cloudg 0.3.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- cloudg/__init__.py +21 -0
- cloudg/api.py +613 -0
- cloudg/cli.py +934 -0
- cloudg/collectors/__init__.py +5 -0
- cloudg/collectors/aws.py +830 -0
- cloudg/collectors/azure.py +362 -0
- cloudg/collectors/base.py +44 -0
- cloudg/collectors/gcp.py +170 -0
- cloudg/collectors/multi.py +329 -0
- cloudg/config.py +261 -0
- cloudg/coverage.py +93 -0
- cloudg/credentials.py +451 -0
- cloudg/graph/__init__.py +6 -0
- cloudg/graph/builder.py +336 -0
- cloudg/graph/ontology.py +914 -0
- cloudg/graph/rag_export.py +533 -0
- cloudg/graph/reachability.py +237 -0
- cloudg/normaliser.py +390 -0
- cloudg/policies/custodian-aws-security.yml +139 -0
- cloudg/policies/custodian-azure.yml +95 -0
- cloudg/policies/custodian-gcp.yml +87 -0
- cloudg/policies/custodian.yml +131 -0
- cloudg/region_discovery.py +330 -0
- cloudg/registry.py +142 -0
- cloudg/renderers/__init__.py +1 -0
- cloudg/renderers/html_report.py +430 -0
- cloudg/renderers/json_export.py +65 -0
- cloudg/renderers/svg.py +689 -0
- cloudg/renderers/terraform_export.py +666 -0
- cloudg/retry.py +103 -0
- cloudg/rules/cis_aws_v3.yaml +148 -0
- cloudg/rules/cis_azure_v2.yaml +142 -0
- cloudg/rules/cis_gcp_v3.yaml +133 -0
- cloudg/rules/frameworks/aws_foundational_security_best_practices_aws.yaml +1286 -0
