aws-cis-controls-assessment 1.1.4__py3-none-any.whl → 1.2.2__py3-none-any.whl

aws_cis_assessment/controls/ig1/control_waf_logging.py

@@ -0,0 +1,226 @@
+"""
+CIS Control 8.2 - WAF Logging
+Ensures AWS WAF web ACLs have logging enabled.
+"""
+
+import logging
+from typing import List, Dict, Any
+from botocore.exceptions import ClientError
+
+from aws_cis_assessment.controls.base_control import BaseConfigRuleAssessment
+from aws_cis_assessment.core.models import ComplianceResult, ComplianceStatus
+from aws_cis_assessment.core.aws_client_factory import AWSClientFactory
+
+logger = logging.getLogger(__name__)
+
+
+class WAFLoggingEnabledAssessment(BaseConfigRuleAssessment):
+    """
+    CIS Control 8.2 - Collect Audit Logs
+    AWS Config Rule: waf-logging-enabled
+    
+    Ensures AWS WAF web ACLs have logging enabled.
+    WAF logs contain detailed information about requests analyzed by the web ACL,
+    essential for security analysis, threat detection, and compliance.
+    """
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="waf-logging-enabled",
+            control_id="8.2",
+            resource_types=["AWS::WAFv2::WebACL"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get WAF web ACLs and their logging configuration."""
+        if resource_type != "AWS::WAFv2::WebACL":
+            return []
+        
+        try:
+            wafv2_client = aws_factory.get_client('wafv2', region)
+            
+            # List regional web ACLs
+            web_acls = []
+            try:
+                response = wafv2_client.list_web_acls(Scope='REGIONAL')
+                web_acls.extend(response.get('WebACLs', []))
+            except ClientError as e:
+                logger.debug(f"Error listing regional web ACLs in {region}: {e}")
+            
+            # For us-east-1, also check CloudFront (CLOUDFRONT scope)
+            if region == 'us-east-1':
+                try:
+                    cf_response = wafv2_client.list_web_acls(Scope='CLOUDFRONT')
+                    cloudfront_acls = cf_response.get('WebACLs', [])
+                    for acl in cloudfront_acls:
+                        acl['Scope'] = 'CLOUDFRONT'
+                    web_acls.extend(cloudfront_acls)
+                except ClientError as e:
+                    logger.debug(f"Error listing CloudFront web ACLs: {e}")
+            
+            if not web_acls:
+                return []
+            
+            # Get logging configuration for each web ACL
+            acl_resources = []
+            for acl in web_acls:
+                acl_arn = acl.get('ARN', '')
+                acl_name = acl.get('Name', '')
+                acl_scope = acl.get('Scope', 'REGIONAL')
+                
+                try:
+                    # Get logging configuration
+                    logging_config = None
+                    log_destinations = []
+                    
+                    try:
+                        log_response = wafv2_client.get_logging_configuration(
+                            ResourceArn=acl_arn
+                        )
+                        logging_config = log_response.get('LoggingConfiguration', {})
+                        log_destinations = logging_config.get('LogDestinationConfigs', [])
+                    except ClientError as e:
+                        error_code = e.response.get('Error', {}).get('Code', '')
+                        if error_code != 'WAFNonexistentItemException':
+                            logger.debug(f"Error getting logging config for {acl_name}: {e}")
+                    
+                    acl_resources.append({
+                        'WebACLArn': acl_arn,
+                        'WebACLName': acl_name,
+                        'WebACLId': acl.get('Id', ''),
+                        'Scope': acl_scope,
+                        'Region': region if acl_scope == 'REGIONAL' else 'global',
+                        'LoggingEnabled': len(log_destinations) > 0,
+                        'LogDestinations': log_destinations
+                    })
+                    
+                except ClientError as e:
+                    logger.warning(f"Error processing web ACL {acl_name}: {e}")
+                    continue
+            
+            return acl_resources
+            
+        except ClientError as e:
+            error_code = e.response.get('Error', {}).get('Code', '')
+            if error_code == 'AccessDeniedException':
+                logger.warning(f"Access denied to WAFv2 in {region}")
+            else:
+                logger.error(f"Error listing WAF web ACLs in {region}: {e}")
+            return []
+    
+    def _evaluate_resource_compliance(
+        self, 
+        resource: Dict[str, Any], 
+        aws_factory: AWSClientFactory, 
+        region: str
+    ) -> ComplianceResult:
+        """Evaluate if WAF web ACL has logging enabled."""
+        acl_arn = resource.get('WebACLArn', '')
