aws-cis-controls-assessment 1.2.0__py3-none-any.whl → 1.2.2__py3-none-any.whl

aws_cis_assessment/__init__.py

@@ -6,6 +6,6 @@ CIS Controls Implementation Groups (IG1, IG2, IG3). Implements 175 comprehensive
 across all implementation groups with 75%+ coverage of CIS Controls v8.1 IG1 safeguards.
 """
 
-__version__ = "1.2.0"
+__version__ = "1.2.2"
 __author__ = "AWS CIS Assessment Team"
 __description__ = "Production-ready AWS CIS Controls Compliance Assessment Framework with Enhanced IG1 Coverage"

aws_cis_assessment/config/rules/cis_controls_ig1.yaml

@@ -917,12 +917,12 @@ controls:
     title: Encrypt Sensitive Data in Transit
     weight: 1.0
     config_rules:
-    - name: alb-http-to-https-redirection
+    - name: alb-http-to-https-redirection-check
       resource_types:
       - AWS::ElasticLoadBalancingV2::LoadBalancer
       parameters: {}
-      description: "CIS Control 3.10 - Encrypt Sensitive Data in Transit\n    AWS Config Rule: alb-http-to-https-redirection\n    \n    Ensures Application Load Balancers redirect HTTP traffic to HTTPS."
-      remediation_guidance: Follow AWS Config rule guidance for alb-http-to-https-redirection
+      description: "CIS Control 3.10 - Encrypt Sensitive Data in Transit\n    AWS Config Rule: alb-http-to-https-redirection-check\n    \n    Ensures Application Load Balancers redirect HTTP traffic to HTTPS."
+      remediation_guidance: Follow AWS Config rule guidance for alb-http-to-https-redirection-check
     - name: elb-tls-https-listeners-only
       resource_types:
       - AWS::ElasticLoadBalancingV2::LoadBalancer

aws_cis_assessment/controls/base_control.py

@@ -56,25 +56,37 @@ class BaseConfigRuleAssessment(ABC):
         results = []
         
         try:
-            # Validate that we can access required services
-            if not self._validate_service_access(aws_factory, region):
-                return [self._create_error_result(
-                    "SERVICE_UNAVAILABLE",
-                    f"Required AWS services not accessible in region {region}",
-                    region
-                )]
-            
             # Evaluate each resource type
             for resource_type in self.resource_types:
                 try:
+                    # Determine evaluation region (us-east-1 for account-level resources)
+                    eval_region = self._get_evaluation_region(resource_type, region)
+                    is_account_level = self._is_account_level_resource(resource_type)
+                    
+                    # Skip account-level resources in non-primary regions to prevent duplication
+                    # Account-level resources are only evaluated once in us-east-1
+                    if is_account_level and region != 'us-east-1':
+                        logger.debug(f"Skipping {resource_type} in {region} (account-level resource, evaluated in us-east-1 only)")
+                        continue
+                    
+                    # Validate that we can access required services in the evaluation region
+                    if not self._validate_service_access(aws_factory, eval_region):
+                        results.append(self._create_error_result(
+                            "SERVICE_UNAVAILABLE",
+                            f"Required AWS services not accessible in region {eval_region}",
+                            eval_region,
+                            resource_type
+                        ))
+                        continue
+                    
                     # Use error handler for resource discovery if available
                     def get_resources():
-                        return self._get_resources(aws_factory, resource_type, region)
+                        return self._get_resources(aws_factory, resource_type, eval_region)
                     
                     if self.error_handler:
                         context = ErrorContext(
                             service_name=self._get_required_services()[0] if self._get_required_services() else "",
-                            region=region,
+                            region=eval_region,
                             resource_type=resource_type,
                             operation="get_resources",
                             control_id=self.control_id,
@@ -90,18 +102,18 @@ class BaseConfigRuleAssessment(ABC):
                     else:
                         resources = get_resources()
                     
-                    logger.debug(f"Found {len(resources)} resources of type {resource_type} in {region}")
+                    logger.debug(f"Found {len(resources)} resources of type {resource_type} in {eval_region}")
                     
                     for resource in resources:
                         try:
                             # Use error handler for resource evaluation if available
                             def evaluate_resource():
-                                return self._evaluate_resource_compliance(resource, aws_factory, region)
+                                return self._evaluate_resource_compliance(resource, aws_factory, eval_region)
                             
                             if self.error_handler:
                                 context = ErrorContext(
                                     service_name=self._get_required_services()[0] if self._get_required_services() else "",
-                                    region=region,
+                                    region=eval_region,
                                     resource_type=resource_type,
                                     resource_id=resource.get('id', 'unknown'),
                                     operation="evaluate_compliance",
@@ -121,13 +133,20 @@ class BaseConfigRuleAssessment(ABC):
                             results.append(compliance)
                             
                         except Exception as e:
-                            logger.error(f"Error evaluating resource {resource.get('id', 'unknown')}: {e}")
+                            error_str = str(e)
+                            # Log expected errors at DEBUG level
+                            if ("Parameter validation failed" in error_str or 
+                                "Missing required parameter" in error_str or
+                                "Could not connect to the endpoint URL" in error_str):
+                                logger.debug(f"Expected error for resource {resource.get('id', 'unknown')}: {e}")
+                            else:
+                                logger.error(f"Error evaluating resource {resource.get('id', 'unknown')}: {e}")
                             
                             # Handle error with error handler if available
                             if self.error_handler:
                                 context = ErrorContext(
                                     service_name=self._get_required_services()[0] if self._get_required_services() else "",
-                                    region=region,
+                                    region=eval_region,
                                     resource_type=resource_type,
                                     resource_id=resource.get('id', 'unknown'),
                                     operation="evaluate_compliance",
@@ -139,19 +158,27 @@ class BaseConfigRuleAssessment(ABC):
                             results.append(self._create_error_result(
                                 resource.get('id', 'unknown'),
                                 f"Evaluation error: {str(e)}",
-                                region,
+                                eval_region,
                                 resource_type
                             ))
                 
                 except ClientError as e:
                     error_code = e.response.get('Error', {}).get('Code', '')
-                    error_message = f"AWS API error: {str(e)}"
+                    error_message = str(e)
+                    
+                    # Log parameter validation errors at DEBUG level (expected for some resources)
+                    if 'Parameter' in error_code or 'parameter' in error_message.lower():
+                        logger.debug(f"Parameter validation error for {resource_type} in {eval_region}: {e}")
+                    elif error_code in ['AccessDenied', 'UnauthorizedOperation']:
+                        logger.debug(f"Access denied for {resource_type} in {eval_region}")
+                    else:
+                        logger.error(f"AWS API error for {resource_type} in {eval_region}: {e}")
                     
                     # Handle error with error handler if available
                     if self.error_handler:
                         context = ErrorContext(
                             service_name=self._get_required_services()[0] if self._get_required_services() else "",
-                            region=region,
+                            region=eval_region,
                             resource_type=resource_type,
                             operation="get_resources",
                             control_id=self.control_id,
@@ -163,25 +190,29 @@ class BaseConfigRuleAssessment(ABC):
                         results.append(self._create_error_result(
                             f"{resource_type}_PERMISSION_ERROR",
                             f"Insufficient permissions to evaluate {resource_type}",
-                            region,
+                            eval_region,
                             resource_type
                         ))
                     else:
                         results.append(self._create_error_result(
                             f"{resource_type}_API_ERROR",
-                            error_message,
-                            region,
+                            f"AWS API error: {error_message}",
+                            eval_region,
                             resource_type
                         ))
                 
                 except Exception as e:
-                    logger.error(f"Unexpected error evaluating {resource_type}: {e}")
+                    # Log parameter validation errors at DEBUG level (expected for some resources)
+                    if "Parameter validation failed" in str(e) or "Missing required parameter" in str(e):
+                        logger.debug(f"Parameter validation error for {resource_type} in {eval_region}: {e}")
+                    else:
+                        logger.error(f"Unexpected error evaluating {resource_type}: {e}")
                     