- cloudg/rules/frameworks/cis_5.0_aws.yaml +280 -0
- cloudg/rules/frameworks/cis_5.0_azure.yaml +475 -0
- cloudg/rules/frameworks/cis_5.0_gcp.yaml +327 -0
- cloudg/rules/frameworks/gdpr_aws.yaml +95 -0
- cloudg/rules/frameworks/hipaa_aws.yaml +461 -0
- cloudg/rules/frameworks/hipaa_azure.yaml +504 -0
- cloudg/rules/frameworks/hipaa_gcp.yaml +211 -0
- cloudg/rules/frameworks/iso27001_2022_aws.yaml +789 -0
- cloudg/rules/frameworks/iso27001_2022_azure.yaml +477 -0
- cloudg/rules/frameworks/iso27001_2022_gcp.yaml +240 -0
- cloudg/rules/frameworks/mitre_attack_aws.yaml +596 -0
- cloudg/rules/frameworks/mitre_attack_azure.yaml +418 -0
- cloudg/rules/frameworks/mitre_attack_gcp.yaml +300 -0
- cloudg/rules/frameworks/nist_800_53_revision_5_aws.yaml +3234 -0
- cloudg/rules/frameworks/nist_csf_2.0_aws.yaml +828 -0
- cloudg/rules/frameworks/pci_4.0_aws.yaml +7108 -0
- cloudg/rules/frameworks/pci_4.0_azure.yaml +4696 -0
- cloudg/rules/frameworks/pci_4.0_gcp.yaml +5405 -0
- cloudg/rules/frameworks/soc2_aws.yaml +421 -0
- cloudg/rules/frameworks/soc2_azure.yaml +477 -0
- cloudg/rules/frameworks/soc2_gcp.yaml +342 -0
- cloudg/rules/gdpr.yaml +56 -0
- cloudg/rules/hipaa_security_rule.yaml +83 -0
- cloudg/rules/iso_27001_2022.yaml +88 -0
- cloudg/rules/nist_800_53.yaml +134 -0
- cloudg/rules/pci_dss_v4.yaml +108 -0
- cloudg/rules/soc2_tsc.yaml +93 -0
- cloudg/scanners/__init__.py +1 -0
- cloudg/scanners/checkov.py +174 -0
- cloudg/scanners/iam_linter.py +200 -0
- cloudg/scanners/prowler.py +237 -0
- cloudg/scanners/scoutsuite.py +163 -0
- cloudg/scanners/trivy.py +339 -0
- cloudg/schema/__init__.py +25 -0
- cloudg/schema/models.py +260 -0
- cloudg/templates/report.html.j2 +828 -0
- cloudg-0.3.0.dist-info/METADATA +330 -0
- cloudg-0.3.0.dist-info/RECORD +75 -0
- cloudg-0.3.0.dist-info/WHEEL +4 -0
- cloudg-0.3.0.dist-info/entry_points.txt +14 -0
- cloudg-0.3.0.dist-info/licenses/LICENSE +21 -0
|
@@ -0,0 +1,461 @@
|
|
|
1
|
+
# Generated by scripts/import_prowler_compliance.py — do not edit by hand.
|
|
2
|
+
# Framework: HIPAA (AWS)
|
|
3
|
+
# Data source: Prowler (https://github.com/prowler-cloud/prowler), Apache-2.0.
|
|
4
|
+
framework: HIPAA-AWS
|
|
5
|
+
version: null
|
|
6
|
+
source: Prowler compliance data (hipaa_aws.json), Apache-2.0, https://github.com/prowler-cloud/prowler
|
|
7
|
+
provider: aws
|
|
8
|
+
controls:
|
|
9
|
+
- id: 164_308_a_1_ii_a
|
|
10
|
+
title: Conduct an accurate and thorough assessment of the potential risks and vulnerabilities
|
|
11
|
+
to the confidentiality, integrity, and availability of electronic protected health
|
|
12
|
+
information held by the covered entity or business associate.
|
|
13
|
+
checks:
|
|
14
|
+
- config_recorder_all_regions_enabled
|
|
15
|
+
- guardduty_is_enabled
|
|
16
|
+
- id: 164_308_a_1_ii_b
|
|
17
|
+
title: 'Implement security measures sufficient to reduce risks and vulnerabilities
|
|
18
|
+
to a reasonable and appropriate level to comply with 164.306(a): Ensure the confidentiality,
|
|
19
|
+
integrity, and availability of all electronic protected health information the
|
|
20
|
+
covered entity or business associate creates, receiv…'
|
|
21
|
+
checks:
|
|
22
|
+
- awslambda_function_not_publicly_accessible
|
|
23
|
+
- awslambda_function_url_public
|
|
24
|
+
- cloudtrail_kms_encryption_enabled
|
|
25
|
+
- cloudtrail_log_file_validation_enabled
|
|
26
|
+
- cloudwatch_log_group_kms_encryption_enabled
|
|
27
|
+
- dynamodb_tables_pitr_enabled
|
|
28
|
+
- ec2_confidential_workload_host_public_ip
|
|
29
|
+
- ec2_ebs_default_encryption
|
|
30
|
+
- ec2_ebs_public_snapshot
|
|
31
|
+
- ec2_ebs_volume_encryption
|
|
32
|
+
- ec2_instance_older_than_specific_days
|
|
33
|
+
- ec2_instance_public_ip
|
|
34
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
35
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
36
|
+
- efs_encryption_at_rest_enabled
|
|
37
|
+
- elb_ssl_listeners
|
|
38
|
+
- elbv2_deletion_protection
|
|
39
|
+
- emr_cluster_master_nodes_no_public_ip
|
|
40
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
41
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
42
|
+
- iam_inline_policy_no_administrative_privileges
|
|
43
|
+
- iam_no_root_access_key
|
|
44
|
+
- opensearch_service_domains_encryption_at_rest_enabled
|
|
45
|
+
- rds_instance_backup_enabled
|
|
46
|
+
- rds_instance_multi_az
|
|
47
|
+
- rds_instance_storage_encrypted
|
|
48
|
+
- rds_snapshots_public_access
|
|
49
|
+
- redshift_cluster_audit_logging
|
|
50
|
+
- redshift_cluster_public_access
|
|
51
|
+
- s3_account_level_public_access_blocks
|
|
52
|
+
- s3_bucket_default_encryption
|
|
53
|
+
- s3_bucket_object_versioning
|
|
54
|
+
- s3_bucket_policy_public_write_access
|
|
55
|
+
- s3_bucket_public_access
|
|
56
|
+
- s3_bucket_secure_transport_policy
|
|
57
|
+
- sagemaker_notebook_instance_encryption_enabled
|
|
58
|
+
- sagemaker_notebook_instance_without_direct_internet_access_configured
|
|
59
|
+
- sns_topics_kms_encryption_at_rest_enabled
|
|
60
|
+
- id: 164_308_a_1_ii_d
|
|
61
|
+
title: Implement procedures to regularly review records of information system activity,
|
|
62
|
+
such as audit logs, access reports, and security incident tracking reports.