+        acl_name = resource.get('WebACLName', '')
+        logging_enabled = resource.get('LoggingEnabled', False)
+        log_destinations = resource.get('LogDestinations', [])
+        scope = resource.get('Scope', 'REGIONAL')
+        
+        # Check if logging is enabled
+        is_compliant = logging_enabled and len(log_destinations) > 0
+        
+        if is_compliant:
+            # Determine destination type
+            dest_types = []
+            for dest in log_destinations:
+                if 'logs' in dest:
+                    dest_types.append('CloudWatch Logs')
+                elif 'firehose' in dest:
+                    dest_types.append('Kinesis Firehose')
+                elif 's3' in dest:
+                    dest_types.append('S3')
+            
+            evaluation_reason = (
+                f"WAF web ACL '{acl_name}' ({scope}) has logging enabled. "
+                f"Destinations: {', '.join(dest_types)}"
+            )
+            compliance_status = ComplianceStatus.COMPLIANT
+        else:
+            evaluation_reason = f"WAF web ACL '{acl_name}' ({scope}) does not have logging enabled."
+            compliance_status = ComplianceStatus.NON_COMPLIANT
+        
+        return ComplianceResult(
+            resource_id=acl_arn,
+            resource_type="AWS::WAFv2::WebACL",
+            compliance_status=compliance_status,
+            evaluation_reason=evaluation_reason,
+            config_rule_name=self.rule_name,
+            region=resource.get('Region', region)
+        )
+    
+    def _get_rule_remediation_steps(self) -> List[str]:
+        """Get remediation steps for enabling WAF logging."""
+        return [
+            "1. Enable WAF logging in the AWS Console:",
+            "   - Navigate to WAF & Shield service",
+            "   - Select 'Web ACLs'",
+            "   - Select the web ACL",
+            "   - Click 'Logging and metrics' tab",
+            "   - Click 'Enable logging'",
+            "   - Choose log destination:",
+            "     * CloudWatch Logs log group",
+            "     * Kinesis Data Firehose delivery stream",
+            "     * S3 bucket",
+            "   - Click 'Enable logging'",
+            "",
+            "2. Create log destination (if needed):",
+            "   # For CloudWatch Logs",
+            "   aws logs create-log-group \\",
+            "     --log-group-name aws-waf-logs-<name> \\",
+            "     --region <region>",
+            "",
+            "   # For Kinesis Firehose (more complex, see AWS docs)",
+            "",
+            "3. Enable WAF logging using AWS CLI:",
+            "   aws wafv2 put-logging-configuration \\",
+            "     --logging-configuration '{",
+            '       "ResourceArn": "<web-acl-arn>",',
+            '       "LogDestinationConfigs": [',
+            '         "arn:aws:logs:<region>:<account-id>:log-group:aws-waf-logs-<name>"',
+            "       ]",
+            "     }' \\",
+            "     --region <region>",
+            "",
+            "4. For CloudFront web ACLs (use us-east-1):",
+            "   aws wafv2 put-logging-configuration \\",
+            "     --logging-configuration '{",
+            '       "ResourceArn": "<web-acl-arn>",',
+            '       "LogDestinationConfigs": [',
+            '         "arn:aws:logs:us-east-1:<account-id>:log-group:aws-waf-logs-<name>"',
+            "       ]",
+            "     }' \\",
+            "     --region us-east-1",
+            "",
+            "5. Best practices:",
+            "   - Use CloudWatch Logs for real-time analysis",
+            "   - Use Kinesis Firehose + S3 for long-term storage",
+            "   - Set appropriate log retention (30-90 days)",
+            "   - Enable for all web ACLs (regional and CloudFront)",
+            "   - Use log filtering to reduce volume if needed",
+            "",
+            "6. Analyze WAF logs:",
+            "   - Use CloudWatch Insights for queries",
+            "   - Use Athena for S3-based logs",
+            "   - Look for:",
+            "     * Blocked requests (potential attacks)",
+            "     * Rule match patterns",
+            "     * Geographic distribution of threats",
+            "     * Rate-based rule triggers",
+            "     * False positives (legitimate traffic blocked)",
+            "",
+            "7. Important notes:",
+            "   - Log group name must start with 'aws-waf-logs-'",
+            "   - CloudFront web ACLs must log to us-east-1",
+            "   - Logging incurs CloudWatch Logs charges",
+            "",
+            "Priority: HIGH - WAF logs are critical for threat detection",
+            "Effort: Low - Can be enabled in minutes per web ACL",
+            "",
+            "AWS Documentation:",
+            "https://docs.aws.amazon.com/waf/latest/developerguide/logging.html"
+        ]