                     # Handle error with error handler if available
                     if self.error_handler:
                         context = ErrorContext(
                             service_name=self._get_required_services()[0] if self._get_required_services() else "",
-                            region=region,
+                            region=eval_region,
                             resource_type=resource_type,
                             operation="evaluate_resource_type",
                             control_id=self.control_id,
@@ -192,7 +223,7 @@ class BaseConfigRuleAssessment(ABC):
                     results.append(self._create_error_result(
                         f"{resource_type}_UNKNOWN_ERROR",
                         f"Unexpected error: {str(e)}",
-                        region,
+                        eval_region,
                         resource_type
                     ))
         
@@ -298,6 +329,57 @@ class BaseConfigRuleAssessment(ABC):
         
         return list(services)
     
+    def _is_account_level_resource(self, resource_type: str) -> bool:
+        """Check if resource type is account-level (global).
+        
+        Account-level resources should be evaluated in us-east-1 only once,
+        not per region. This prevents duplicate evaluations and region validation errors.
+        
+        Args:
+            resource_type: AWS resource type (e.g., "AWS::::Account", "AWS::IAM::User")
+            
+        Returns:
+            True if resource is account-level/global
+        """
+        # Explicit account-level marker
+        if resource_type == 'AWS::::Account':
+            return True
+        
+        # Global services that should only be evaluated in us-east-1
+        global_service_prefixes = [
+            'AWS::IAM::',           # IAM is global
+            'AWS::CloudFront::',    # CloudFront is global
+            'AWS::Route53::',       # Route53 is global
+            'AWS::Organizations::', # Organizations is global
+        ]
+        
+        for prefix in global_service_prefixes:
+            if resource_type.startswith(prefix):
+                return True
+        
+        # S3 buckets are special - they're global but region-specific
+        # We handle them in controls by checking region == 'us-east-1'
+        
+        return False
+    
+    def _get_evaluation_region(self, resource_type: str, requested_region: str) -> str:
+        """Determine which region to use for resource evaluation.
+        
+        Account-level and global resources must be evaluated in us-east-1
+        to avoid region validation errors and ensure proper API access.
+        
+        Args:
+            resource_type: AWS resource type
+            requested_region: Region requested for evaluation
+            
+        Returns:
+            Region to use (us-east-1 for account-level, requested_region otherwise)
+        """
+        if self._is_account_level_resource(resource_type):
+            return 'us-east-1'
+        return requested_region
+    
+    
     def _create_error_result(self, resource_id: str, error_message: str, region: str, resource_type: str = "Unknown") -> ComplianceResult:
         """Create a ComplianceResult for error conditions.
         

aws_cis_assessment/controls/ig1/__init__.py

@@ -61,13 +61,8 @@ from .control_data_protection import (
 )
 
 from .control_network_security import (
-    DMSReplicationNotPublicAssessment,
-    ElasticsearchInVPCOnlyAssessment,
-    EC2InstancesInVPCAssessment,
-    EMRMasterNoPublicIPAssessment,
-    LambdaFunctionPublicAccessProhibitedAssessment,
-    SageMakerNotebookNoDirectInternetAccessAssessment,
-    SubnetAutoAssignPublicIPDisabledAssessment
+    NetworkFirewallDeployedAssessment,
+    Route53ResolverFirewallEnabledAssessment
 )
 
 from .control_iam_governance import (
@@ -143,6 +138,85 @@ from .control_instance_optimization import (
     EBSOptimizedInstanceAssessment
 )
 
+# Phase 1-4: CIS Controls v8.1 IG1 Expansion
+from .control_guardduty import GuardDutyEnabledAssessment
+from .control_inspector import InspectorEnabledAssessment
+from .control_macie import MacieEnabledAssessment
+from .control_access_analyzer import IAMAccessAnalyzerEnabledAssessment
+from .control_vpc_flow_logs import VPCFlowLogsEnabledAssessment
+from .control_elb_logging import ELBLoggingEnabledAssessment
+from .control_cloudfront_logging import CloudFrontLoggingEnabledAssessment
+from .control_waf_logging import WAFLoggingEnabledAssessment
+from .control_ebs_encryption import EBSEncryptionByDefaultAssessment
+from .control_rds_encryption import RDSStorageEncryptedAssessment
+from .control_efs_encryption import EFSEncryptedCheckAssessment
+from .control_dynamodb_encryption import DynamoDBTableEncryptedKMSAssessment
+from .control_s3_encryption import S3DefaultEncryptionKMSAssessment
+from .control_patch_management import (
+    SSMPatchManagerEnabledAssessment,
+    SSMPatchBaselineConfiguredAssessment,
+    EC2PatchComplianceStatusAssessment
+)
+from .control_access_control import (
+    SSOEnabledCheckAssessment,
+    IdentityCenterConfiguredAssessment
+)
+from .control_mfa import (
+    IAMAdminMFARequiredAssessment,
+    CognitoMFAEnabledAssessment,
+    VPNMFAEnabledAssessment
+)
+from .control_tls_ssl import (
+    ALBHTTPToHTTPSRedirectionAssessment,
+    ELBTLSHTTPSListenersOnlyAssessment,
+    RDSSSLConnectionRequiredAssessment,
+    APIGatewaySSLEnabledAssessment,
+    RedshiftRequireTLSSSLAssessment
+)
+from .control_messaging_encryption import (
+    SNSEncryptedKMSAssessment,
+    SQSQueueEncryptedAssessment,
+    CloudTrailS3DataEventsEnabledAssessment
+)
+from .control_inventory import (
+    SSMInventoryEnabledAssessment,
+    ConfigEnabledAllRegionsAssessment,
+    AMIInventoryTrackingAssessment,
+    LambdaRuntimeInventoryAssessment,
+    IAMUserInventoryCheckAssessment
+)
+from .control_configuration_mgmt import (
+    ConfigConformancePackDeployedAssessment,
+    SecurityHubStandardsEnabledAssessment,
+    AssetTaggingComplianceAssessment,
+    InspectorAssessmentEnabledAssessment
+)
+from .control_version_mgmt import (
+    EC2OSVersionSupportedAssessment,
+    RDSEngineVersionSupportedAssessment,
+    LambdaRuntimeSupportedAssessment
+)
+from .control_access_asset_mgmt import (
+    IAMUserLastAccessCheckAssessment,
+    SSMSessionManagerEnabledAssessment,
+    UnauthorizedAssetDetectionAssessment
+)
+from .control_data_classification import (
+    DataClassificationTaggingAssessment,
+    S3BucketClassificationTagsAssessment
+)
+from .control_network_security import (
+    NetworkFirewallDeployedAssessment,
+    Route53ResolverFirewallEnabledAssessment
+)
+from .control_backup_security import (
+    BackupVaultEncryptionEnabledAssessment,
+    BackupCrossRegionCopyEnabledAssessment,
+    BackupVaultLockEnabledAssessment,
+    Route53QueryLoggingEnabledAssessment,
+    RDSBackupRetentionCheckAssessment
+)
+
 __all__ = [
     # Control 1.1 - Asset Inventory
     'EIPAttachedAssessment',
@@ -171,13 +245,6 @@ __all__ = [
     'RDSInstancePublicAccessCheckAssessment',
     'RedshiftClusterPublicAccessCheckAssessment',
     'S3BucketLevelPublicAccessProhibitedAssessment',
-    'DMSReplicationNotPublicAssessment',
-    'ElasticsearchInVPCOnlyAssessment',
-    'EC2InstancesInVPCAssessment',
-    'EMRMasterNoPublicIPAssessment',
-    'LambdaFunctionPublicAccessProhibitedAssessment',
-    'SageMakerNotebookNoDirectInternetAccessAssessment',
-    'SubnetAutoAssignPublicIPDisabledAssessment',
     'IAMGroupHasUsersCheckAssessment',
     'IAMPolicyNoStatementsWithFullAccessAssessment',
     'IAMUserNoPoliciesCheckAssessment',
@@ -252,5 +319,67 @@ __all__ = [
     'S3BucketPublicWriteProhibitedAssessment',
     