|
|
63
|
+
checks:
|
|
64
|
+
- apigateway_restapi_logging_enabled
|
|
65
|
+
- cloudtrail_bedrock_logging_enabled
|
|
66
|
+
- cloudtrail_cloudwatch_logging_enabled
|
|
67
|
+
- cloudtrail_kms_encryption_enabled
|
|
68
|
+
- cloudtrail_log_file_validation_enabled
|
|
69
|
+
- cloudtrail_multi_region_enabled
|
|
70
|
+
- cloudtrail_s3_dataevents_read_enabled
|
|
71
|
+
- cloudtrail_s3_dataevents_write_enabled
|
|
72
|
+
- elb_logging_enabled
|
|
73
|
+
- elbv2_logging_enabled
|
|
74
|
+
- guardduty_is_enabled
|
|
75
|
+
- kms_key_enclave_debug_attestation_detected
|
|
76
|
+
- redshift_cluster_audit_logging
|
|
77
|
+
- s3_bucket_server_access_logging_enabled
|
|
78
|
+
- securityhub_enabled
|
|
79
|
+
- vpc_flow_logs_enabled
|
|
80
|
+
- id: 164_308_a_3_i
|
|
81
|
+
title: Implement policies and procedures to ensure that all members of its workforce
|
|
82
|
+
have appropriate access to electronic protected health information, as provided
|
|
83
|
+
under paragraph (a)(4) of this section, and to prevent those workforce members
|
|
84
|
+
who do not have access under paragraph (a)(4) of this section …
|
|
85
|
+
checks:
|
|
86
|
+
- awslambda_function_not_publicly_accessible
|
|
87
|
+
- awslambda_function_url_public
|
|
88
|
+
- ec2_ebs_public_snapshot
|
|
89
|
+
- ec2_instance_public_ip
|
|
90
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
91
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
92
|
+
- iam_inline_policy_no_administrative_privileges
|
|
93
|
+
- iam_no_root_access_key
|
|
94
|
+
- rds_instance_no_public_access
|
|
95
|
+
- rds_snapshots_public_access
|
|
96
|
+
- redshift_cluster_public_access
|
|
97
|
+
- s3_account_level_public_access_blocks
|
|
98
|
+
- s3_bucket_policy_public_write_access
|
|
99
|
+
- s3_bucket_public_access
|
|
100
|
+
- sagemaker_notebook_instance_without_direct_internet_access_configured
|
|
101
|
+
- id: 164_308_a_3_ii_a
|
|
102
|
+
title: Implement procedures for the authorization and/or supervision of workforce
|
|
103
|
+
members who work with electronic protected health information or in locations
|
|
104
|
+
where it might be accessed.
|
|
105
|
+
checks:
|
|
106
|
+
- apigateway_restapi_logging_enabled
|
|
107
|
+
- cloudtrail_multi_region_enabled
|
|
108
|
+
- cloudtrail_s3_dataevents_read_enabled
|
|
109
|
+
- cloudtrail_s3_dataevents_write_enabled
|
|
110
|
+
- elb_logging_enabled
|
|
111
|
+
- elbv2_logging_enabled
|
|
112
|
+
- guardduty_is_enabled
|
|
113
|
+
- iam_root_hardware_mfa_enabled
|
|
114
|
+
- iam_root_mfa_enabled
|
|
115
|
+
- iam_user_mfa_enabled_console_access
|
|
116
|
+
- redshift_cluster_audit_logging
|
|
117
|
+
- s3_bucket_server_access_logging_enabled
|
|
118
|
+
- securityhub_enabled
|
|
119
|
+
- vpc_flow_logs_enabled
|
|
120
|
+
- id: 164_308_a_3_ii_b
|
|
121
|
+
title: Implement procedures to determine that the access of a workforce member to
|
|
122
|
+
electronic protected health information is appropriate.