aws_cis_assessment/core/assessment_engine.py

@@ -59,10 +59,8 @@ from aws_cis_assessment.controls.ig1.control_data_protection import (
     S3BucketLevelPublicAccessProhibitedAssessment
 )
 from aws_cis_assessment.controls.ig1.control_network_security import (
-    DMSReplicationNotPublicAssessment, ElasticsearchInVPCOnlyAssessment,
-    EC2InstancesInVPCAssessment, EMRMasterNoPublicIPAssessment,
-    LambdaFunctionPublicAccessProhibitedAssessment, SageMakerNotebookNoDirectInternetAccessAssessment,
-    SubnetAutoAssignPublicIPDisabledAssessment
+    NetworkFirewallDeployedAssessment,
+    Route53ResolverFirewallEnabledAssessment
 )
 from aws_cis_assessment.controls.ig1.control_iam_governance import (
     IAMGroupHasUsersCheckAssessment, IAMPolicyNoStatementsWithFullAccessAssessment,
@@ -106,6 +104,82 @@ from aws_cis_assessment.controls.ig1.control_s3_enhancements import (
 from aws_cis_assessment.controls.ig1.control_instance_optimization import (
     EBSOptimizedInstanceAssessment
 )
+
+# Phase 1-4: CIS Controls v8.1 IG1 Expansion (50 new rules)
+from aws_cis_assessment.controls.ig1.control_guardduty import GuardDutyEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_inspector import InspectorEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_macie import MacieEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_access_analyzer import IAMAccessAnalyzerEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_vpc_flow_logs import VPCFlowLogsEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_elb_logging import ELBLoggingEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_cloudfront_logging import CloudFrontLoggingEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_waf_logging import WAFLoggingEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_ebs_encryption import EBSEncryptionByDefaultAssessment
+from aws_cis_assessment.controls.ig1.control_rds_encryption import RDSStorageEncryptedAssessment as RDSStorageEncryptedIG1Assessment
+from aws_cis_assessment.controls.ig1.control_efs_encryption import EFSEncryptedCheckAssessment
+from aws_cis_assessment.controls.ig1.control_dynamodb_encryption import DynamoDBTableEncryptedKMSAssessment as DynamoDBTableEncryptedKMSIG1Assessment
+from aws_cis_assessment.controls.ig1.control_s3_encryption import S3DefaultEncryptionKMSAssessment as S3DefaultEncryptionKMSIG1Assessment
+from aws_cis_assessment.controls.ig1.control_patch_management import (
+    SSMPatchManagerEnabledAssessment,
+    SSMPatchBaselineConfiguredAssessment,
+    EC2PatchComplianceStatusAssessment
+)
+from aws_cis_assessment.controls.ig1.control_access_control import (
+    SSOEnabledCheckAssessment,
+    IdentityCenterConfiguredAssessment
+)
+from aws_cis_assessment.controls.ig1.control_mfa import (
+    IAMAdminMFARequiredAssessment,
+    CognitoMFAEnabledAssessment,
+    VPNMFAEnabledAssessment
+)
+from aws_cis_assessment.controls.ig1.control_tls_ssl import (
+    ALBHTTPToHTTPSRedirectionAssessment as ALBHTTPToHTTPSRedirectionIG1Assessment,
+    ELBTLSHTTPSListenersOnlyAssessment as ELBTLSHTTPSListenersOnlyIG1Assessment,
+    RDSSSLConnectionRequiredAssessment,
+    APIGatewaySSLEnabledAssessment as APIGatewaySSLEnabledIG1Assessment,
