensures S3 buckets require\
+        \ SSL/TLS for all requests to protect data in transit."
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-ssl-requests-only
+    - name: s3-bucket-server-side-encryption-enabled
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: s3-bucket-server-side-encryption-enabled\n    \n    Ensures\
+        \ S3 buckets have server-side encryption enabled to protect data at rest."
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-server-side-encryption-enabled
+    - name: s3-bucket-logging-enabled
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: s3-bucket-logging-enabled\n    \n    Ensures S3 buckets have\
+        \ access logging enabled for audit and compliance."
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-logging-enabled
+    - name: iam-root-access-key-check
+      resource_types:
+      - AWS::::Account
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-root-access-key-check\n    \n    Ensures the root user\
+        \ does not have access keys attached to prevent unauthorized access."
+      remediation_guidance: Follow AWS Config rule guidance for iam-root-access-key-check
+    - name: iam-user-unused-credentials-check
+      resource_types:
+      - AWS::IAM::User
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-user-unused-credentials-check\n    \n    Ensures IAM users\
+        \ don't have unused credentials that could pose security risks."
+      remediation_guidance: Follow AWS Config rule guidance for iam-user-unused-credentials-check
+    - name: iam-customer-policy-blocked-kms-actions
+      resource_types:
+      - AWS::IAM::Policy
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-customer-policy-blocked-kms-actions\n    \n    Ensures\
+        \ customer-managed IAM policies don't contain blocked KMS actions."
+      remediation_guidance: Follow AWS Config rule guidance for iam-customer-policy-blocked-kms-actions
+    - name: iam-inline-policy-blocked-kms-actions
+      resource_types:
+      - AWS::IAM::User
+      - AWS::IAM::Role
+      - AWS::IAM::Group
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-inline-policy-blocked-kms-actions\n    \n    Ensures inline\
+        \ IAM policies don't contain blocked KMS actions."
+      remediation_guidance: Follow AWS Config rule guidance for iam-inline-policy-blocked-kms-actions
+    - name: ebs-snapshot-public-restorable-check
+      resource_types:
+      - AWS::EC2::Snapshot
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: ebs-snapshot-public-restorable-check\n    \n    Ensures EBS\
+        \ snapshots are not publicly restorable to prevent data exposure."
+      remediation_guidance: Follow AWS Config rule guidance for ebs-snapshot-public-restorable-check
+    - name: rds-snapshots-public-prohibited
+      resource_types:
+      - AWS::RDS::DBSnapshot
+      - AWS::RDS::DBClusterSnapshot
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: rds-snapshots-public-prohibited\n    \n    Ensures RDS snapshots\
+        \ are not publicly accessible to prevent database data exposure."
+      remediation_guidance: Follow AWS Config rule guidance for rds-snapshots-public-prohibited
+    - name: rds-instance-public-access-check
+      resource_types:
+      - AWS::RDS::DBInstance
+      - AWS::RDS::DBCluster
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: rds-instance-public-access-check\n    \n    Ensures RDS instances\
+        \ are not publicly accessible to prevent database exposure."
+      remediation_guidance: Follow AWS Config rule guidance for rds-instance-public-access-check
+    - name: redshift-cluster-public-access-check
+      resource_types:
+      - AWS::Redshift::Cluster
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: redshift-cluster-public-access-check\n    \n    Ensures Redshift\
+        \ clusters are not publicly accessible to prevent data warehouse exposure."
+      remediation_guidance: Follow AWS Config rule guidance for redshift-cluster-public-access-check
+    - name: s3-bucket-level-public-access-prohibited
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: s3-bucket-level-public-access-prohibited\n    \n    Ensures\
+        \ S3 buckets do not allow public access at the bucket level to prevent data\
+        \ exposure."
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-level-public-access-prohibited
+    - name: iam-user-mfa-enabled
+      resource_types:
+      - AWS::IAM::User
+      parameters: {}
+      description: Assessment for iam-user-mfa-enabled Config rule - ensures IAM users
+        have MFA.
