aws-cis-controls-assessment 1.1.4__py3-none-any.whl → 1.2.0__py3-none-any.whl

aws_cis_assessment/controls/ig1/control_network_security.py

@@ -1,13 +1,11 @@
 """
-CIS Control 3.3 - Network Security Controls
-Critical network security rules to prevent public exposure and ensure proper network isolation.
+CIS Control 13.6 - Network Security
+Ensures advanced network security controls are deployed.
 """
 
 import logging
-from typing import List, Dict, Any, Optional
-import boto3
-import json
-from botocore.exceptions import ClientError, NoCredentialsError
+from typing import List, Dict, Any
+from botocore.exceptions import ClientError
 
 from aws_cis_assessment.controls.base_control import BaseConfigRuleAssessment
 from aws_cis_assessment.core.models import ComplianceResult, ComplianceStatus
@@ -16,657 +14,234 @@ from aws_cis_assessment.core.aws_client_factory import AWSClientFactory
 logger = logging.getLogger(__name__)
 
 
-class DMSReplicationNotPublicAssessment(BaseConfigRuleAssessment):
+class NetworkFirewallDeployedAssessment(BaseConfigRuleAssessment):
     """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: dms-replication-not-public
+    CIS Control 13.6 - Deny Communications with Known Malicious IP Addresses
+    AWS Config Rule: network-firewall-deployed
     
-    Ensures DMS replication instances are not publicly accessible to prevent data exposure.
+    Ensures AWS Network Firewall is deployed for advanced network protection.
     """
     
     def __init__(self):
         super().__init__(
-            rule_name="dms-replication-not-public",
-            control_id="3.3",
-            resource_types=["AWS::DMS::ReplicationInstance"]
+            rule_name="network-firewall-deployed",
+            control_id="13.6",
+            resource_types=["AWS::EC2::VPC"]
         )
     
     def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all DMS replication instances in the region."""
-        if resource_type != "AWS::DMS::ReplicationInstance":
+        """Get VPCs and check for Network Firewall deployment."""
+        if resource_type != "AWS::EC2::VPC":
             return []
         
         try:
-            dms_client = aws_factory.get_client('dms', region)
-            
-            # Get all DMS replication instances
-            paginator = dms_client.get_paginator('describe_replication_instances')
-            instances = []
-            
-            for page in paginator.paginate():
-                for instance in page['ReplicationInstances']:
-                    instances.append({
-                        'ReplicationInstanceIdentifier': instance['ReplicationInstanceIdentifier'],
-                        'ReplicationInstanceArn': instance['ReplicationInstanceArn'],
-                        'ReplicationInstanceClass': instance.get('ReplicationInstanceClass', ''),
-                        'PubliclyAccessible': instance.get('PubliclyAccessible', False),
-                        'VpcSecurityGroups': [sg['VpcSecurityGroupId'] for sg in instance.get('VpcSecurityGroups', [])],
-                        'ReplicationSubnetGroup': instance.get('ReplicationSubnetGroup', {}).get('ReplicationSubnetGroupIdentifier', ''),
-                        'AvailabilityZone': instance.get('AvailabilityZone', ''),
-                        'MultiAZ': instance.get('MultiAZ', False)
-                    })
-            
-            logger.debug(f"Found {len(instances)} DMS replication instances in {region}")
-            return instances
-            
-        except ClientError as e:
-            logger.error(f"Error retrieving DMS replication instances in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving DMS replication instances in {region}: {e}")
-            raise
-    
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if DMS replication instance is publicly accessible."""
-        instance_id = resource.get('ReplicationInstanceIdentifier', 'unknown')
-        is_public = resource.get('PubliclyAccessible', False)
-        
-        if is_public:
-            return ComplianceResult(
-                resource_id=instance_id,
-                resource_type="AWS::DMS::ReplicationInstance",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="DMS replication instance is publicly accessible",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        else:
-            return ComplianceResult(
-                resource_id=instance_id,
-                resource_type="AWS::DMS::ReplicationInstance",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason="DMS replication instance is not publicly accessible",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-
-
-class ElasticsearchInVPCOnlyAssessment(BaseConfigRuleAssessment):
-    """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: elasticsearch-in-vpc-only
-    
-    Ensures Elasticsearch domains are deployed within VPC to prevent public access.
-    """
-    
-    def __init__(self):
-        super().__init__(
-            rule_name="elasticsearch-in-vpc-only",
-            control_id="3.3",
-            resource_types=["AWS::Elasticsearch::Domain"]
-        )
-    
-    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all Elasticsearch domains in the region."""
-        if resource_type != "AWS::Elasticsearch::Domain":
-            return []
-        
-        try:
-            es_client = aws_factory.get_client('es', region)
-            
-            # Get all Elasticsearch domains
-            response = es_client.list_domain_names()
-            domains = []
-            
-            for domain_info in response.get('DomainNames', []):
-                domain_name = domain_info['DomainName']
-                
-                try:
-                    # Get detailed domain configuration
-                    domain_response = es_client.describe_elasticsearch_domain(DomainName=domain_name)
-                    domain = domain_response['DomainStatus']
-                    
-                    vpc_options = domain.get('VPCOptions', {})
-                    
-                    domains.append({
-                        'DomainName': domain_name,
-                        'DomainArn': domain.get('ARN', ''),
-                        'ElasticsearchVersion': domain.get('ElasticsearchVersion', ''),
-                        'VPCOptions': vpc_options,
-                        'VPCId': vpc_options.get('VPCId', ''),
-                        'SubnetIds': vpc_options.get('SubnetIds', []),
-                        'SecurityGroupIds': vpc_options.get('SecurityGroupIds', []),
-                        'Endpoint': domain.get('Endpoint', ''),
-                        'Endpoints': domain.get('Endpoints', {})
-                    })
+            ec2_client = aws_factory.get_client('ec2', region)
+            network_firewall_client = aws_factory.get_client('network-firewall', region)
+            
+            # Get all VPCs
+            vpcs_response = ec2_client.describe_vpcs()
+            vpcs = []
+            
+            # Get all firewalls
+            try:
+                firewalls_response = network_firewall_client.list_firewalls()
+                firewalls = firewalls_response.get('Firewalls', [])
+                firewall_vpcs = {fw.get('VpcId') for fw in firewalls}
+            except ClientError:
+                firewall_vpcs = set()
+            
+            for vpc in vpcs_response.get('Vpcs', []):
+                vpc_id = vpc.get('VpcId')
+                has_firewall = vpc_id in firewall_vpcs
                 