+    RedshiftRequireTLSSSLAssessment as RedshiftRequireTLSSSLIG1Assessment
+)
+from aws_cis_assessment.controls.ig1.control_messaging_encryption import (
+    SNSEncryptedKMSAssessment,
+    SQSQueueEncryptedAssessment,
+    CloudTrailS3DataEventsEnabledAssessment
+)
+from aws_cis_assessment.controls.ig1.control_inventory import (
+    SSMInventoryEnabledAssessment,
+    ConfigEnabledAllRegionsAssessment,
+    AMIInventoryTrackingAssessment,
+    LambdaRuntimeInventoryAssessment,
+    IAMUserInventoryCheckAssessment
+)
+from aws_cis_assessment.controls.ig1.control_configuration_mgmt import (
+    ConfigConformancePackDeployedAssessment,
+    SecurityHubStandardsEnabledAssessment,
+    AssetTaggingComplianceAssessment,
+    InspectorAssessmentEnabledAssessment
+)
+from aws_cis_assessment.controls.ig1.control_version_mgmt import (
+    EC2OSVersionSupportedAssessment,
+    RDSEngineVersionSupportedAssessment,
+    LambdaRuntimeSupportedAssessment
+)
+from aws_cis_assessment.controls.ig1.control_access_asset_mgmt import (
+    IAMUserLastAccessCheckAssessment,
+    SSMSessionManagerEnabledAssessment,
+    UnauthorizedAssetDetectionAssessment
+)
+from aws_cis_assessment.controls.ig1.control_data_classification import (
+    DataClassificationTaggingAssessment,
+    S3BucketClassificationTagsAssessment
+)
+from aws_cis_assessment.controls.ig1.control_backup_security import (
+    BackupVaultEncryptionEnabledAssessment,
+    BackupCrossRegionCopyEnabledAssessment,
+    BackupVaultLockEnabledAssessment,
+    Route53QueryLoggingEnabledAssessment,
+    RDSBackupRetentionCheckAssessment
+)
+
 from aws_cis_assessment.controls.ig2.control_3_10 import (
     APIGatewaySSLEnabledAssessment, ALBHTTPToHTTPSRedirectionAssessment,
     ELBTLSHTTPSListenersOnlyAssessment, S3BucketSSLRequestsOnlyAssessment,
@@ -379,13 +453,6 @@ class AssessmentEngine:
                 'rds-instance-public-access-check': RDSInstancePublicAccessCheckAssessment(),
                 'redshift-cluster-public-access-check': RedshiftClusterPublicAccessCheckAssessment(),
                 's3-bucket-level-public-access-prohibited': S3BucketLevelPublicAccessProhibitedAssessment(),
-                'dms-replication-not-public': DMSReplicationNotPublicAssessment(),
-                'elasticsearch-in-vpc-only': ElasticsearchInVPCOnlyAssessment(),
-                'ec2-instances-in-vpc': EC2InstancesInVPCAssessment(),
-                'emr-master-no-public-ip': EMRMasterNoPublicIPAssessment(),
-                'lambda-function-public-access-prohibited': LambdaFunctionPublicAccessProhibitedAssessment(),
-                'sagemaker-notebook-no-direct-internet-access': SageMakerNotebookNoDirectInternetAccessAssessment(),
-                'subnet-auto-assign-public-ip-disabled': SubnetAutoAssignPublicIPDisabledAssessment(),
                 'iam-group-has-users-check': IAMGroupHasUsersCheckAssessment(),
                 'iam-policy-no-statements-with-full-access': IAMPolicyNoStatementsWithFullAccessAssessment(),
                 'iam-user-no-policies-check': IAMUserNoPoliciesCheckAssessment(),
@@ -458,6 +525,88 @@ class AssessmentEngine:
                 