+      remediation_guidance: Follow AWS Config rule guidance for iam-user-mfa-enabled
+    - name: iam-root-access-key-check
+      resource_types:
+      - AWS::::Account
+      parameters: {}
+      description: Assessment for iam-root-access-key-check Config rule - ensures
+        root has no access keys.
+      remediation_guidance: Follow AWS Config rule guidance for iam-root-access-key-check
+    - name: s3-bucket-public-read-prohibited
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: Assessment for s3-bucket-public-read-prohibited Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-public-read-prohibited
+    - name: ec2-instance-no-public-ip
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: Assessment for ec2-instance-no-public-ip Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-instance-no-public-ip
+    - name: autoscaling-launch-config-public-ip-disabled
+      resource_types:
+      - AWS::AutoScaling::LaunchConfiguration
+      parameters: {}
+      description: Assessment for autoscaling-launch-config-public-ip-disabled AWS
+        Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for autoscaling-launch-config-public-ip-disabled
+    - name: efs-access-point-enforce-root-directory
+      resource_types:
+      - AWS::EFS::AccessPoint
+      parameters: {}
+      description: Assessment for efs-access-point-enforce-root-directory AWS Config
+        rule.
+      remediation_guidance: Follow AWS Config rule guidance for efs-access-point-enforce-root-directory
+    - name: ec2-managedinstance-association-compliance-status-check
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: "CIS Control 1.1/2.4/4.1 - Systems Management\n    AWS Config Rule:\
+        \ ec2-managedinstance-association-compliance-status-check\n    \n    Ensures\
+        \ EC2 instances have proper Systems Manager associations for compliance tracking."
+      remediation_guidance: Follow AWS Config rule guidance for ec2-managedinstance-association-compliance-status-check
+    - name: emr-kerberos-enabled
+      resource_types:
+      - AWS::EMR::Cluster
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: emr-kerberos-enabled\n    \n    Ensures EMR clusters have Kerberos\
+        \ authentication enabled to prevent unauthorized access."
+      remediation_guidance: Follow AWS Config rule guidance for emr-kerberos-enabled
+    - name: lambda-inside-vpc
+      resource_types:
+      - AWS::Lambda::Function
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: lambda-inside-vpc\n    \n    Ensures Lambda functions are deployed\
+        \ within VPC when needed for network isolation."
+      remediation_guidance: Follow AWS Config rule guidance for lambda-inside-vpc
+    - name: ecs-task-definition-user-for-host-mode-check
+      resource_types:
+      - AWS::ECS::TaskDefinition
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: ecs-task-definition-user-for-host-mode-check\n    \n    Ensures\
+        \ ECS tasks in host mode do not run with elevated privileges to prevent container\
+        \ privilege escalation."
+      remediation_guidance: Follow AWS Config rule guidance for ecs-task-definition-user-for-host-mode-check
+    - name: iam-group-has-users-check
+      resource_types:
+      - AWS::IAM::Group
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-group-has-users-check\n    \n    Ensures IAM groups have\
+        \ at least one user for proper access management."
+      remediation_guidance: Follow AWS Config rule guidance for iam-group-has-users-check
+    - name: iam-policy-no-statements-with-full-access
+      resource_types:
+      - AWS::IAM::Policy
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-policy-no-statements-with-full-access\n    \n    Prevents\
+        \ IAM policies with overly broad permissions to prevent privilege escalation."
+      remediation_guidance: Follow AWS Config rule guidance for iam-policy-no-statements-with-full-access
+    - name: iam-user-no-policies-check
+      resource_types:
+      - AWS::IAM::User
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: iam-user-no-policies-check\n    \n    Ensures IAM policies\
+        \ are attached to groups/roles, not users directly for proper access management."
+      remediation_guidance: Follow AWS Config rule guidance for iam-user-no-policies-check
+    - name: ssm-document-not-public
+      resource_types:
+      - AWS::SSM::Document
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: ssm-document-not-public\n    \n    Ensures SSM documents are\
+        \ not publicly accessible to prevent exposure of automation scripts."