|
|
123
|
+
checks:
|
|
124
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
125
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
126
|
+
- iam_inline_policy_no_administrative_privileges
|
|
127
|
+
- iam_no_root_access_key
|
|
128
|
+
- iam_user_accesskey_unused
|
|
129
|
+
- iam_user_console_access_unused
|
|
130
|
+
- id: 164_308_a_3_ii_c
|
|
131
|
+
title: Implement procedures for terminating access to electronic protected health
|
|
132
|
+
information when the employment of, or other arrangement with, a workforce member
|
|
133
|
+
ends or as required by determinations made as specified in paragraph (a)(3)(ii)(b).
|
|
134
|
+
checks:
|
|
135
|
+
- iam_rotate_access_key_90_days
|
|
136
|
+
- id: 164_308_a_4_i
|
|
137
|
+
title: Implement policies and procedures for authorizing access to electronic protected
|
|
138
|
+
health information that are consistent with the applicable requirements of subpart
|
|
139
|
+
E of this part.
|
|
140
|
+
checks:
|
|
141
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
142
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
143
|
+
- iam_inline_policy_no_administrative_privileges
|
|
144
|
+
- id: 164_308_a_4_ii_a
|
|
145
|
+
title: If a health care clearinghouse is part of a larger organization, the clearinghouse
|
|
146
|
+
must implement policies and procedures that protect the electronic protected health
|
|
147
|
+
information of the clearinghouse from unauthorized access by the larger organization.
|
|
148
|
+
checks:
|
|
149
|
+
- acm_certificates_expiration_check
|
|
150
|
+
- cloudfront_distributions_https_enabled
|
|
151
|
+
- cloudtrail_kms_encryption_enabled
|
|
152
|
+
- cloudwatch_log_group_kms_encryption_enabled
|
|
153
|
+
- dynamodb_accelerator_cluster_encryption_enabled
|
|
154
|
+
- dynamodb_tables_kms_cmk_encryption_enabled
|
|
155
|
+
- ec2_ebs_default_encryption
|
|
156
|
+
- ec2_ebs_volume_encryption
|
|
157
|
+
- efs_encryption_at_rest_enabled
|
|
158
|
+
- eks_cluster_kms_cmk_encryption_in_secrets_enabled
|
|
159
|
+
- elb_ssl_listeners
|
|
160
|
+
- opensearch_service_domains_encryption_at_rest_enabled
|
|
161
|
+
- opensearch_service_domains_node_to_node_encryption_enabled
|
|
162
|
+
- rds_instance_backup_enabled
|
|
163
|
+
- rds_instance_integration_cloudwatch_logs
|
|
164
|
+
- rds_instance_storage_encrypted
|
|
165
|
+
- redshift_cluster_audit_logging
|
|
166
|
+
- redshift_cluster_automated_snapshot
|
|
167
|
+
- s3_bucket_default_encryption
|
|
168
|
+
- sagemaker_notebook_instance_encryption_enabled
|
|
169
|
+
- sns_topics_kms_encryption_at_rest_enabled
|
|
170
|
+
- id: 164_308_a_4_ii_b
|
|
171
|
+
title: Implement policies and procedures for granting access to electronic protected
|
|
172
|
+
health information, As one illustrative example, through access to a workstation,
|
|
173
|
+
transaction, program, process, or other mechanism.
|
|
174
|
+
checks:
|
|
175
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
176
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
177
|
+
- iam_inline_policy_no_administrative_privileges
|
|
178
|
+
- iam_inline_policy_no_wildcard_marketplace_subscribe
|
|
179
|
+
- iam_policy_no_wildcard_marketplace_subscribe
|
|
180
|
+
- id: 164_308_a_4_ii_c
|
|
181
|
+
title: Implement policies and procedures that, based upon the covered entity's or
|
|
182
|
+
the business associate's access authorization policies, establish, document, review,
|
|
183
|
+
and modify a user's right of access to a workstation, transaction, program, or
|
|
184
|
+
process.
|
|
185
|
+
checks:
|
|
186
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
187
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
188
|
+
- iam_inline_policy_no_administrative_privileges
|
|
189
|
+
- iam_no_root_access_key
|
|
190
|
+
- iam_password_policy_reuse_24
|
|
191
|
+
- iam_rotate_access_key_90_days
|
|
192
|
+
- iam_user_accesskey_unused
|
|
193
|
+
- iam_user_console_access_unused
|
|
194
|
+
- secretsmanager_automatic_rotation_enabled
|
|
195
|
+
- id: 164_308_a_5_ii_b
|
|
196
|
+
title: Procedures for guarding against, detecting, and reporting malicious software.