     # Instance Optimization
-    'EBSOptimizedInstanceAssessment'
+    'EBSOptimizedInstanceAssessment',
+    
+    # Phase 1-4: CIS Controls v8.1 IG1 Expansion (50 new rules)
+    # Phase 1 - Quick Wins (13 rules)
+    'GuardDutyEnabledAssessment',
+    'InspectorEnabledAssessment',
+    'MacieEnabledAssessment',
+    'IAMAccessAnalyzerEnabledAssessment',
+    'VPCFlowLogsEnabledAssessment',
+    'ELBLoggingEnabledAssessment',
+    'CloudFrontLoggingEnabledAssessment',
+    'WAFLoggingEnabledAssessment',
+    'EBSEncryptionByDefaultAssessment',
+    'RDSStorageEncryptedAssessment',
+    'EFSEncryptedCheckAssessment',
+    'DynamoDBTableEncryptedKMSAssessment',
+    'S3DefaultEncryptionKMSAssessment',
+    
+    # Phase 2 - Core Security (15 rules)
+    'SSMPatchManagerEnabledAssessment',
+    'SSMPatchBaselineConfiguredAssessment',
+    'EC2PatchComplianceStatusAssessment',
+    'SSOEnabledCheckAssessment',
+    'IdentityCenterConfiguredAssessment',
+    'IAMAdminMFARequiredAssessment',
+    'CognitoMFAEnabledAssessment',
+    'VPNMFAEnabledAssessment',
+    'ALBHTTPToHTTPSRedirectionAssessment',
+    'ELBTLSHTTPSListenersOnlyAssessment',
+    'RDSSSLConnectionRequiredAssessment',
+    'APIGatewaySSLEnabledAssessment',
+    'RedshiftRequireTLSSSLAssessment',
+    'SNSEncryptedKMSAssessment',
+    'SQSQueueEncryptedAssessment',
+    'CloudTrailS3DataEventsEnabledAssessment',
+    
+    # Phase 3 - Advanced (15 rules)
+    'SSMInventoryEnabledAssessment',
+    'ConfigEnabledAllRegionsAssessment',
+    'AMIInventoryTrackingAssessment',
+    'LambdaRuntimeInventoryAssessment',
+    'IAMUserInventoryCheckAssessment',
+    'ConfigConformancePackDeployedAssessment',
+    'SecurityHubStandardsEnabledAssessment',
+    'AssetTaggingComplianceAssessment',
+    'InspectorAssessmentEnabledAssessment',
+    'EC2OSVersionSupportedAssessment',
+    'RDSEngineVersionSupportedAssessment',
+    'LambdaRuntimeSupportedAssessment',
+    'IAMUserLastAccessCheckAssessment',
+    'SSMSessionManagerEnabledAssessment',
+    'UnauthorizedAssetDetectionAssessment',
+    
+    # Phase 4 - Enhanced (7 rules)
+    'DataClassificationTaggingAssessment',
+    'S3BucketClassificationTagsAssessment',
+    'NetworkFirewallDeployedAssessment',
+    'Route53ResolverFirewallEnabledAssessment',
+    'BackupVaultEncryptionEnabledAssessment',
+    'BackupCrossRegionCopyEnabledAssessment',
+    'BackupVaultLockEnabledAssessment',
+    'Route53QueryLoggingEnabledAssessment',
+    'RDSBackupRetentionCheckAssessment'
 ]

aws_cis_assessment/controls/ig1/control_4_1.py

@@ -28,8 +28,8 @@ class AccountPartOfOrganizationsAssessment(BaseConfigRuleAssessment):
             return []
         
         try:
-            # Get account information
-            sts_client = aws_factory.get_client('sts', region)
+            # Get account information (use allow_global_region for account-level resources)
+            sts_client = aws_factory.get_client('sts', region, allow_global_region=True)
             
             response = aws_factory.aws_api_call_with_retry(
                 lambda: sts_client.get_caller_identity()
@@ -55,8 +55,8 @@ class AccountPartOfOrganizationsAssessment(BaseConfigRuleAssessment):
         account_id = resource.get('AccountId', 'unknown')
         
         try:
-            # Check if account is part of an organization
-            organizations_client = aws_factory.get_client('organizations', region)
+            # Check if account is part of an organization (use allow_global_region for account-level resources)
+            organizations_client = aws_factory.get_client('organizations', region, allow_global_region=True)
             
             # Try to describe the organization
             response = aws_factory.aws_api_call_with_retry(

aws_cis_assessment/controls/ig1/control_guardduty.py

@@ -16,8 +16,8 @@ logger = logging.getLogger(__name__)
 
 class GuardDutyEnabledAssessment(BaseConfigRuleAssessment):
     """
-    CIS Control 10.1 - Deploy and Maintain Anti-Malware Software
-    AWS Config Rule: guardduty-enabled
+    CIS Control 6.2 - Establish and Maintain a Secure Network Architecture
+    AWS Config Rule: guardduty-enabled-centralized
     
     Ensures GuardDuty is enabled for threat detection and malware defense.
     GuardDuty provides intelligent threat detection by analyzing VPC Flow Logs,
@@ -26,8 +26,8 @@ class GuardDutyEnabledAssessment(BaseConfigRuleAssessment):
     
     def __init__(self):
         super().__init__(
-            rule_name="guardduty-enabled",
-            control_id="10.1",
+            rule_name="guardduty-enabled-centralized",
+            control_id="6.2",
             resource_types=["AWS::GuardDuty::Detector"]
         )
     

aws_cis_assessment/controls/ig1/control_s3_encryption.py

@@ -304,7 +304,7 @@ class S3DefaultEncryptionKMSAssessment(BaseConfigRuleAssessment):
             '         "Rules": [{',
             '           "ApplyServerSideEncryptionByDefault": {',
             '             "SSEAlgorithm": "aws:kms",',
-            '             "KMSMasterKeyID": "'\"$KMS_KEY_ID\"'"',
+            '             "KMSMasterKeyID": "'"$KMS_KEY_ID"'"',
             "           },",
             '           "BucketKeyEnabled": true',
             "         }]",

aws_cis_assessment/controls/ig1/control_tls_ssl.py

@@ -16,16 +16,16 @@ logger = logging.getLogger(__name__)
 
 class ALBHTTPToHTTPSRedirectionAssessment(BaseConfigRuleAssessment):
     """
-    CIS Control 2.8 - Encrypt Sensitive Data in Transit
-    AWS Config Rule: alb-http-to-https-redirection
+    CIS Control 3.10 - Encrypt Sensitive Data in Transit
+    AWS Config Rule: alb-http-to-https-redirection-check
     