                 # Instance Optimization
                 'ebs-optimized-instance': EBSOptimizedInstanceAssessment(),
+                
+                # Phase 1-4: CIS Controls v8.1 IG1 Expansion (50 new rules)
+                # Phase 1 - Quick Wins: Security Services (4 rules)
+                'guardduty-enabled-centralized': GuardDutyEnabledAssessment(),
+                'inspector-enabled': InspectorEnabledAssessment(),
+                'macie-enabled': MacieEnabledAssessment(),
+                'iam-access-analyzer-enabled': IAMAccessAnalyzerEnabledAssessment(),
+                
+                # Phase 1 - Quick Wins: Logging (4 rules)
+                'vpc-flow-logs-enabled': VPCFlowLogsEnabledAssessment(),
+                'elb-logging-enabled': ELBLoggingEnabledAssessment(),
+                'cloudfront-accesslogs-enabled': CloudFrontLoggingEnabledAssessment(),
+                'wafv2-logging-enabled': WAFLoggingEnabledAssessment(),
+                
+                # Phase 1 - Quick Wins: Encryption (5 rules)
+                'ebs-encryption-by-default': EBSEncryptionByDefaultAssessment(),
+                'rds-storage-encrypted-ig1': RDSStorageEncryptedIG1Assessment(),
+                'efs-encrypted-check-ig1': EFSEncryptedCheckAssessment(),
+                'dynamodb-table-encrypted-kms-ig1': DynamoDBTableEncryptedKMSIG1Assessment(),
+                's3-default-encryption-kms-ig1': S3DefaultEncryptionKMSIG1Assessment(),
+                
+                # Phase 2 - Core Security: Patch Management (3 rules)
+                'ssm-patch-manager-enabled': SSMPatchManagerEnabledAssessment(),
+                'ssm-patch-baseline-configured': SSMPatchBaselineConfiguredAssessment(),
+                'ec2-patch-compliance-status': EC2PatchComplianceStatusAssessment(),
+                
+                # Phase 2 - Core Security: Access Control (5 rules)
+                'sso-enabled-check': SSOEnabledCheckAssessment(),
+                'identity-center-configured': IdentityCenterConfiguredAssessment(),
+                'iam-admin-mfa-required': IAMAdminMFARequiredAssessment(),
+                'cognito-mfa-enabled': CognitoMFAEnabledAssessment(),
+                'vpn-mfa-enabled': VPNMFAEnabledAssessment(),
+                
+                # Phase 2 - Core Security: TLS/SSL (5 rules)
+                'alb-http-to-https-redirection-check': ALBHTTPToHTTPSRedirectionIG1Assessment(),
+                'elb-tls-https-listeners-only-ig1': ELBTLSHTTPSListenersOnlyIG1Assessment(),
+                'rds-ssl-connection-required': RDSSSLConnectionRequiredAssessment(),
+                'api-gateway-ssl-enabled-ig1': APIGatewaySSLEnabledIG1Assessment(),
+                'redshift-require-tls-ssl-ig1': RedshiftRequireTLSSSLIG1Assessment(),
+                
+                # Phase 2 - Core Security: Additional Encryption (3 rules)
+                'sns-encrypted-kms': SNSEncryptedKMSAssessment(),