|
|
197
|
+
checks:
|
|
198
|
+
- ec2_instance_managed_by_ssm
|
|
199
|
+
- ssm_managed_compliant_patching
|
|
200
|
+
- id: 164_308_a_5_ii_c
|
|
201
|
+
title: Procedures for monitoring log-in attempts and reporting discrepancies.
|
|
202
|
+
checks:
|
|
203
|
+
- cloudwatch_log_metric_filter_authentication_failures
|
|
204
|
+
- guardduty_is_enabled
|
|
205
|
+
- securityhub_enabled
|
|
206
|
+
- id: 164_308_a_5_ii_d
|
|
207
|
+
title: Procedures for creating, changing, and safeguarding passwords.
|
|
208
|
+
checks:
|
|
209
|
+
- iam_password_policy_lowercase
|
|
210
|
+
- iam_password_policy_minimum_length_14
|
|
211
|
+
- iam_password_policy_number
|
|
212
|
+
- iam_password_policy_reuse_24
|
|
213
|
+
- iam_password_policy_symbol
|
|
214
|
+
- iam_password_policy_uppercase
|
|
215
|
+
- iam_rotate_access_key_90_days
|
|
216
|
+
- iam_user_accesskey_unused
|
|
217
|
+
- iam_user_console_access_unused
|
|
218
|
+
- id: 164_308_a_6_i
|
|
219
|
+
title: Implement policies and procedures to address security incidents.
|
|
220
|
+
checks:
|
|
221
|
+
- cloudwatch_changes_to_network_acls_alarm_configured
|
|
222
|
+
- cloudwatch_changes_to_network_gateways_alarm_configured
|
|
223
|
+
- cloudwatch_changes_to_network_route_tables_alarm_configured
|
|
224
|
+
- cloudwatch_changes_to_vpcs_alarm_configured
|
|
225
|
+
- cloudwatch_log_metric_filter_authentication_failures
|
|
226
|
+
- cloudwatch_log_metric_filter_root_usage
|
|
227
|
+
- guardduty_is_enabled
|
|
228
|
+
- securityhub_enabled
|
|
229
|
+
- id: 164_308_a_6_ii
|
|
230
|
+
title: Identify and respond to suspected or known security incidents; mitigate,
|
|
231
|
+
to the extent practicable, harmful effects of security incidents that are known
|
|
232
|
+
to the covered entity or business associate; and document security incidents and
|
|
233
|
+
their outcomes.
|
|
234
|
+
checks:
|
|
235
|
+
- apigateway_restapi_logging_enabled
|
|
236
|
+
- cloudtrail_cloudwatch_logging_enabled
|
|
237
|
+
- cloudtrail_multi_region_enabled
|
|
238
|
+
- cloudtrail_s3_dataevents_read_enabled
|
|
239
|
+
- cloudtrail_s3_dataevents_write_enabled
|
|
240
|
+
- cloudwatch_log_metric_filter_authentication_failures
|
|
241
|
+
- cloudwatch_log_metric_filter_root_usage
|
|
242
|
+
- elb_logging_enabled
|
|
243
|
+
- elbv2_logging_enabled
|
|
244
|
+
- guardduty_is_enabled
|
|
245
|
+
- guardduty_no_high_severity_findings
|
|
246
|
+
- s3_bucket_server_access_logging_enabled
|
|
247
|
+
- securityhub_enabled
|
|
248
|
+
- vpc_flow_logs_enabled
|
|
249
|
+
- id: 164_308_a_7_i
|
|
250
|
+
title: Establish (and implement as needed) policies and procedures for responding
|
|
251
|
+
to an emergency or other occurrence (for example, fire, vandalism, system failure,
|
|
252
|
+
and natural disaster) that damages systems that contain electronic protected health
|
|
253
|
+
information.
|
|
254
|
+
checks:
|
|
255
|
+
- dynamodb_tables_pitr_enabled
|
|
256
|
+
- efs_have_backup_enabled
|
|
257
|
+
- rds_instance_backup_enabled
|
|
258
|
+
- rds_instance_multi_az
|
|
259
|
+
- redshift_cluster_automated_snapshot
|
|
260
|
+
- s3_bucket_object_versioning
|
|
261
|
+
- id: 164_308_a_7_ii_a
|
|
262
|
+
title: Establish and implement procedures to create and maintain retrievable exact
|
|
263
|
+
copies of electronic protected health information.