     Ensures Application Load Balancers redirect HTTP traffic to HTTPS.
     """
     
     def __init__(self):
         super().__init__(
-            rule_name="alb-http-to-https-redirection",
-            control_id="2.8",
+            rule_name="alb-http-to-https-redirection-check",
+            control_id="3.10",
             resource_types=["AWS::ElasticLoadBalancingV2::LoadBalancer"]
         )
     

aws_cis_assessment/controls/ig1/control_version_mgmt.py

@@ -58,7 +58,15 @@ class EC2OSVersionSupportedAssessment(BaseConfigRuleAssessment):
             return instances
             
         except ClientError as e:
-            logger.error(f"Error retrieving instance information in {region}: {e}")
+            error_code = e.response.get('Error', {}).get('Code', '')
+            # Log parameter validation errors at DEBUG level (expected for some resources)
+            if 'Parameter' in error_code or 'parameter' in str(e).lower():
+                logger.debug(f"Parameter validation issue retrieving instance information in {region}: {e}")
+            else:
+                logger.error(f"Error retrieving instance information in {region}: {e}")
+            return []
+        except Exception as e:
+            logger.error(f"Unexpected error retrieving instance information in {region}: {e}")
             return []
     
     def _check_version_support(self, platform_name: str, platform_version: str) -> bool:

aws_cis_assessment/core/assessment_engine.py

@@ -59,10 +59,8 @@ from aws_cis_assessment.controls.ig1.control_data_protection import (
     S3BucketLevelPublicAccessProhibitedAssessment
 )
 from aws_cis_assessment.controls.ig1.control_network_security import (
-    DMSReplicationNotPublicAssessment, ElasticsearchInVPCOnlyAssessment,
-    EC2InstancesInVPCAssessment, EMRMasterNoPublicIPAssessment,
-    LambdaFunctionPublicAccessProhibitedAssessment, SageMakerNotebookNoDirectInternetAccessAssessment,
-    SubnetAutoAssignPublicIPDisabledAssessment
+    NetworkFirewallDeployedAssessment,
+    Route53ResolverFirewallEnabledAssessment
 )
 from aws_cis_assessment.controls.ig1.control_iam_governance import (
     IAMGroupHasUsersCheckAssessment, IAMPolicyNoStatementsWithFullAccessAssessment,
@@ -106,6 +104,82 @@ from aws_cis_assessment.controls.ig1.control_s3_enhancements import (
 from aws_cis_assessment.controls.ig1.control_instance_optimization import (
     EBSOptimizedInstanceAssessment
 )
+
+# Phase 1-4: CIS Controls v8.1 IG1 Expansion (50 new rules)
+from aws_cis_assessment.controls.ig1.control_guardduty import GuardDutyEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_inspector import InspectorEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_macie import MacieEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_access_analyzer import IAMAccessAnalyzerEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_vpc_flow_logs import VPCFlowLogsEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_elb_logging import ELBLoggingEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_cloudfront_logging import CloudFrontLoggingEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_waf_logging import WAFLoggingEnabledAssessment
+from aws_cis_assessment.controls.ig1.control_ebs_encryption import EBSEncryptionByDefaultAssessment
+from aws_cis_assessment.controls.ig1.control_rds_encryption import RDSStorageEncryptedAssessment as RDSStorageEncryptedIG1Assessment
+from aws_cis_assessment.controls.ig1.control_efs_encryption import EFSEncryptedCheckAssessment
+from aws_cis_assessment.controls.ig1.control_dynamodb_encryption import DynamoDBTableEncryptedKMSAssessment as DynamoDBTableEncryptedKMSIG1Assessment
+from aws_cis_assessment.controls.ig1.control_s3_encryption import S3DefaultEncryptionKMSAssessment as S3DefaultEncryptionKMSIG1Assessment
+from aws_cis_assessment.controls.ig1.control_patch_management import (
+    SSMPatchManagerEnabledAssessment,
+    SSMPatchBaselineConfiguredAssessment,
+    EC2PatchComplianceStatusAssessment
+)
+from aws_cis_assessment.controls.ig1.control_access_control import (
+    SSOEnabledCheckAssessment,
+    IdentityCenterConfiguredAssessment
+)
+from aws_cis_assessment.controls.ig1.control_mfa import (
+    IAMAdminMFARequiredAssessment,
+    CognitoMFAEnabledAssessment,
+    VPNMFAEnabledAssessment
+)
+from aws_cis_assessment.controls.ig1.control_tls_ssl import (
+    ALBHTTPToHTTPSRedirectionAssessment as ALBHTTPToHTTPSRedirectionIG1Assessment,
+    ELBTLSHTTPSListenersOnlyAssessment as ELBTLSHTTPSListenersOnlyIG1Assessment,
+    RDSSSLConnectionRequiredAssessment,
+    APIGatewaySSLEnabledAssessment as APIGatewaySSLEnabledIG1Assessment,
+    RedshiftRequireTLSSSLAssessment as RedshiftRequireTLSSSLIG1Assessment
+)
+from aws_cis_assessment.controls.ig1.control_messaging_encryption import (
+    SNSEncryptedKMSAssessment,
+    SQSQueueEncryptedAssessment,
+    CloudTrailS3DataEventsEnabledAssessment
+)
+from aws_cis_assessment.controls.ig1.control_inventory import (
+    SSMInventoryEnabledAssessment,
+    ConfigEnabledAllRegionsAssessment,
+    AMIInventoryTrackingAssessment,
+    LambdaRuntimeInventoryAssessment,
+    IAMUserInventoryCheckAssessment
+)
+from aws_cis_assessment.controls.ig1.control_configuration_mgmt import (
+    ConfigConformancePackDeployedAssessment,
+    SecurityHubStandardsEnabledAssessment,
+    AssetTaggingComplianceAssessment,
+    InspectorAssessmentEnabledAssessment
+)
+from aws_cis_assessment.controls.ig1.control_version_mgmt import (
+    EC2OSVersionSupportedAssessment,
+    RDSEngineVersionSupportedAssessment,
+    LambdaRuntimeSupportedAssessment
+)
+from aws_cis_assessment.controls.ig1.control_access_asset_mgmt import (
+    IAMUserLastAccessCheckAssessment,
+    SSMSessionManagerEnabledAssessment,
+    UnauthorizedAssetDetectionAssessment
+)
+from aws_cis_assessment.controls.ig1.control_data_classification import (
+    DataClassificationTaggingAssessment,
+    S3BucketClassificationTagsAssessment
+)
+from aws_cis_assessment.controls.ig1.control_backup_security import (
+    BackupVaultEncryptionEnabledAssessment,
+    BackupCrossRegionCopyEnabledAssessment,
+    BackupVaultLockEnabledAssessment,
+    Route53QueryLoggingEnabledAssessment,
+    RDSBackupRetentionCheckAssessment
+)
+
 from aws_cis_assessment.controls.ig2.control_3_10 import (
     APIGatewaySSLEnabledAssessment, ALBHTTPToHTTPSRedirectionAssessment,
     ELBTLSHTTPSListenersOnlyAssessment, S3BucketSSLRequestsOnlyAssessment,
@@ -379,13 +453,6 @@ class AssessmentEngine:
                 'rds-instance-public-access-check': RDSInstancePublicAccessCheckAssessment(),
                 'redshift-cluster-public-access-check': RedshiftClusterPublicAccessCheckAssessment(),
                 's3-bucket-level-public-access-prohibited': S3BucketLevelPublicAccessProhibitedAssessment(),
-                'dms-replication-not-public': DMSReplicationNotPublicAssessment(),
-                'elasticsearch-in-vpc-only': ElasticsearchInVPCOnlyAssessment(),
-                'ec2-instances-in-vpc': EC2InstancesInVPCAssessment(),
-                'emr-master-no-public-ip': EMRMasterNoPublicIPAssessment(),
-                'lambda-function-public-access-prohibited': LambdaFunctionPublicAccessProhibitedAssessment(),
-                'sagemaker-notebook-no-direct-internet-access': SageMakerNotebookNoDirectInternetAccessAssessment(),
-                'subnet-auto-assign-public-ip-disabled': SubnetAutoAssignPublicIPDisabledAssessment(),
                 'iam-group-has-users-check': IAMGroupHasUsersCheckAssessment(),
                 'iam-policy-no-statements-with-full-access': IAMPolicyNoStatementsWithFullAccessAssessment(),
                 'iam-user-no-policies-check': IAMUserNoPoliciesCheckAssessment(),
@@ -458,6 +525,88 @@ class AssessmentEngine:
                 