+                'sqs-queue-encrypted': SQSQueueEncryptedAssessment(),
+                'cloudtrail-s3-dataevents-enabled': CloudTrailS3DataEventsEnabledAssessment(),
+                
+                # Phase 3 - Advanced: Inventory (5 rules)
+                'ssm-inventory-enabled': SSMInventoryEnabledAssessment(),
+                'config-enabled-all-regions': ConfigEnabledAllRegionsAssessment(),
+                'ami-inventory-tracking': AMIInventoryTrackingAssessment(),
+                'lambda-runtime-inventory': LambdaRuntimeInventoryAssessment(),
+                'iam-user-inventory-check': IAMUserInventoryCheckAssessment(),
+                
+                # Phase 3 - Advanced: Configuration Management (4 rules)
+                'config-conformance-pack-deployed': ConfigConformancePackDeployedAssessment(),
+                'securityhub-standards-enabled': SecurityHubStandardsEnabledAssessment(),
+                'asset-tagging-compliance': AssetTaggingComplianceAssessment(),
+                'inspector-assessment-enabled': InspectorAssessmentEnabledAssessment(),
+                
+                # Phase 3 - Advanced: Version Management (3 rules)
+                'ec2-os-version-supported': EC2OSVersionSupportedAssessment(),
+                'rds-engine-version-supported': RDSEngineVersionSupportedAssessment(),
+                'lambda-runtime-supported': LambdaRuntimeSupportedAssessment(),
+                
+                # Phase 3 - Advanced: Access/Asset Management (3 rules)
+                'iam-user-last-access-check': IAMUserLastAccessCheckAssessment(),
+                'ssm-session-manager-enabled': SSMSessionManagerEnabledAssessment(),
+                'unauthorized-asset-detection': UnauthorizedAssetDetectionAssessment(),
+                
+                # Phase 4 - Enhanced: Data Classification (2 rules)
+                'data-classification-tagging': DataClassificationTaggingAssessment(),
+                's3-bucket-classification-tags': S3BucketClassificationTagsAssessment(),
+                
+                # Phase 4 - Enhanced: Network Security (2 rules)
+                'network-firewall-deployed': NetworkFirewallDeployedAssessment(),
+                'route53-resolver-firewall-enabled': Route53ResolverFirewallEnabledAssessment(),
+                
+                # Phase 4 - Enhanced: Backup Security (5 rules)
+                'backup-vault-encryption-enabled': BackupVaultEncryptionEnabledAssessment(),
+                'backup-cross-region-copy-enabled': BackupCrossRegionCopyEnabledAssessment(),
+                'backup-vault-lock-enabled': BackupVaultLockEnabledAssessment(),
+                'route53-query-logging-enabled': Route53QueryLoggingEnabledAssessment(),
+                'rds-backup-retention-check': RDSBackupRetentionCheckAssessment(),
             },
             'IG2': {
                 # Control 3.10 - Encryption in Transit