|
|
264
|
+
checks:
|
|
265
|
+
- dynamodb_tables_pitr_enabled
|
|
266
|
+
- efs_have_backup_enabled
|
|
267
|
+
- rds_instance_backup_enabled
|
|
268
|
+
- rds_instance_multi_az
|
|
269
|
+
- redshift_cluster_automated_snapshot
|
|
270
|
+
- s3_bucket_object_versioning
|
|
271
|
+
- id: 164_308_a_7_ii_b
|
|
272
|
+
title: Establish (and implement as needed) procedures to restore any loss of data.
|
|
273
|
+
checks:
|
|
274
|
+
- dynamodb_tables_pitr_enabled
|
|
275
|
+
- efs_have_backup_enabled
|
|
276
|
+
- rds_instance_backup_enabled
|
|
277
|
+
- rds_instance_multi_az
|
|
278
|
+
- redshift_cluster_automated_snapshot
|
|
279
|
+
- s3_bucket_object_versioning
|
|
280
|
+
- id: 164_308_a_7_ii_c
|
|
281
|
+
title: Establish (and implement as needed) procedures to enable continuation of
|
|
282
|
+
critical business processes for protection of the security of electronic protected
|
|
283
|
+
health information while operating in emergency mode.
|
|
284
|
+
checks:
|
|
285
|
+
- dynamodb_tables_pitr_enabled
|
|
286
|
+
- efs_have_backup_enabled
|
|
287
|
+
- rds_instance_backup_enabled
|
|
288
|
+
- rds_instance_multi_az
|
|
289
|
+
- redshift_cluster_automated_snapshot
|
|
290
|
+
- s3_bucket_object_versioning
|
|
291
|
+
- id: 164_308_a_8
|
|
292
|
+
title: Perform a periodic technical and nontechnical evaluation, based initially
|
|
293
|
+
upon the standards implemented under this rule and subsequently, in response to
|
|
294
|
+
environmental or operational changes affecting the security of electronic protected
|
|
295
|
+
health information, that establishes the extent to which an e…
|
|
296
|
+
checks:
|
|
297
|
+
- guardduty_is_enabled
|
|
298
|
+
- securityhub_enabled
|
|
299
|
+
- id: 164_312_a_1
|
|
300
|
+
title: Implement technical policies and procedures for electronic information systems
|
|
301
|
+
that maintain electronic protected health information to allow access only to
|
|
302
|
+
those persons or software programs that have been granted access rights as specified
|
|
303
|
+
in 164.308(a)(4).
|
|
304
|
+
checks:
|
|
305
|
+
- awslambda_function_not_publicly_accessible
|
|
306
|
+
- awslambda_function_url_public
|
|
307
|
+
- ec2_confidential_workload_host_imdsv2_not_enforced
|
|
308
|
+
- ec2_confidential_workload_host_public_ip
|
|
309
|
+
- ec2_ebs_public_snapshot
|
|
310
|
+
- ec2_instance_public_ip
|
|
311
|
+
- emr_cluster_master_nodes_no_public_ip
|
|
312
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
313
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
314
|
+
- iam_inline_policy_no_administrative_privileges
|
|
315
|
+
- iam_user_mfa_enabled_console_access
|
|
316
|
+
- kms_key_enclave_attestation_bypassable_path
|
|
317
|
+
- rds_instance_no_public_access
|
|
318
|
+
- rds_snapshots_public_access
|
|
319
|
+
- redshift_cluster_public_access
|
|
320
|
+
- s3_bucket_policy_public_write_access
|
|
321
|
+
- s3_bucket_public_access
|
|
322
|
+
- sagemaker_notebook_instance_without_direct_internet_access_configured
|
|
323
|
+
- id: 164_312_a_2_i
|
|
324
|
+
title: Assign a unique name and/or number for identifying and tracking user identity.
|
|
325
|
+
checks:
|
|
326
|
+
- cloudtrail_s3_dataevents_read_enabled
|
|
327
|
+
- cloudtrail_s3_dataevents_write_enabled
|
|
328
|
+
- iam_no_root_access_key
|
|
329
|
+
- s3_bucket_public_access
|
|
330
|
+
- id: 164_312_a_2_ii
|
|
331
|
+
title: Establish (and implement as needed) procedures for obtaining necessary electronic
|
|
332
|
+
protected health information during an emergency.