-                except ClientError as e:
-                    logger.warning(f"Error getting details for Elasticsearch domain {domain_name}: {e}")
-                    continue
+                vpcs.append({
+                    'VpcId': vpc_id,
+                    'HasFirewall': has_firewall,
+                    'IsDefault': vpc.get('IsDefault', False)
+                })
             
-            logger.debug(f"Found {len(domains)} Elasticsearch domains in {region}")
-            return domains
+            return vpcs
             
         except ClientError as e:
-            logger.error(f"Error retrieving Elasticsearch domains in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving Elasticsearch domains in {region}: {e}")
-            raise
-    
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if Elasticsearch domain is deployed within VPC."""
-        domain_name = resource.get('DomainName', 'unknown')
-        vpc_id = resource.get('VPCId', '')
-        
-        if vpc_id:
-            return ComplianceResult(
-                resource_id=domain_name,
-                resource_type="AWS::Elasticsearch::Domain",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason=f"Elasticsearch domain is deployed within VPC {vpc_id}",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        else:
-            return ComplianceResult(
-                resource_id=domain_name,
-                resource_type="AWS::Elasticsearch::Domain",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="Elasticsearch domain is not deployed within VPC",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-
-
-class EC2InstancesInVPCAssessment(BaseConfigRuleAssessment):
-    """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: ec2-instances-in-vpc
-    
-    Ensures EC2 instances are deployed within VPC for network security.
-    """
-    
-    def __init__(self):
-        super().__init__(
-            rule_name="ec2-instances-in-vpc",
-            control_id="3.3",
-            resource_types=["AWS::EC2::Instance"]
-        )
-    
-    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all EC2 instances in the region."""
-        if resource_type != "AWS::EC2::Instance":
+            logger.error(f"Error retrieving VPCs in {region}: {e}")
             return []
-        
-        try:
-            ec2_client = aws_factory.get_client('ec2', region)
-            
-            # Get all EC2 instances
-            paginator = ec2_client.get_paginator('describe_instances')
-            instances = []
-            
-            for page in paginator.paginate():
-                for reservation in page['Reservations']:
-                    for instance in reservation['Instances']:
-                        instances.append({
-                            'InstanceId': instance['InstanceId'],
-                            'VpcId': instance.get('VpcId', ''),
-                            'SubnetId': instance.get('SubnetId', ''),
-                            'State': instance.get('State', {}).get('Name', ''),
-                            'InstanceType': instance.get('InstanceType', ''),
-                            'PublicIpAddress': instance.get('PublicIpAddress', ''),
-                            'PrivateIpAddress': instance.get('PrivateIpAddress', '')
-                        })
-            
-            logger.debug(f"Found {len(instances)} EC2 instances in {region}")
-            return instances
-            
-        except ClientError as e:
-            logger.error(f"Error retrieving EC2 instances in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving EC2 instances in {region}: {e}")
-            raise
     