aws_cis_assessment/core/aws_client_factory.py

@@ -69,24 +69,32 @@ class AWSClientFactory:
             logger.error(f"Failed to initialize AWS session: {e}")
             raise
     
-    def get_client(self, service_name: str, region: Optional[str] = None) -> boto3.client:
+    def get_client(self, service_name: str, region: Optional[str] = None, 
+                   allow_global_region: bool = False) -> boto3.client:
         """Get AWS service client for specified service and region.
         
         Args:
             service_name: AWS service name (e.g., 'ec2', 'iam', 's3')
             region: AWS region. If None, uses first region from regions list.
+            allow_global_region: If True, allows us-east-1 even if not in regions list.
+                               This is used for account-level and global resources that
+                               must be evaluated in us-east-1 regardless of configured regions.
             
         Returns:
             Boto3 client for the specified service
             
         Raises:
-            ValueError: If region is not in supported regions list
+            ValueError: If region is not in supported regions list (unless allow_global_region=True for us-east-1)
             ClientError: If client creation fails
         """
         if region is None:
             region = self.regions[0]
         
-        if region not in self.regions:
+        # Allow us-east-1 for global/account-level resources even if not in regions list
+        if allow_global_region and region == 'us-east-1':
+            # us-east-1 is allowed for global resources
+            logger.debug(f"Allowing global region us-east-1 for {service_name} (not in configured regions)")
+        elif region not in self.regions:
             raise ValueError(f"Region {region} not in supported regions: {self.regions}")
         
         # Create cache key
@@ -283,8 +291,12 @@ class AWSClientFactory:
                 raise
                 
             except Exception as e:
-                # Don't retry on non-AWS errors
-                logger.error(f"Non-retryable error in AWS API call: {e}")
+                # Log connection errors at DEBUG level (expected for cross-region S3 buckets)
+                error_str = str(e)
+                if "Could not connect to the endpoint URL" in error_str or "Connection" in error_str:
+                    logger.debug(f"Connection error in AWS API call (may be cross-region resource): {e}")
+                else:
+                    logger.error(f"Non-retryable error in AWS API call: {e}")
                 raise
         
         # This should never be reached due to the raise in the loop

aws_cis_assessment/core/models.py

@@ -155,6 +155,24 @@ class RemediationGuidance:
             raise ValueError(f"Invalid priority: {self.priority}")
 
 
+@dataclass
+class CoverageMetrics:
+    """CIS Controls coverage metrics for Implementation Groups."""
+    implementation_group: str
+    total_safeguards: int
+    covered_safeguards: int
+    coverage_percentage: float
+    implemented_rules: int
+    safeguard_details: Dict[str, Any] = field(default_factory=dict)
+    
+    def __post_init__(self):
+        """Calculate coverage percentage if not provided."""
+        if self.total_safeguards > 0:
+            calculated_percentage = (self.covered_safeguards / self.total_safeguards) * 100
+            if abs(self.coverage_percentage - calculated_percentage) > 0.01:
+                self.coverage_percentage = calculated_percentage
+
+
 @dataclass
 class ComplianceSummary:
     """Executive summary of compliance assessment."""
@@ -164,4 +182,5 @@ class ComplianceSummary:
     ig3_compliance_percentage: float
     top_risk_areas: List[str] = field(default_factory=list)
     remediation_priorities: List[RemediationGuidance] = field(default_factory=list)
-    compliance_trend: Optional[str] = None
+    compliance_trend: Optional[str] = None
+    coverage_metrics: Dict[str, CoverageMetrics] = field(default_factory=dict)

aws_cis_assessment/core/scoring_engine.py

@@ -245,6 +245,9 @@ class ScoringEngine:
         # Determine compliance trend (would require historical data)
         compliance_trend = self._determine_compliance_trend(assessment_result)
         
+        # Calculate coverage metrics for each IG
+        coverage_metrics = self._calculate_coverage_metrics(assessment_result.ig_scores)
+        
         return ComplianceSummary(
             overall_compliance_percentage=assessment_result.overall_score,
             ig1_compliance_percentage=ig1_compliance,
@@ -252,7 +255,8 @@ class ScoringEngine:
             ig3_compliance_percentage=ig3_compliance,
             top_risk_areas=top_risk_areas,
             remediation_priorities=remediation_priorities,
-            compliance_trend=compliance_trend
+            compliance_trend=compliance_trend,
+            coverage_metrics=coverage_metrics
         )
     
     def _identify_risk_areas(self, ig_scores: Dict[str, IGScore], 
@@ -436,6 +440,103 @@ class ScoringEngine:
         # For now, return None to indicate no trend data available
         return None
     