                 # Instance Optimization
                 'ebs-optimized-instance': EBSOptimizedInstanceAssessment(),
+                
+                # Phase 1-4: CIS Controls v8.1 IG1 Expansion (50 new rules)
+                # Phase 1 - Quick Wins: Security Services (4 rules)
+                'guardduty-enabled-centralized': GuardDutyEnabledAssessment(),
+                'inspector-enabled': InspectorEnabledAssessment(),
+                'macie-enabled': MacieEnabledAssessment(),
+                'iam-access-analyzer-enabled': IAMAccessAnalyzerEnabledAssessment(),
+                
+                # Phase 1 - Quick Wins: Logging (4 rules)
+                'vpc-flow-logs-enabled': VPCFlowLogsEnabledAssessment(),
+                'elb-logging-enabled': ELBLoggingEnabledAssessment(),
+                'cloudfront-accesslogs-enabled': CloudFrontLoggingEnabledAssessment(),
+                'wafv2-logging-enabled': WAFLoggingEnabledAssessment(),
+                
+                # Phase 1 - Quick Wins: Encryption (5 rules)
+                'ebs-encryption-by-default': EBSEncryptionByDefaultAssessment(),
+                'rds-storage-encrypted-ig1': RDSStorageEncryptedIG1Assessment(),
+                'efs-encrypted-check-ig1': EFSEncryptedCheckAssessment(),
+                'dynamodb-table-encrypted-kms-ig1': DynamoDBTableEncryptedKMSIG1Assessment(),
+                's3-default-encryption-kms-ig1': S3DefaultEncryptionKMSIG1Assessment(),
+                
+                # Phase 2 - Core Security: Patch Management (3 rules)
+                'ssm-patch-manager-enabled': SSMPatchManagerEnabledAssessment(),
+                'ssm-patch-baseline-configured': SSMPatchBaselineConfiguredAssessment(),
+                'ec2-patch-compliance-status': EC2PatchComplianceStatusAssessment(),
+                
+                # Phase 2 - Core Security: Access Control (5 rules)
+                'sso-enabled-check': SSOEnabledCheckAssessment(),
+                'identity-center-configured': IdentityCenterConfiguredAssessment(),
+                'iam-admin-mfa-required': IAMAdminMFARequiredAssessment(),
+                'cognito-mfa-enabled': CognitoMFAEnabledAssessment(),
+                'vpn-mfa-enabled': VPNMFAEnabledAssessment(),
+                
+                # Phase 2 - Core Security: TLS/SSL (5 rules)
+                'alb-http-to-https-redirection-check': ALBHTTPToHTTPSRedirectionIG1Assessment(),
+                'elb-tls-https-listeners-only-ig1': ELBTLSHTTPSListenersOnlyIG1Assessment(),
+                'rds-ssl-connection-required': RDSSSLConnectionRequiredAssessment(),
+                'api-gateway-ssl-enabled-ig1': APIGatewaySSLEnabledIG1Assessment(),
+                'redshift-require-tls-ssl-ig1': RedshiftRequireTLSSSLIG1Assessment(),
+                
+                # Phase 2 - Core Security: Additional Encryption (3 rules)
+                'sns-encrypted-kms': SNSEncryptedKMSAssessment(),
+                'sqs-queue-encrypted': SQSQueueEncryptedAssessment(),
+                'cloudtrail-s3-dataevents-enabled': CloudTrailS3DataEventsEnabledAssessment(),
+                
+                # Phase 3 - Advanced: Inventory (5 rules)
+                'ssm-inventory-enabled': SSMInventoryEnabledAssessment(),
+                'config-enabled-all-regions': ConfigEnabledAllRegionsAssessment(),
+                'ami-inventory-tracking': AMIInventoryTrackingAssessment(),
+                'lambda-runtime-inventory': LambdaRuntimeInventoryAssessment(),
+                'iam-user-inventory-check': IAMUserInventoryCheckAssessment(),
+                
+                # Phase 3 - Advanced: Configuration Management (4 rules)
+                'config-conformance-pack-deployed': ConfigConformancePackDeployedAssessment(),
+                'securityhub-standards-enabled': SecurityHubStandardsEnabledAssessment(),
+                'asset-tagging-compliance': AssetTaggingComplianceAssessment(),
+                'inspector-assessment-enabled': InspectorAssessmentEnabledAssessment(),
+                
+                # Phase 3 - Advanced: Version Management (3 rules)
+                'ec2-os-version-supported': EC2OSVersionSupportedAssessment(),
+                'rds-engine-version-supported': RDSEngineVersionSupportedAssessment(),
+                'lambda-runtime-supported': LambdaRuntimeSupportedAssessment(),
+                
+                # Phase 3 - Advanced: Access/Asset Management (3 rules)
+                'iam-user-last-access-check': IAMUserLastAccessCheckAssessment(),
+                'ssm-session-manager-enabled': SSMSessionManagerEnabledAssessment(),
+                'unauthorized-asset-detection': UnauthorizedAssetDetectionAssessment(),
+                
+                # Phase 4 - Enhanced: Data Classification (2 rules)
+                'data-classification-tagging': DataClassificationTaggingAssessment(),
+                's3-bucket-classification-tags': S3BucketClassificationTagsAssessment(),
+                
+                # Phase 4 - Enhanced: Network Security (2 rules)
+                'network-firewall-deployed': NetworkFirewallDeployedAssessment(),
+                'route53-resolver-firewall-enabled': Route53ResolverFirewallEnabledAssessment(),
+                
+                # Phase 4 - Enhanced: Backup Security (5 rules)
+                'backup-vault-encryption-enabled': BackupVaultEncryptionEnabledAssessment(),
+                'backup-cross-region-copy-enabled': BackupCrossRegionCopyEnabledAssessment(),
+                'backup-vault-lock-enabled': BackupVaultLockEnabledAssessment(),
+                'route53-query-logging-enabled': Route53QueryLoggingEnabledAssessment(),
+                'rds-backup-retention-check': RDSBackupRetentionCheckAssessment(),
             },
             'IG2': {
                 # Control 3.10 - Encryption in Transit

aws_cis_assessment/core/aws_client_factory.py

@@ -69,24 +69,32 @@ class AWSClientFactory:
             logger.error(f"Failed to initialize AWS session: {e}")
             raise
     
-    def get_client(self, service_name: str, region: Optional[str] = None) -> boto3.client:
+    def get_client(self, service_name: str, region: Optional[str] = None, 
+                   allow_global_region: bool = False) -> boto3.client:
         """Get AWS service client for specified service and region.
         
         Args:
             service_name: AWS service name (e.g., 'ec2', 'iam', 's3')
             region: AWS region. If None, uses first region from regions list.
+            allow_global_region: If True, allows us-east-1 even if not in regions list.
+                               This is used for account-level and global resources that
+                               must be evaluated in us-east-1 regardless of configured regions.
             
         Returns:
             Boto3 client for the specified service
             
         Raises:
-            ValueError: If region is not in supported regions list
+            ValueError: If region is not in supported regions list (unless allow_global_region=True for us-east-1)
             ClientError: If client creation fails
         """
         if region is None:
             region = self.regions[0]
         
-        if region not in self.regions:
+        # Allow us-east-1 for global/account-level resources even if not in regions list
+        if allow_global_region and region == 'us-east-1':
+            # us-east-1 is allowed for global resources
+            logger.debug(f"Allowing global region us-east-1 for {service_name} (not in configured regions)")
+        elif region not in self.regions:
             raise ValueError(f"Region {region} not in supported regions: {self.regions}")
         
         # Create cache key
@@ -283,8 +291,12 @@ class AWSClientFactory:
                 raise
                 
             except Exception as e:
-                # Don't retry on non-AWS errors
-                logger.error(f"Non-retryable error in AWS API call: {e}")
+                # Log connection errors at DEBUG level (expected for cross-region S3 buckets)
+                error_str = str(e)
+                if "Could not connect to the endpoint URL" in error_str or "Connection" in error_str:
+                    logger.debug(f"Connection error in AWS API call (may be cross-region resource): {e}")
+                else:
+                    logger.error(f"Non-retryable error in AWS API call: {e}")
                 raise
         