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if EC2 instance is deployed within VPC."""
-        instance_id = resource.get('InstanceId', 'unknown')
-        vpc_id = resource.get('VpcId', '')
-        state = resource.get('State', '')
-        
-        # Skip terminated instances
-        if state == 'terminated':
-            return ComplianceResult(
-                resource_id=instance_id,
-                resource_type="AWS::EC2::Instance",
-                compliance_status=ComplianceStatus.NOT_APPLICABLE,
-                evaluation_reason=f"Instance {instance_id} is terminated",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        
-        if vpc_id:
-            return ComplianceResult(
-                resource_id=instance_id,
-                resource_type="AWS::EC2::Instance",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason=f"EC2 instance is deployed within VPC {vpc_id}",
-                config_rule_name=self.rule_name,
-                region=region
-            )
+    def _evaluate_resource_compliance(
+        self, 
+        resource: Dict[str, Any], 
+        aws_factory: AWSClientFactory, 
+        region: str
+    ) -> ComplianceResult:
+        """Evaluate if VPC has Network Firewall deployed."""
+        vpc_id = resource.get('VpcId', 'unknown')
+        has_firewall = resource.get('HasFirewall', False)
+        is_default = resource.get('IsDefault', False)
+        
+        # Default VPCs are often not used for production
+        if is_default:
+            evaluation_reason = f"VPC {vpc_id} is default VPC (typically not used for production)"
+            compliance_status = ComplianceStatus.NOT_APPLICABLE
+        elif has_firewall:
+            evaluation_reason = f"VPC {vpc_id} has AWS Network Firewall deployed"
+            compliance_status = ComplianceStatus.COMPLIANT
         else:
-            return ComplianceResult(
-                resource_id=instance_id,
-                resource_type="AWS::EC2::Instance",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="EC2 instance is not deployed within VPC (EC2-Classic)",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-
-
-class EMRMasterNoPublicIPAssessment(BaseConfigRuleAssessment):
-    """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: emr-master-no-public-ip
-    
-    Ensures EMR master nodes do not have public IP addresses.
-    """
-    
-    def __init__(self):
-        super().__init__(
-            rule_name="emr-master-no-public-ip",
-            control_id="3.3",
-            resource_types=["AWS::EMR::Cluster"]
+            evaluation_reason = f"VPC {vpc_id} does not have AWS Network Firewall deployed"
+            compliance_status = ComplianceStatus.NON_COMPLIANT
+        
+        return ComplianceResult(
+            resource_id=vpc_id,
+            resource_type="AWS::EC2::VPC",
+            compliance_status=compliance_status,
+            evaluation_reason=evaluation_reason,
+            config_rule_name=self.rule_name,
+            region=region
         )
     