+      remediation_guidance: Follow AWS Config rule guidance for ssm-document-not-public
+    - name: iam-policy-no-statements-with-admin-access
+      resource_types:
+      - AWS::IAM::Policy
+      parameters: {}
+      description: Assessment for iam-policy-no-statements-with-admin-access Config
+        rule.
+      remediation_guidance: Follow AWS Config rule guidance for iam-policy-no-statements-with-admin-access
+    - name: iam-no-inline-policy-check
+      resource_types:
+      - AWS::IAM::User
+      - AWS::IAM::Role
+      - AWS::IAM::Group
+      parameters: {}
+      description: Assessment for iam-no-inline-policy-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for iam-no-inline-policy-check
+    - name: iam-user-group-membership-check
+      resource_types:
+      - AWS::IAM::User
+      parameters: {}
+      description: Assessment for iam-user-group-membership-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for iam-user-group-membership-check
+    - name: dms-replication-not-public
+      resource_types:
+      - AWS::DMS::ReplicationInstance
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: dms-replication-not-public\n    \n    Ensures DMS replication\
+        \ instances are not publicly accessible to prevent data exposure."
+      remediation_guidance: Follow AWS Config rule guidance for dms-replication-not-public
+    - name: elasticsearch-in-vpc-only
+      resource_types:
+      - AWS::Elasticsearch::Domain
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: elasticsearch-in-vpc-only\n    \n    Ensures Elasticsearch\
+        \ domains are deployed within VPC to prevent public access."
+      remediation_guidance: Follow AWS Config rule guidance for elasticsearch-in-vpc-only
+    - name: ec2-instances-in-vpc
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: ec2-instances-in-vpc\n    \n    Ensures EC2 instances are deployed\
+        \ within VPC for network security."
+      remediation_guidance: Follow AWS Config rule guidance for ec2-instances-in-vpc
+    - name: emr-master-no-public-ip
+      resource_types:
+      - AWS::EMR::Cluster
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: emr-master-no-public-ip\n    \n    Ensures EMR master nodes\
+        \ do not have public IP addresses."
+      remediation_guidance: Follow AWS Config rule guidance for emr-master-no-public-ip
+    - name: lambda-function-public-access-prohibited
+      resource_types:
+      - AWS::Lambda::Function
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: lambda-function-public-access-prohibited\n    \n    Ensures\
+        \ Lambda functions cannot be publicly accessed."
+      remediation_guidance: Follow AWS Config rule guidance for lambda-function-public-access-prohibited
+    - name: sagemaker-notebook-no-direct-internet-access
+      resource_types:
+      - AWS::SageMaker::NotebookInstance
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: sagemaker-notebook-no-direct-internet-access\n    \n    Ensures\
+        \ SageMaker notebooks do not have direct internet access."
+      remediation_guidance: Follow AWS Config rule guidance for sagemaker-notebook-no-direct-internet-access
+    - name: subnet-auto-assign-public-ip-disabled
+      resource_types:
+      - AWS::EC2::Subnet
+      parameters: {}
+      description: "CIS Control 3.3 - Configure Data Access Control Lists\n    AWS\
+        \ Config Rule: subnet-auto-assign-public-ip-disabled\n    \n    Ensures subnets\
+        \ do not automatically assign public IPs to prevent accidental exposure."
+      remediation_guidance: Follow AWS Config rule guidance for subnet-auto-assign-public-ip-disabled
+    - name: s3-account-level-public-access-blocks-periodic
+      resource_types:
+      - AWS::::Account
+      parameters: {}
+      description: Assessment for s3-account-level-public-access-blocks-periodic AWS
+        Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for s3-account-level-public-access-blocks-periodic
+    - name: s3-bucket-public-write-prohibited
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: Assessment for s3-bucket-public-write-prohibited AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-public-write-prohibited
+    - name: ec2-imdsv2-check
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: Assessment for ec2-imdsv2-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-imdsv2-check
+    - name: ec2-instance-profile-attached
+      resource_types:
+      - AWS::EC2::Instance
+      parameters: {}
+      description: Assessment for ec2-instance-profile-attached Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-instance-profile-attached
+  '3.4':
+    title: Configure Automatic Session Locking on Enterprise Assets
+    weight: 1.0
+    config_rules:
+    - name: s3-bucket-versioning-enabled
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: "CIS Control 3.4 - Enforce Data Retention\n    AWS Config Rule:\
+        \ s3-bucket-versioning-enabled\n    \n    Ensures S3 buckets have versioning\
+        \ enabled for data protection and recovery."