         # This should never be reached due to the raise in the loop

aws_cis_assessment/core/scoring_engine.py

@@ -463,22 +463,26 @@ class ScoringEngine:
             'IG3': 153  # Cumulative
         }
         
-        # Mapping of implemented rules to safeguards covered
-        # Based on the 125 IG1 rules covering 42+ safeguards (75%+ coverage)
-        safeguard_coverage = {
-            'IG1': {
-                'covered': 42,  # 75%+ of 56 safeguards
-                'rules': 125    # Total IG1 rules implemented
-            },
-            'IG2': {
-                'covered': 30,  # Estimated based on IG2 rules
-                'rules': 38     # Total IG2 rules implemented
-            },
-            'IG3': {
-                'covered': 15,  # Estimated based on IG3 rules
-                'rules': 12     # Total IG3 rules implemented
+        # Dynamically count implemented rules from actual assessment data
+        # This replaces hardcoded values to ensure accuracy
+        safeguard_coverage = {}
+        
+        for ig_name, ig_score in ig_scores.items():
+            if ig_name not in total_safeguards:
+                continue
+            
+            # Count unique config rules across all controls in this IG
+            unique_rules = set()
+            for control_score in ig_score.control_scores.values():
+                # Each control may evaluate multiple config rules
+                if hasattr(control_score, 'config_rules_evaluated'):
+                    unique_rules.update(control_score.config_rules_evaluated)
+            
+            # Store the actual count of rules
+            safeguard_coverage[ig_name] = {
+                'covered': 42 if ig_name == 'IG1' else (30 if ig_name == 'IG2' else 15),  # Safeguards covered (estimated)
+                'rules': len(unique_rules)  # Actual rule count from assessment
             }
-        }
         
         coverage_metrics = {}
         

aws_cis_assessment/reporters/base_reporter.py

@@ -80,21 +80,36 @@ class ReportGenerator(ABC):
         Returns:
             Dictionary containing standardized report data
         """
-        # Calculate additional metrics
-        total_resources = sum(
-            sum(len(control.findings) for control in ig.control_scores.values())
-            for ig in assessment_result.ig_scores.values()
-        )
-        
+        # Calculate additional metrics - deduplicate resources across IGs
+        # Since IG2 includes IG1 and IG3 includes IG1+IG2, we need to count unique resources
+        # Use IG1 as the source of truth since it contains all unique evaluations
+        # (controls in higher IGs are the same controls, just evaluated again)
+        
+        # Collect unique resources by (resource_id, resource_type, region, config_rule_name)
+        unique_resources = {}
+        
+        for ig_name, ig_score in assessment_result.ig_scores.items():
+            for control_id, control in ig_score.control_scores.items():
+                for finding in control.findings:
+                    # Create unique key for each resource evaluation
+                    resource_key = (
+                        finding.resource_id,
+                        finding.resource_type,
+                        finding.region,
+                        finding.config_rule_name
+                    )
+                    # Store the finding (last one wins, but they should be identical)
+                    unique_resources[resource_key] = finding
+        
+        # Now count from unique resources
+        total_resources = len(unique_resources)
         total_compliant = sum(
-            sum(control.compliant_resources for control in ig.control_scores.values())
-            for ig in assessment_result.ig_scores.values()
+            1 for finding in unique_resources.values()
+            if finding.compliance_status.value == 'COMPLIANT'
         )
-        
         total_non_compliant = sum(
-            sum(len([f for f in control.findings if f.compliance_status.value == 'NON_COMPLIANT'])
-                for control in ig.control_scores.values())
-            for ig in assessment_result.ig_scores.values()
+            1 for finding in unique_resources.values()
+            if finding.compliance_status.value == 'NON_COMPLIANT'
         )
         
         # Prepare standardized data structure

aws_cis_assessment/reporters/html_reporter.py

@@ -1861,7 +1861,7 @@ class HTMLReporter(ReportGenerator):
                     <span>{ig_value:.1f}%</span>
                 </div>
                 <div class="progress-container">
-                    <div class="progress-bar {ig_status}" data-width="{ig_value}">
+                    <div class="progress-bar {ig_status}" data-width="{self._get_display_width(ig_value)}">
                         <span class="progress-text">{ig_value:.1f}%</span>
                     </div>
                 </div>
@@ -1959,7 +1959,7 @@ class HTMLReporter(ReportGenerator):
                     </div>
                     {inheritance_indicator}
                     <div class="progress-container">
-                        <div class="progress-bar {status_class}" data-width="{control_data['compliance_percentage']}">
+                        <div class="progress-bar {status_class}" data-width="{self._get_display_width(control_data['compliance_percentage'])}">
                             <span class="progress-text">{control_data['compliance_percentage']:.1f}%</span>
                         </div>
                     </div>
@@ -2188,6 +2188,20 @@ class HTMLReporter(ReportGenerator):
         else:
             return "#e74c3c"  # Red
     
+    def _get_display_width(self, actual_percentage: float) -> float:
+        """Calculate display width for progress bars.
+        
+        Ensures minimum 5% width for visibility when actual percentage is 0%.
+        This prevents progress bars from being invisible for non-compliant controls.
+        
+        Args:
+            actual_percentage: Actual compliance percentage (0-100)
+            
+        Returns:
+            Display width with minimum 5% for visibility
+        """
+        return max(5.0, actual_percentage)
+    
     def _get_status_class(self, compliance_percentage: float) -> str:
         """Get CSS status class based on compliance percentage."""
         if compliance_percentage >= 95.0:
@@ -2302,9 +2316,9 @@ class HTMLReporter(ReportGenerator):
                         have higher impact on the overall score.
                     </p>
                     <ul class="comparison-features">
-                        <li>✓ Prioritizes critical security controls</li>
-                        <li>✓ Prevents resource count skew</li>
-                        <li>✓ Guides remediation priorities</li>
+                        <li>Prioritizes critical security controls</li>
+                        <li>Prevents resource count skew</li>
+                        <li>Guides remediation priorities</li>
                     </ul>
                 </div>
                 
@@ -2316,9 +2330,9 @@ class HTMLReporter(ReportGenerator):
                         All rules treated equally regardless of security criticality.
                     </p>
                     <ul class="comparison-features">
-                        <li>✓ Simple and straightforward</li>
-                        <li>✓ Easy to audit</li>
-                        <li>✓ Resource-level tracking</li>
+                        <li>Simple and straightforward</li>
+                        <li>Easy to audit</li>
+                        <li>Resource-level tracking</li>
                     </ul>
                 </div>
             </div>
@@ -2724,7 +2738,7 @@ class HTMLReporter(ReportGenerator):
             type_compliance = (stats["compliant"] / stats["total"] * 100) if stats["total"] > 0 else 0
             status_class = self._get_status_class(type_compliance)
             # Ensure minimum width of 5% for visibility when compliance is 0%
-            display_width = max(type_compliance, 5.0) if type_compliance < 5.0 else type_compliance
+            display_width = self._get_display_width(type_compliance)
             
             resource_type_breakdown += f"""
             <div class="resource-type-stat">

{aws_cis_controls_assessment-1.2.0.dist-info → aws_cis_controls_assessment-1.2.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-cis-controls-assessment
-Version: 1.2.0
+Version: 1.2.2
 Summary: Production-ready AWS CIS Controls compliance assessment framework with 175 comprehensive rules and 75%+ IG1 coverage
 Author-email: AWS CIS Assessment Team <security@example.com>
 Maintainer-email: AWS CIS Assessment Team <security@example.com>

{aws_cis_controls_assessment-1.2.0.dist-info → aws_cis_controls_assessment-1.2.2.dist-info}/RECORD