-    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all EMR clusters in the region."""
-        if resource_type != "AWS::EMR::Cluster":
-            return []
-        
-        try:
-            emr_client = aws_factory.get_client('emr', region)
-            
-            # Get all EMR clusters
-            paginator = emr_client.get_paginator('list_clusters')
-            clusters = []
-            
-            for page in paginator.paginate():
-                for cluster_summary in page['Clusters']:
-                    cluster_id = cluster_summary['Id']
-                    
-                    try:
-                        # Get detailed cluster information
-                        cluster_response = emr_client.describe_cluster(ClusterId=cluster_id)
-                        cluster = cluster_response['Cluster']
-                        
-                        # Get instance groups to check master node configuration
-                        instance_groups_response = emr_client.list_instance_groups(ClusterId=cluster_id)
-                        
-                        master_public_ip = False
-                        for instance_group in instance_groups_response['InstanceGroups']:
-                            if instance_group['InstanceGroupType'] == 'MASTER':
-                                # Check if master instances have public IPs
-                                instances_response = emr_client.list_instances(
-                                    ClusterId=cluster_id,
-                                    InstanceGroupTypes=['MASTER']
-                                )
-                                
-                                for instance in instances_response['Instances']:
-                                    if instance.get('PublicIpAddress'):
-                                        master_public_ip = True
-                                        break
-                                break
-                        
-                        clusters.append({
-                            'ClusterId': cluster_id,
-                            'Name': cluster.get('Name', ''),
-                            'State': cluster.get('Status', {}).get('State', ''),
-                            'MasterPublicDnsName': cluster.get('MasterPublicDnsName', ''),
-                            'Ec2InstanceAttributes': cluster.get('Ec2InstanceAttributes', {}),
-                            'MasterHasPublicIP': master_public_ip
-                        })
-                    
-                    except ClientError as e:
-                        logger.warning(f"Error getting details for EMR cluster {cluster_id}: {e}")
-                        continue
-            
-            logger.debug(f"Found {len(clusters)} EMR clusters in {region}")
-            return clusters
-            
-        except ClientError as e:
-            logger.error(f"Error retrieving EMR clusters in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving EMR clusters in {region}: {e}")
-            raise
-    
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if EMR master node has public IP address."""
-        cluster_id = resource.get('ClusterId', 'unknown')
-        state = resource.get('State', '')
-        master_has_public_ip = resource.get('MasterHasPublicIP', False)
-        
-        # Skip terminated clusters
-        if state in ['TERMINATED', 'TERMINATED_WITH_ERRORS']:
-            return ComplianceResult(
-                resource_id=cluster_id,
-                resource_type="AWS::EMR::Cluster",
-                compliance_status=ComplianceStatus.NOT_APPLICABLE,
-                evaluation_reason=f"EMR cluster {cluster_id} is terminated",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        
-        if master_has_public_ip:
-            return ComplianceResult(
-                resource_id=cluster_id,
-                resource_type="AWS::EMR::Cluster",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="EMR master node has public IP address",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        else:
-            return ComplianceResult(
-                resource_id=cluster_id,
-                resource_type="AWS::EMR::Cluster",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason="EMR master node does not have public IP address",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-
-
-class LambdaFunctionPublicAccessProhibitedAssessment(BaseConfigRuleAssessment):
+    def _get_rule_remediation_steps(self) -> List[str]:
+        """Get remediation steps for deploying Network Firewall."""
+        return [
+            "1. Create Network Firewall policy:",
+            "   aws network-firewall create-firewall-policy \\",
+            "     --firewall-policy-name production-policy \\",
+            "     --firewall-policy '{...}'",
+            "",
+            "2. Deploy Network Firewall:",
+            "   aws network-firewall create-firewall \\",
+            "     --firewall-name production-firewall \\",
+            "     --firewall-policy-arn <policy-arn> \\",
+            "     --vpc-id <vpc-id> \\",
+            "     --subnet-mappings SubnetId=<subnet-id>",
+            "",
+            "3. Update route tables to route traffic through firewall",
+            "",
+            "4. Console method:",
+            "   - Navigate to VPC > Network Firewall",
+            "   - Click 'Create firewall'",
+            "   - Configure firewall policy and rules",
+            "   - Select VPC and subnets",
+            "   - Update route tables",
+            "",
+            "Priority: MEDIUM - Enhanced network security",
+            "Effort: High - Requires network architecture changes",
+            "",
+            "AWS Documentation:",
+            "https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html"
+        ]
+
+
+class Route53ResolverFirewallEnabledAssessment(BaseConfigRuleAssessment):
     """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: lambda-function-public-access-prohibited
+    CIS Control 13.6 - Deny Communications with Known Malicious IP Addresses
+    AWS Config Rule: route53-resolver-firewall-enabled
     