+      remediation_guidance: Follow AWS Config rule guidance for s3-bucket-versioning-enabled
+    - name: s3-version-lifecycle-policy-check
+      resource_types:
+      - AWS::S3::Bucket
+      parameters: {}
+      description: Assessment for s3-version-lifecycle-policy-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for s3-version-lifecycle-policy-check
+    - name: cw-loggroup-retention-period-check
+      resource_types:
+      - AWS::Logs::LogGroup
+      parameters: {}
+      description: Assessment for cw-loggroup-retention-period-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for cw-loggroup-retention-period-check
+  '4.1':
+    title: Establish and Maintain a Secure Configuration Process
+    weight: 1.0
+    config_rules:
+    - name: account-part-of-organizations
+      resource_types:
+      - AWS::::Account
+      parameters: {}
+      description: Assessment for account-part-of-organizations Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for account-part-of-organizations
+    - name: ec2-volume-inuse-check
+      resource_types:
+      - AWS::EC2::Volume
+      parameters: {}
+      description: Assessment for ec2-volume-inuse-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ec2-volume-inuse-check
+    - name: redshift-cluster-maintenancesettings-check
+      resource_types:
+      - AWS::Redshift::Cluster
+      parameters: {}
+      description: Assessment for redshift-cluster-maintenancesettings-check Config
+        rule.
+      remediation_guidance: Follow AWS Config rule guidance for redshift-cluster-maintenancesettings-check
+    - name: secretsmanager-rotation-enabled-check
+      resource_types:
+      - AWS::SecretsManager::Secret
+      parameters: {}
+      description: Assessment for secretsmanager-rotation-enabled-check Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for secretsmanager-rotation-enabled-check
+    - name: ecs-task-definition-nonroot-user
+      resource_types:
+      - AWS::ECS::TaskDefinition
+      parameters: {}
+      description: Assessment for ecs-task-definition-nonroot-user AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for ecs-task-definition-nonroot-user
+    - name: access-keys-rotated
+      resource_types:
+      - AWS::IAM::User
+      parameters: {}
+      description: Assessment for access-keys-rotated Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for access-keys-rotated
+  '5.2':
+    title: Use Unique Passwords
+    weight: 1.0
+    config_rules:
+    - name: iam-password-policy
+      resource_types:
+      - AWS::::Account
+      parameters: {}
+      description: Assessment for iam-password-policy Config rule - ensures strong
+        password policy.
+      remediation_guidance: Follow AWS Config rule guidance for iam-password-policy
+  '8.2':
+    title: Control 8.2
+    weight: 1.0
+    config_rules:
+    - name: cloudtrail-enabled
+      resource_types:
+      - AWS::::Account
+      parameters: {}
+      description: "CIS Control 8.2 - Collect Audit Logs\n    AWS Config Rule: cloudtrail-enabled\n\
+        \    \n    Ensures CloudTrail is enabled to record AWS Management Console\
+        \ actions and API calls."
+      remediation_guidance: Follow AWS Config rule guidance for cloudtrail-enabled
+  '8.8':
+    title: Control 8.8
+    weight: 1.0
+    config_rules:
+    - name: securityhub-enabled
+      resource_types:
+      - AWS::SecurityHub::Hub
+      parameters: {}
+      description: Assessment for securityhub-enabled AWS Config rule.
+      remediation_guidance: Follow AWS Config rule guidance for securityhub-enabled