@@ -1,21 +1,21 @@
-aws_cis_assessment/__init__.py,sha256=zmpdZ6kKbZBxO4UT560pV3EYkx53KPTGUmhJWh1Kx6A,518
+aws_cis_assessment/__init__.py,sha256=BketHh6rhvnzVE591PT-esMgjZlRIupmk-VtLPLomYE,518
 aws_cis_assessment/cli/__init__.py,sha256=DYaGVAIoy5ucs9ubKQxX6Z3ZD46AGz9AaIaDQXzrzeY,100
 aws_cis_assessment/cli/examples.py,sha256=F9K2Fe297kUfwoq6Ine9Aj_IXNU-KwO9hd7SAPWeZHI,12884
 aws_cis_assessment/cli/main.py,sha256=i5QoqHXsPG_Kw0W7jM3Zj2YaAaCJnxxnfz82QBBHq-U,49441
 aws_cis_assessment/cli/utils.py,sha256=ufdsifIPIE9HKVZAvFXfeJgEk_aAmz01tDrEukVyL0g,9783
 aws_cis_assessment/config/__init__.py,sha256=aSQyaKGEQ7WgldC8IocY-YK7nduzfgjI6EuDE4Xti6s,77
 aws_cis_assessment/config/config_loader.py,sha256=Wk6gfblj8RWU5QctHjPu5tTJMIb8lbEW3Ic9z-se4uQ,13165
-aws_cis_assessment/config/rules/cis_controls_ig1.yaml,sha256=RFZAukanQO8VUM6-kCfn8a4LfjWhd34DdPIHgcWRZt8,55167
+aws_cis_assessment/config/rules/cis_controls_ig1.yaml,sha256=uaEm2Hmo4GZdG-9prUYcU67K1WBCx7120_TDh0lTwD0,55185
 aws_cis_assessment/config/rules/cis_controls_ig2.yaml,sha256=kX4h-TFmaohNPhhFBrzHBZkitgG_kaRb2-XW_AJwnR0,48820
 aws_cis_assessment/config/rules/cis_controls_ig3.yaml,sha256=YSghyCmwKF5UNZXdQQQNsaidQ95VDUgnwvh4jsV6kQU,4347
 aws_cis_assessment/controls/__init__.py,sha256=oVTM94UAt0Vu7Hy-V84p6LAxZHORs-RRAj9j86r_730,72
-aws_cis_assessment/controls/base_control.py,sha256=DpjRrYdz3FzpuU_WtbvtqUBRgEoMW7Qgah-iD5Y_HJI,17227
-aws_cis_assessment/controls/ig1/__init__.py,sha256=hV_Amiwd-6wcrQcSp8O_gTaqujiPkZ0BY20DdboTfkc,8411
+aws_cis_assessment/controls/base_control.py,sha256=0otzF_bYPjBEt33HfFUXM9PB50r3ZBmJ3R4zZZdSQHg,21648
+aws_cis_assessment/controls/ig1/__init__.py,sha256=jLOWHp6nDodEdYBx5urrjjCs7TEsRfaaCyZ_CgtjmJM,13144
 aws_cis_assessment/controls/ig1/control_1_1.py,sha256=MwxaFCayJmFrBeGrVyTcLUksrPqRHId76m2Du1Vuk4I,28070
 aws_cis_assessment/controls/ig1/control_2_2.py,sha256=yPp4aGGGzroAFqoTSaujjALSPq4jPxcaDiDIhwC11P0,11504
 aws_cis_assessment/controls/ig1/control_3_3.py,sha256=f4ZuiMR6qSXCmVwP3OflEeZn48qpzQqq0XfjZgbq3Go,35668
 aws_cis_assessment/controls/ig1/control_3_4.py,sha256=Flw_cA8_Qxv8zuIbOWv6JAYUdjPiAPU7Qs3CqDoRqvk,11438
-aws_cis_assessment/controls/ig1/control_4_1.py,sha256=-lIoa0XRGwiRdtG9L9f00Wud525FZbv3961bXMuiQIE,22362
+aws_cis_assessment/controls/ig1/control_4_1.py,sha256=GoaYc_aZ9Gd-QDETzE3ho77zaJjSQAro3bctODATfO0,22522
 aws_cis_assessment/controls/ig1/control_access_analyzer.py,sha256=vURgc1sL_eYzJvviSeKD39fEQ0nHtCZl96NFZXF4Lvc,9056
 aws_cis_assessment/controls/ig1/control_access_asset_mgmt.py,sha256=-fdURSgVMIb6ei6pVAAtkXq5IVIMefdq5Q3fanL6fP8,14851
 aws_cis_assessment/controls/ig1/control_access_control.py,sha256=vM5XFd0J_pIVeeMKYbF2W7NrErGTw08HMl92g8ZrK_0,12861
@@ -34,7 +34,7 @@ aws_cis_assessment/controls/ig1/control_dynamodb_encryption.py,sha256=VOuNPeqqx-
 aws_cis_assessment/controls/ig1/control_ebs_encryption.py,sha256=kHiaVmcm_qb64Z5uttW_Z9s-dEVPpPQQcNdvo7V8dcA,7605
 aws_cis_assessment/controls/ig1/control_efs_encryption.py,sha256=cfUhk0pjfGkjWfarivngTM-s4ud9uGKwu7A0sNBw9AU,11292
 aws_cis_assessment/controls/ig1/control_elb_logging.py,sha256=vk3S4zXbQ8pX2_Tx1F1J7Y1vteYZUSIHlSikU4T7i-A,8501
-aws_cis_assessment/controls/ig1/control_guardduty.py,sha256=EAQKgyGntmbRAfL5pTW6FIGNhfzkro7RAQV1mqvZ2MU,6620
+aws_cis_assessment/controls/ig1/control_guardduty.py,sha256=CZsYG5nRDPGAeVtf-3UhVwVQhGX1amB6jBwSsHd9b1Q,6653
 aws_cis_assessment/controls/ig1/control_iam_advanced.py,sha256=FQA_8IV5CyD_49u0eLN8q-JM50g1-tilDu9Ww_R3o9s,27694
 aws_cis_assessment/controls/ig1/control_iam_governance.py,sha256=msaqmhLlFYK3pMgC-eYOP7RvDCpx014W8Su6hdlQ_Ic,22079
 aws_cis_assessment/controls/ig1/control_iam_policies.py,sha256=k6BT4IF4c0uEs94UR8Ny1RifgRgvDpOPlaWr2WjVGWM,17326
@@ -48,11 +48,11 @@ aws_cis_assessment/controls/ig1/control_network_enhancements.py,sha256=Ta-9SMHT7
 aws_cis_assessment/controls/ig1/control_network_security.py,sha256=8hVXx0ezUgtOasCZGUa5owbCj5F6QVLCl5JbKQ2au_8,9923
 aws_cis_assessment/controls/ig1/control_patch_management.py,sha256=SXO1Bo8tGxf66cOCA6bzbg-03hNjo2A7rJ-JpjPBBJU,29209
 aws_cis_assessment/controls/ig1/control_rds_encryption.py,sha256=-dgjds10Ob8RHmtBzZFV9jShj8psd-cwgJz4xh6wTYc,10761
-aws_cis_assessment/controls/ig1/control_s3_encryption.py,sha256=-kyPaBnnC3GWiE_peA_PWDCR4d0sIZMUuObB4XmHBOg,17928
+aws_cis_assessment/controls/ig1/control_s3_encryption.py,sha256=VY_isicWF8as8yFKInq37LW_V6BQ86SjEdZnyDJ1Wo0,17926
 aws_cis_assessment/controls/ig1/control_s3_enhancements.py,sha256=uP0Ko6cjTvmpg47vNtdaFgdjVPMS6Yjww-WZQIzvk8o,7759
 aws_cis_assessment/controls/ig1/control_s3_security.py,sha256=8vt2rnNPdgQrvO5Ds3yV74mQ7qkF0f_LpKqQLjg0AQc,18308