-    Ensures Lambda functions cannot be publicly accessed.
+    Ensures Route 53 Resolver DNS Firewall is enabled for DNS-level protection.
     """
     
     def __init__(self):
         super().__init__(
-            rule_name="lambda-function-public-access-prohibited",
-            control_id="3.3",
-            resource_types=["AWS::Lambda::Function"]
+            rule_name="route53-resolver-firewall-enabled",
+            control_id="13.6",
+            resource_types=["AWS::EC2::VPC"]
         )
     
     def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all Lambda functions in the region."""
-        if resource_type != "AWS::Lambda::Function":
+        """Get VPCs and check for Route 53 Resolver Firewall."""
+        if resource_type != "AWS::EC2::VPC":
             return []
         
         try:
-            lambda_client = aws_factory.get_client('lambda', region)
-            
-            # Get all Lambda functions
-            paginator = lambda_client.get_paginator('list_functions')
-            functions = []
-            
-            for page in paginator.paginate():
-                for function in page['Functions']:
-                    function_name = function['FunctionName']
-                    
-                    try:
-                        # Get function policy to check for public access
-                        policy_response = lambda_client.get_policy(FunctionName=function_name)
-                        policy_doc = json.loads(policy_response['Policy'])
-                        
-                        has_public_access = False
-                        public_statements = []
-                        
-                        for statement in policy_doc.get('Statement', []):
-                            if isinstance(statement, dict):
-                                effect = statement.get('Effect', '')
-                                principal = statement.get('Principal', {})
-                                
-                                if effect == 'Allow':
-                                    if principal == '*' or (isinstance(principal, dict) and principal.get('AWS') == '*'):
-                                        has_public_access = True
-                                        public_statements.append(statement)
-                        
-                        functions.append({
-                            'FunctionName': function_name,
-                            'FunctionArn': function['FunctionArn'],
-                            'Runtime': function.get('Runtime', ''),
-                            'VpcConfig': function.get('VpcConfig', {}),
-                            'HasPublicAccess': has_public_access,
-                            'PublicStatements': public_statements
-                        })
-                    
-                    except ClientError as e:
-                        if e.response.get('Error', {}).get('Code') == 'ResourceNotFoundException':
-                            # Function has no policy, so no public access
-                            functions.append({
-                                'FunctionName': function_name,
-                                'FunctionArn': function['FunctionArn'],
-                                'Runtime': function.get('Runtime', ''),
-                                'VpcConfig': function.get('VpcConfig', {}),
-                                'HasPublicAccess': False,
-                                'PublicStatements': []
-                            })
-                        else:
-                            logger.warning(f"Error getting policy for Lambda function {function_name}: {e}")
-                            continue
+            ec2_client = aws_factory.get_client('ec2', region)
+            route53resolver_client = aws_factory.get_client('route53resolver', region)
+            
+            # Get all VPCs
+            vpcs_response = ec2_client.describe_vpcs()
+            vpcs = []
+            
+            # Get firewall rule group associations
+            try:
+                associations_response = route53resolver_client.list_firewall_rule_group_associations()
+                associations = associations_response.get('FirewallRuleGroupAssociations', [])
+                protected_vpcs = {assoc.get('VpcId') for assoc in associations}
+            except ClientError:
+                protected_vpcs = set()
+            
+            for vpc in vpcs_response.get('Vpcs', []):
+                vpc_id = vpc.get('VpcId')
+                has_dns_firewall = vpc_id in protected_vpcs
+                
+                vpcs.append({
+                    'VpcId': vpc_id,
+                    'HasDNSFirewall': has_dns_firewall,
+                    'IsDefault': vpc.get('IsDefault', False)
+                })
             
-            logger.debug(f"Found {len(functions)} Lambda functions in {region}")
-            return functions
+            return vpcs
             