|
|
333
|
+
checks:
|
|
334
|
+
- dynamodb_tables_pitr_enabled
|
|
335
|
+
- efs_have_backup_enabled
|
|
336
|
+
- rds_instance_backup_enabled
|
|
337
|
+
- redshift_cluster_automated_snapshot
|
|
338
|
+
- s3_bucket_object_versioning
|
|
339
|
+
- id: 164_312_a_2_iv
|
|
340
|
+
title: Implement a mechanism to encrypt and decrypt electronic protected health
|
|
341
|
+
information.
|
|
342
|
+
checks:
|
|
343
|
+
- cloudtrail_kms_encryption_enabled
|
|
344
|
+
- cloudwatch_log_group_kms_encryption_enabled
|
|
345
|
+
- dynamodb_accelerator_cluster_encryption_enabled
|
|
346
|
+
- dynamodb_tables_kms_cmk_encryption_enabled
|
|
347
|
+
- ec2_ebs_default_encryption
|
|
348
|
+
- ec2_ebs_volume_encryption
|
|
349
|
+
- efs_encryption_at_rest_enabled
|
|
350
|
+
- eks_cluster_kms_cmk_encryption_in_secrets_enabled
|
|
351
|
+
- kms_cmk_rotation_enabled
|
|
352
|
+
- kms_key_enclave_attestation_not_enforced
|
|
353
|
+
- opensearch_service_domains_encryption_at_rest_enabled
|
|
354
|
+
- rds_instance_storage_encrypted
|
|
355
|
+
- redshift_cluster_audit_logging
|
|
356
|
+
- s3_bucket_default_encryption
|
|
357
|
+
- s3_bucket_secure_transport_policy
|
|
358
|
+
- sagemaker_notebook_instance_encryption_enabled
|
|
359
|
+
- sns_topics_kms_encryption_at_rest_enabled
|
|
360
|
+
- id: 164_312_b
|
|
361
|
+
title: Implement hardware, software, and/or procedural mechanisms that record and
|
|
362
|
+
examine activity in information systems that contain or use electronic protected
|
|
363
|
+
health information.
|
|
364
|
+
checks:
|
|
365
|
+
- apigateway_restapi_logging_enabled
|
|
366
|
+
- cloudtrail_bedrock_logging_enabled
|
|
367
|
+
- cloudtrail_cloudwatch_logging_enabled
|
|
368
|
+
- cloudtrail_log_file_validation_enabled
|
|
369
|
+
- cloudtrail_multi_region_enabled
|
|
370
|
+
- cloudtrail_s3_dataevents_read_enabled
|
|
371
|
+
- cloudtrail_s3_dataevents_write_enabled
|
|
372
|
+
- cloudwatch_log_group_retention_policy_specific_days_enabled
|
|
373
|
+
- elb_logging_enabled
|
|
374
|
+
- elbv2_logging_enabled
|
|
375
|
+
- guardduty_is_enabled
|
|
376
|
+
- kms_key_enclave_debug_attestation_detected
|
|
377
|
+
- rds_instance_integration_cloudwatch_logs
|
|
378
|
+
- redshift_cluster_audit_logging
|
|
379
|
+
- s3_bucket_server_access_logging_enabled
|
|
380
|
+
- securityhub_enabled
|
|
381
|
+
- vpc_flow_logs_enabled
|
|
382
|
+
- id: 164_312_c_1
|
|
383
|
+
title: Implement policies and procedures to protect electronic protected health
|
|
384
|
+
information from improper alteration or destruction.
|
|
385
|
+
checks:
|
|
386
|
+
- cloudtrail_kms_encryption_enabled
|
|
387
|
+
- cloudtrail_log_file_validation_enabled
|
|
388
|
+
- ec2_ebs_volume_encryption
|
|
389
|
+
- kms_key_enclave_attestation_pcr_mismatch
|
|
390
|
+
- s3_bucket_default_encryption
|
|
391
|
+
- s3_bucket_object_versioning
|
|
392
|
+
- s3_bucket_secure_transport_policy
|
|
393
|
+
- id: 164_312_c_2
|
|
394
|
+
title: Implement electronic mechanisms to corroborate that electronic protected
|
|
395
|
+
health information has not been altered or destroyed in an unauthorized manner.