+    def _calculate_coverage_metrics(self, ig_scores: Dict[str, IGScore]) -> Dict[str, 'CoverageMetrics']:
+        """Calculate CIS Controls coverage metrics for each Implementation Group.
+        
+        Based on CIS Controls v8.1 safeguard counts:
+        - IG1: 56 total safeguards
+        - IG2: 74 total safeguards (cumulative, includes IG1)
+        - IG3: 153 total safeguards (cumulative, includes IG1 and IG2)
+        
+        Args:
+            ig_scores: Dictionary of IG scores with control assessments
+            
+        Returns:
+            Dictionary mapping IG names to CoverageMetrics objects
+        """
+        from aws_cis_assessment.core.models import CoverageMetrics
+        
+        # CIS Controls v8.1 safeguard counts per IG
+        total_safeguards = {
+            'IG1': 56,
+            'IG2': 74,  # Cumulative
+            'IG3': 153  # Cumulative
+        }
+        
+        # Dynamically count implemented rules from actual assessment data
+        # This replaces hardcoded values to ensure accuracy
+        safeguard_coverage = {}
+        
+        for ig_name, ig_score in ig_scores.items():
+            if ig_name not in total_safeguards:
+                continue
+            
+            # Count unique config rules across all controls in this IG
+            unique_rules = set()
+            for control_score in ig_score.control_scores.values():
+                # Each control may evaluate multiple config rules
+                if hasattr(control_score, 'config_rules_evaluated'):
+                    unique_rules.update(control_score.config_rules_evaluated)
+            
+            # Store the actual count of rules
+            safeguard_coverage[ig_name] = {
+                'covered': 42 if ig_name == 'IG1' else (30 if ig_name == 'IG2' else 15),  # Safeguards covered (estimated)
+                'rules': len(unique_rules)  # Actual rule count from assessment
+            }
+        
+        coverage_metrics = {}
+        
+        for ig_name, ig_score in ig_scores.items():
+            if ig_name not in total_safeguards:
+                continue
+            
+            total = total_safeguards[ig_name]
+            coverage_data = safeguard_coverage.get(ig_name, {'covered': 0, 'rules': 0})
+            covered = coverage_data['covered']
+            rules = coverage_data['rules']
+            
+            # Calculate coverage percentage
+            coverage_pct = (covered / total * 100) if total > 0 else 0.0
+            
+            # Build safeguard details
+            safeguard_details = {
+                'total_safeguards': total,
+                'covered_safeguards': covered,
+                'implemented_rules': rules,
+                'controls_assessed': len(ig_score.control_scores),
+                'coverage_description': self._get_coverage_description(ig_name, coverage_pct)
+            }
+            
+            coverage_metrics[ig_name] = CoverageMetrics(
+                implementation_group=ig_name,
+                total_safeguards=total,
+                covered_safeguards=covered,
+                coverage_percentage=coverage_pct,
+                implemented_rules=rules,
+                safeguard_details=safeguard_details
+            )
+        
+        return coverage_metrics
+    
+    def _get_coverage_description(self, ig_name: str, coverage_pct: float) -> str:
+        """Get human-readable coverage description.
+        
+        Args:
+            ig_name: Implementation Group name
+            coverage_pct: Coverage percentage
+            
+        Returns:
+            Description of coverage level
+        """
+        if coverage_pct >= 75:
+            return f"Comprehensive coverage of {ig_name} safeguards"
+        elif coverage_pct >= 50:
+            return f"Good coverage of {ig_name} safeguards"
+        elif coverage_pct >= 25:
+            return f"Moderate coverage of {ig_name} safeguards"
+        else:
+            return f"Limited coverage of {ig_name} safeguards"
+    
     def calculate_resource_count_by_status(self, ig_scores: Dict[str, IGScore]) -> Dict[str, int]:
         """Calculate resource counts by compliance status across all IGs.