         except ClientError as e:
-            logger.error(f"Error retrieving Lambda functions in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving Lambda functions in {region}: {e}")
-            raise
-    
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if Lambda function has public access."""
-        function_name = resource.get('FunctionName', 'unknown')
-        has_public_access = resource.get('HasPublicAccess', False)
-        
-        if has_public_access:
-            return ComplianceResult(
-                resource_id=function_name,
-                resource_type="AWS::Lambda::Function",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="Lambda function allows public access",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        else:
-            return ComplianceResult(
-                resource_id=function_name,
-                resource_type="AWS::Lambda::Function",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason="Lambda function does not allow public access",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-
-
-class SageMakerNotebookNoDirectInternetAccessAssessment(BaseConfigRuleAssessment):
-    """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: sagemaker-notebook-no-direct-internet-access
-    
-    Ensures SageMaker notebooks do not have direct internet access.
-    """
-    
-    def __init__(self):
-        super().__init__(
-            rule_name="sagemaker-notebook-no-direct-internet-access",
-            control_id="3.3",
-            resource_types=["AWS::SageMaker::NotebookInstance"]
-        )
-    
-    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all SageMaker notebook instances in the region."""
-        if resource_type != "AWS::SageMaker::NotebookInstance":
+            logger.error(f"Error retrieving VPCs in {region}: {e}")
             return []
-        
-        try:
-            sagemaker_client = aws_factory.get_client('sagemaker', region)
-            
-            # Get all SageMaker notebook instances
-            paginator = sagemaker_client.get_paginator('list_notebook_instances')
-            notebooks = []
-            
-            for page in paginator.paginate():
-                for notebook_summary in page['NotebookInstances']:
-                    notebook_name = notebook_summary['NotebookInstanceName']
-                    
-                    try:
-                        # Get detailed notebook instance information
-                        notebook_response = sagemaker_client.describe_notebook_instance(
-                            NotebookInstanceName=notebook_name
-                        )
-                        
-                        notebooks.append({
-                            'NotebookInstanceName': notebook_name,
-                            'NotebookInstanceArn': notebook_response['NotebookInstanceArn'],
-                            'NotebookInstanceStatus': notebook_response['NotebookInstanceStatus'],
-                            'InstanceType': notebook_response['InstanceType'],
-                            'SubnetId': notebook_response.get('SubnetId', ''),
-                            'SecurityGroups': notebook_response.get('SecurityGroups', []),
-                            'DirectInternetAccess': notebook_response.get('DirectInternetAccess', 'Enabled')
-                        })
-                    
-                    except ClientError as e:
-                        logger.warning(f"Error getting details for SageMaker notebook {notebook_name}: {e}")
-                        continue
-            
-            logger.debug(f"Found {len(notebooks)} SageMaker notebook instances in {region}")
-            return notebooks
-            
-        except ClientError as e:
-            logger.error(f"Error retrieving SageMaker notebook instances in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving SageMaker notebook instances in {region}: {e}")
-            raise
     
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if SageMaker notebook has direct internet access."""
-        notebook_name = resource.get('NotebookInstanceName', 'unknown')
-        status = resource.get('NotebookInstanceStatus', '')
-        direct_internet_access = resource.get('DirectInternetAccess', 'Enabled')
-        
-        # Skip deleted notebooks
-        if status == 'Deleting':
-            return ComplianceResult(
-                resource_id=notebook_name,
-                resource_type="AWS::SageMaker::NotebookInstance",
-                compliance_status=ComplianceStatus.NOT_APPLICABLE,
-                evaluation_reason=f"SageMaker notebook {notebook_name} is being deleted",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        
-        if direct_internet_access == 'Enabled':
-            return ComplianceResult(
-                resource_id=notebook_name,
-                resource_type="AWS::SageMaker::NotebookInstance",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="SageMaker notebook has direct internet access enabled",
-                config_rule_name=self.rule_name,
-                region=region
-            )
+    def _evaluate_resource_compliance(
+        self, 
+        resource: Dict[str, Any], 
+        aws_factory: AWSClientFactory, 
+        region: str
+    ) -> ComplianceResult:
+        """Evaluate if VPC has Route 53 Resolver DNS Firewall."""
+        vpc_id = resource.get('VpcId', 'unknown')
+        has_dns_firewall = resource.get('HasDNSFirewall', False)
+        is_default = resource.get('IsDefault', False)
+        
+        if is_default:
+            evaluation_reason = f"VPC {vpc_id} is default VPC (typically not used for production)"
+            compliance_status = ComplianceStatus.NOT_APPLICABLE
+        elif has_dns_firewall:
+            evaluation_reason = f"VPC {vpc_id} has Route 53 Resolver DNS Firewall enabled"
+            compliance_status = ComplianceStatus.COMPLIANT
         else:
-            return ComplianceResult(
-                resource_id=notebook_name,
-                resource_type="AWS::SageMaker::NotebookInstance",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason="SageMaker notebook does not have direct internet access",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-
-
-class SubnetAutoAssignPublicIPDisabledAssessment(BaseConfigRuleAssessment):
-    """
-    CIS Control 3.3 - Configure Data Access Control Lists
-    AWS Config Rule: subnet-auto-assign-public-ip-disabled
-    
-    Ensures subnets do not automatically assign public IPs to prevent accidental exposure.
-    """
-    
-    def __init__(self):
-        super().__init__(
-            rule_name="subnet-auto-assign-public-ip-disabled",
-            control_id="3.3",
-            resource_types=["AWS::EC2::Subnet"]
+            evaluation_reason = f"VPC {vpc_id} does not have Route 53 Resolver DNS Firewall enabled"
+            compliance_status = ComplianceStatus.NON_COMPLIANT
+        
+        return ComplianceResult(
+            resource_id=vpc_id,
+            resource_type="AWS::EC2::VPC",
+            compliance_status=compliance_status,
+            evaluation_reason=evaluation_reason,
+            config_rule_name=self.rule_name,
+            region=region
         )
     