-aws_cis_assessment/controls/ig1/control_tls_ssl.py,sha256=s6SvwCzpeDBgC71hewuBvaAePdq5pom6VUG74OlIQj4,24247
-aws_cis_assessment/controls/ig1/control_version_mgmt.py,sha256=usXAHNKDw0qqcpWR9EhVerd_3U_gImJ1hYkeVfZEK4s,13415
+aws_cis_assessment/controls/ig1/control_tls_ssl.py,sha256=A1LfYRtZKQLXs3dYyWiUglesKUqJ2Fio0oeprCjRzvY,24261
+aws_cis_assessment/controls/ig1/control_version_mgmt.py,sha256=o2Q1YY7_FtA52rEvJ_DLufKhCHZ8b4uVcu-HswrnFCk,13929
 aws_cis_assessment/controls/ig1/control_vpc_flow_logs.py,sha256=wgp8HGLobtL_pEYbm9YrmUwvvG0axF2zVTm0-4SqkNU,8485
 aws_cis_assessment/controls/ig1/control_vpc_security.py,sha256=RCtBUozvdIPrXKFU0ssxjBF6A9l_HMcAbRv0K87Bbhc,10639
 aws_cis_assessment/controls/ig1/control_waf_logging.py,sha256=HCYJBr84Kk8KK3py8JnY99_HJ_3cuVrmgMVP2Ye_BPU,9602
@@ -78,18 +78,18 @@ aws_cis_assessment/controls/ig3/control_3_14.py,sha256=fY2MZATcicuP1Zich5L7J6-MM
 aws_cis_assessment/controls/ig3/control_7_1.py,sha256=GZQt0skGJVlUbGoH4MD5AoJJONf0nT9k7WQT-8F3le4,18499
 aws_cis_assessment/core/__init__.py,sha256=aXt5Z3mqaaDvFyZPyMaJYFy66A_phfFIhhH_eyaic8Q,52
 aws_cis_assessment/core/accuracy_validator.py,sha256=jnN2O32PpdDfWAp6erV4v4zKugC9ziJkDYnVF93FVuY,18386
-aws_cis_assessment/core/assessment_engine.py,sha256=I__VAJ93m3KWrIpexgF4_FpuSvH2fNM_tq8eaUNTJv4,66807
+aws_cis_assessment/core/assessment_engine.py,sha256=3AXk3yFHmCTcVelABgTZH8hYZ24ULqjxCRA3xT1m-m4,75362
 aws_cis_assessment/core/audit_trail.py,sha256=qapCkI2zjbAPHlHQcgYonfDYyjU2MoX5Sc2IXtYj3eE,18395
-aws_cis_assessment/core/aws_client_factory.py,sha256=1qTLfQ3fgPBH3mWRpX1_i3bbHlQQYsmSE8vsKxKTz8w,13143
+aws_cis_assessment/core/aws_client_factory.py,sha256=Rjy2TIra-0fY3qjogQ6wOJxj5mdRpCvbJaenBlbbtIo,14147
 aws_cis_assessment/core/error_handler.py,sha256=5JgH3Y2yG1-ZSuEJR7o0ZMzqlwGWFRW2N4SjcL2gnBw,24219
 aws_cis_assessment/core/models.py,sha256=-jgx_AEY1L9vK9VIM1VHeqZGcr6j9QzvtDldk1iOusE,6584
-aws_cis_assessment/core/scoring_engine.py,sha256=uM97w9UEaKd5xh2cpR6dYvoX3lKh_IDmPleN6AY9vpc,23978
+aws_cis_assessment/core/scoring_engine.py,sha256=CUkAIjguIpJpE0pU-M3YZ6SBaT50kfnyjtRKK6zNsVs,24341
 aws_cis_assessment/reporters/__init__.py,sha256=GXdlY08kKy1Y3mMBv8Y0JuUB69u--e5DIu2jNJpc6QI,357
-aws_cis_assessment/reporters/base_reporter.py,sha256=RJgn6xNy-G9Z1w30fjOOOdlhapD3uvzoFSdkEDPzNjM,19473
+aws_cis_assessment/reporters/base_reporter.py,sha256=YqGG9mrnaF4RakVEpBdh-lkEm2qF-vwPBlcKTLt1gCg,20325
 aws_cis_assessment/reporters/csv_reporter.py,sha256=r83xzfP1t5AO9MfKawgN4eTeOU6eGZwJQgvNDLEd7NI,31419
-aws_cis_assessment/reporters/html_reporter.py,sha256=t-X6PNJjUauKqA-Zxc3AizPNRPtrcyEReJz9irMz5xg,122309
+aws_cis_assessment/reporters/html_reporter.py,sha256=qA3AdTc1UAIXxD8H74qK6-p8I8TvF65gBIs3NMb7lu0,122837
 aws_cis_assessment/reporters/json_reporter.py,sha256=MObCzTc9nlGTEXeWc7P8tTMeKCpEaJNfcSYc79cHXhc,22250
-aws_cis_controls_assessment-1.2.0.dist-info/licenses/LICENSE,sha256=T_p0qKH4RoI3ejr3tktf3rx2Zart_9KeUmJd5iiqXW8,1079
+aws_cis_controls_assessment-1.2.2.dist-info/licenses/LICENSE,sha256=T_p0qKH4RoI3ejr3tktf3rx2Zart_9KeUmJd5iiqXW8,1079
 deprecation-package/aws_cis_assessment_deprecated/__init__.py,sha256=WOaufqanKNhvWQ3frj8e627tS_kZnyk2R2hwqPFqydw,1892
 docs/README.md,sha256=MXnfbPRmxir-7ihG2lNmLI9TJG0Pp0QWqoDZtXiH_Mk,4912
 docs/adding-aws-backup-controls.md,sha256=l_H0H8W71n-6NbeplNujC_li2NiaQcYPr0hQMhEPbrc,21081
@@ -104,8 +104,8 @@ docs/scoring-comparison-aws-config.md,sha256=8BBe1tQsaAT0BAE3OdGIRFjuT1VJcOlM1qB
 docs/scoring-methodology.md,sha256=C86FisBxKt6pyr-Kp6rAVPz45yPZpgsGibjgq8obIsg,9404
 docs/troubleshooting.md,sha256=mGmWgrc3A1dn-Uk_XxWFh04OQxjmqkeax8vQX7takg0,18220
 docs/user-guide.md,sha256=WysjUvbkuVf-7ntpwsiVTND5RkxRtZvq3Cm8Jzl-3NA,15860
-aws_cis_controls_assessment-1.2.0.dist-info/METADATA,sha256=rvIgKNPWiZWx6LRB1F0elcSN3QpbG77TM_iO1T4nOP4,15544
-aws_cis_controls_assessment-1.2.0.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-aws_cis_controls_assessment-1.2.0.dist-info/entry_points.txt,sha256=-AxPn5Y7yau0pQh33F5_uyWfvcnm2Kg1_nMQuLrZ7SY,68
-aws_cis_controls_assessment-1.2.0.dist-info/top_level.txt,sha256=4OHmV6RAEWkz-Se50kfmuGCd-mUSotDZz3iLGF9CmkI,44
-aws_cis_controls_assessment-1.2.0.dist-info/RECORD,,
+aws_cis_controls_assessment-1.2.2.dist-info/METADATA,sha256=g7hJ2aj2KWgulfHwgnTsBQ78cWys71t1YLMzV6QtuCc,15544
+aws_cis_controls_assessment-1.2.2.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+aws_cis_controls_assessment-1.2.2.dist-info/entry_points.txt,sha256=-AxPn5Y7yau0pQh33F5_uyWfvcnm2Kg1_nMQuLrZ7SY,68
+aws_cis_controls_assessment-1.2.2.dist-info/top_level.txt,sha256=4OHmV6RAEWkz-Se50kfmuGCd-mUSotDZz3iLGF9CmkI,44
+aws_cis_controls_assessment-1.2.2.dist-info/RECORD,,