aws-cis-controls-assessment 1.0.9__py3-none-any.whl → 1.1.0__py3-none-any.whl

aws_cis_assessment/__init__.py

@@ -2,10 +2,10 @@
 AWS CIS Controls Compliance Assessment Framework
 
 A production-ready, enterprise-grade framework for evaluating AWS account configurations against 
-CIS Controls Implementation Groups (IG1, IG2, IG3). Implements 145 comprehensive AWS Config rules 
+CIS Controls Implementation Groups (IG1, IG2, IG3). Implements 163 comprehensive AWS Config rules 
 across all implementation groups for complete security compliance assessment.
 """
 
-__version__ = "1.0.9"
+__version__ = "1.1.0"
 __author__ = "AWS CIS Assessment Team"
 __description__ = "Production-ready AWS CIS Controls Compliance Assessment Framework"

aws_cis_assessment/config/rules/cis_controls_ig1.yaml

@@ -1,5 +1,5 @@
 implementation_group: IG1
-total_rules: 74
+total_rules: 77
 description: Essential cyber hygiene - foundational safeguards for all enterprises
 controls:
   '1.1':
@@ -108,6 +108,99 @@ controls:
       parameters: {}
       description: Assessment for s3-bucket-replication-enabled AWS Config rule.
       remediation_guidance: Follow AWS Config rule guidance for s3-bucket-replication-enabled
+    - name: backup-plan-min-frequency-and-min-retention-check
+      resource_types:
+      - AWS::Backup::BackupPlan
+      parameters: {}
+      description: Validates AWS Backup plans have appropriate backup frequency and retention policies to ensure data protection and recovery capabilities
+      remediation_guidance: |
+        Ensure backup plans have:
+        - Backup frequency of at least daily
+        - Retention period of at least 7 days
+        - Appropriate lifecycle policies
+        
+        To create or update a backup plan:
+        1. Go to AWS Backup console
+        2. Create or edit a backup plan
+        3. Add backup rules with:
+           - Schedule: Use cron or rate expressions (e.g., "cron(0 5 * * ? *)" for daily at 5 AM)
+           - Retention: Set to at least 7 days
+           - Lifecycle: Configure cold storage transition if needed
+        
+        AWS CLI example:
+        aws backup create-backup-plan --backup-plan '{
+          "BackupPlanName": "daily-backup-plan",
+          "Rules": [{
+            "RuleName": "daily-rule",
+            "ScheduleExpression": "cron(0 5 * * ? *)",
+            "Lifecycle": {"DeleteAfterDays": 30}
+          }]
+        }'
+    - name: backup-vault-access-policy-check
+      resource_types:
+      - AWS::Backup::BackupVault
+      parameters: {}
+      description: Checks AWS Backup vault access policies for security to ensure vaults follow principle of least privilege and do not allow public access
+      remediation_guidance: |
+        Ensure backup vaults:
+        - Do not allow public access (Principal: "*")
+        - Have restrictive access policies
+        - Follow principle of least privilege
+        - Consider using vault lock for critical vaults
+        
+        To secure a backup vault:
+        1. Go to AWS Backup console
+        2. Select the backup vault
+        3. Review and update access policy:
+           - Remove any wildcard principals
+           - Restrict to specific IAM roles/users
+           - Limit permissions to necessary actions only
+        4. Consider enabling vault lock to prevent deletion
+        
+        AWS CLI example to remove public access:
+        aws backup delete-backup-vault-access-policy --backup-vault-name MyVault
+        
+        To set a restrictive policy:
+        aws backup put-backup-vault-access-policy --backup-vault-name MyVault --policy '{
+          "Version": "2012-10-17",
+          "Statement": [{
+            "Effect": "Allow",
+            "Principal": {"AWS": "arn:aws:iam::123456789012:role/BackupRole"},
+            "Action": ["backup:DescribeBackupVault", "backup:ListRecoveryPointsByBackupVault"],
+            "Resource": "*"
+          }]
+        }'
+    - name: backup-selection-resource-coverage-check
+      resource_types:
+      - AWS::Backup::BackupPlan
+      parameters: {}
+      description: Validates that AWS Backup plans have backup selections that cover critical resources ensuring comprehensive backup coverage
+      remediation_guidance: |
+        Ensure backup plans have proper resource coverage:
+        - At least one backup selection per plan
+        - Selections target specific resources or use tags
+        - Critical resource types are included
+        - Selections are not empty
+        
+        To add backup selections:
+        1. Go to AWS Backup console
+        2. Select your backup plan
+        3. Add backup selection:
+           - Specify resources by ARN, or
+           - Use resource tags to automatically include resources, or
+           - Use conditions to dynamically select resources
+        4. Ensure critical resources (RDS, EBS, EFS, DynamoDB) are covered
+        
+        AWS CLI example to create a backup selection:
+        aws backup create-backup-selection --backup-plan-id <plan-id> --backup-selection '{
+          "SelectionName": "CriticalResources",
+          "IamRoleArn": "arn:aws:iam::123456789012:role/AWSBackupRole",
+          "ListOfTags": [{
+            "ConditionType": "STRINGEQUALS",
+            "ConditionKey": "backup",
+            "ConditionValue": "true"
+          }]
+        }'
   '12.2':
     title: Control 12.2
     weight: 1.0