-    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
-        """Get all subnets in the region."""
-        if resource_type != "AWS::EC2::Subnet":
-            return []
-        
-        try:
-            ec2_client = aws_factory.get_client('ec2', region)
-            
-            # Get all subnets
-            paginator = ec2_client.get_paginator('describe_subnets')
-            subnets = []
-            
-            for page in paginator.paginate():
-                for subnet in page['Subnets']:
-                    subnets.append({
-                        'SubnetId': subnet['SubnetId'],
-                        'VpcId': subnet['VpcId'],
-                        'AvailabilityZone': subnet['AvailabilityZone'],
-                        'CidrBlock': subnet['CidrBlock'],
-                        'MapPublicIpOnLaunch': subnet.get('MapPublicIpOnLaunch', False),
-                        'State': subnet.get('State', ''),
-                        'Tags': subnet.get('Tags', [])
-                    })
-            
-            logger.debug(f"Found {len(subnets)} subnets in {region}")
-            return subnets
-            
-        except ClientError as e:
-            logger.error(f"Error retrieving subnets in {region}: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Unexpected error retrieving subnets in {region}: {e}")
-            raise
-    
-    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
-        """Evaluate if subnet auto-assigns public IPs."""
-        subnet_id = resource.get('SubnetId', 'unknown')
-        map_public_ip = resource.get('MapPublicIpOnLaunch', False)
-        state = resource.get('State', '')
-        
-        # Skip subnets that are not available
-        if state != 'available':
-            return ComplianceResult(
-                resource_id=subnet_id,
-                resource_type="AWS::EC2::Subnet",
-                compliance_status=ComplianceStatus.NOT_APPLICABLE,
-                evaluation_reason=f"Subnet {subnet_id} is in state '{state}'",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        
-        if map_public_ip:
-            return ComplianceResult(
-                resource_id=subnet_id,
-                resource_type="AWS::EC2::Subnet",
-                compliance_status=ComplianceStatus.NON_COMPLIANT,
-                evaluation_reason="Subnet automatically assigns public IP addresses",
-                config_rule_name=self.rule_name,
-                region=region
-            )
-        else:
-            return ComplianceResult(
-                resource_id=subnet_id,
-                resource_type="AWS::EC2::Subnet",
-                compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason="Subnet does not automatically assign public IP addresses",
-                config_rule_name=self.rule_name,
-                region=region
-            )
+    def _get_rule_remediation_steps(self) -> List[str]:
+        """Get remediation steps for enabling DNS Firewall."""
+        return [
+            "1. Create DNS Firewall rule group:",
+            "   aws route53resolver create-firewall-rule-group \\",
+            "     --name block-malicious-domains \\",
+            "     --creator-request-id $(uuidgen)",
+            "",
+            "2. Add rules to block malicious domains:",
+            "   aws route53resolver create-firewall-rule \\",
+            "     --firewall-rule-group-id <group-id> \\",
+            "     --firewall-domain-list-id <list-id> \\",
+            "     --priority 100 \\",
+            "     --action BLOCK",
+            "",
+            "3. Associate rule group with VPC:",
+            "   aws route53resolver associate-firewall-rule-group \\",
+            "     --firewall-rule-group-id <group-id> \\",
+            "     --vpc-id <vpc-id> \\",
+            "     --priority 100 \\",
+            "     --name vpc-protection",
+            "",
+            "4. Console method:",
+            "   - Navigate to Route 53 > Resolver > DNS Firewall",
+            "   - Create rule group",
+            "   - Add domain lists and rules",
+            "   - Associate with VPCs",
+            "",
+            "Priority: MEDIUM - DNS-level threat protection",
+            "Effort: Medium - Requires rule configuration",
+            "",
+            "AWS Documentation:",
+            "https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall.html"
+        ]