|
|
396
|
+
checks:
|
|
397
|
+
- cloudtrail_kms_encryption_enabled
|
|
398
|
+
- cloudtrail_log_file_validation_enabled
|
|
399
|
+
- ec2_ebs_volume_encryption
|
|
400
|
+
- kms_key_enclave_attestation_unknown_image
|
|
401
|
+
- s3_bucket_default_encryption
|
|
402
|
+
- s3_bucket_object_versioning
|
|
403
|
+
- s3_bucket_secure_transport_policy
|
|
404
|
+
- vpc_flow_logs_enabled
|
|
405
|
+
- id: 164_312_d
|
|
406
|
+
title: Implement procedures to verify that a person or entity seeking access to
|
|
407
|
+
electronic protected health information is the one claimed.
|
|
408
|
+
checks:
|
|
409
|
+
- iam_password_policy_reuse_24
|
|
410
|
+
- iam_root_hardware_mfa_enabled
|
|
411
|
+
- iam_root_mfa_enabled
|
|
412
|
+
- iam_user_mfa_enabled_console_access
|
|
413
|
+
- id: 164_312_e_1
|
|
414
|
+
title: Implement technical security measures to guard against unauthorized access
|
|
415
|
+
to electronic protected health information that is being transmitted over an electronic
|
|
416
|
+
communications network.
|
|
417
|
+
checks:
|
|
418
|
+
- acm_certificates_expiration_check
|
|
419
|
+
- awslambda_function_not_publicly_accessible
|
|
420
|
+
- cloudfront_distributions_https_enabled
|
|
421
|
+
- ec2_confidential_workload_host_unrestricted_ingress
|
|
422
|
+
- ec2_confidential_workload_host_vsock_proxy_exposed
|
|
423
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
424
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
425
|
+
- elb_ssl_listeners
|
|
426
|
+
- opensearch_service_domains_node_to_node_encryption_enabled
|
|
427
|
+
- s3_bucket_secure_transport_policy
|
|
428
|
+
- id: 164_312_e_2_i
|
|
429
|
+
title: Implement security measures to ensure that electronically transmitted electronic
|
|
430
|
+
protected health information is not improperly modified without detection until
|
|
431
|
+
disposed of.
|
|
432
|
+
checks:
|
|
433
|
+
- cloudtrail_cloudwatch_logging_enabled
|
|
434
|
+
- cloudtrail_multi_region_enabled
|
|
435
|
+
- cloudtrail_s3_dataevents_read_enabled
|
|
436
|
+
- cloudtrail_s3_dataevents_write_enabled
|
|
437
|
+
- elb_ssl_listeners
|
|
438
|
+
- guardduty_is_enabled
|
|
439
|
+
- s3_bucket_secure_transport_policy
|
|
440
|
+
- s3_bucket_server_access_logging_enabled
|
|
441
|
+
- securityhub_enabled
|
|
442
|
+
- id: 164_312_e_2_ii
|
|
443
|
+
title: Implement a mechanism to encrypt electronic protected health information
|
|
444
|
+
whenever deemed appropriate.
|
|
445
|
+
checks:
|
|
446
|
+
- cloudtrail_kms_encryption_enabled
|
|
447
|
+
- cloudwatch_log_group_kms_encryption_enabled
|
|
448
|
+
- dynamodb_accelerator_cluster_encryption_enabled
|
|
449
|
+
- dynamodb_tables_kms_cmk_encryption_enabled
|
|
450
|
+
- ec2_ebs_default_encryption
|
|
451
|
+
- ec2_ebs_volume_encryption
|
|
452
|
+
- efs_encryption_at_rest_enabled
|
|
453
|
+
- eks_cluster_kms_cmk_encryption_in_secrets_enabled
|
|
454
|
+
- elb_ssl_listeners
|
|
455
|
+
- opensearch_service_domains_encryption_at_rest_enabled
|
|
456
|
+
- rds_instance_storage_encrypted
|
|
457
|
+
- redshift_cluster_audit_logging
|
|
458
|
+
- s3_bucket_default_encryption
|
|
459
|
+
- s3_bucket_secure_transport_policy
|
|
460
|
+
- sagemaker_notebook_instance_encryption_enabled
|
|
461
|
+
- sns_topics_kms_encryption_at_rest_enabled
|