{"_id":"@cloudgraph/policy-pack-aws-cis-1.5.0","_rev":"3-64dcdbe70ba59e71f0f01b56ece08e25","name":"@cloudgraph/policy-pack-aws-cis-1.5.0","dist-tags":{"alpha":"1.0.1-alpha.2","latest":"1.0.0"},"versions":{"1.0.0-alpha.1":{"name":"@cloudgraph/policy-pack-aws-cis-1.5.0","description":"Policy pack implementing CIS Amazon Web Services Foundations 1.5.0 Benchmark","version":"1.0.0-alpha.1","author":{"name":"AutoCloud"},"license":"MPL-2.0","main":"dist/index.js","types":"dist/index.d.ts","repository":{"type":"git","url":"git+ssh://git@github.com/cloudgraphdev/cloudgraph-policy-packs.git","directory":"src/aws/cis-1.5.0"},"bugs":{"url":"https://github.com/cloudgraphdev/cloudgraph-policy-packs/issues"},"publishConfig":{"access":"public"},"directories":{"test":"tests"},"devDependencies":{"@autocloud/eslint-config":"^0.1.0","@cloudgraph/sdk":"^0.21.1","@types/jest":"^27.0.3","@types/node":"^15.12.4","@types/pino":"^6.3.11","@typescript-eslint/eslint-plugin":"^4.28.5","@typescript-eslint/parser":"^4.28.5","cpx":"^1.5.0","cuid":"^2.1.8","eslint":"^7.25.0","eslint-config-airbnb-base":"14.2.1","eslint-config-prettier":"^6.11.0","eslint-plugin-import":"^2.22.1","eslint-plugin-prettier":"^3.4.0","jest":"^27.0.6","prettier":"^2.4.1","shx":"^0.3.3","ts-jest":"^27.0.4","tslib":"^1","typescript":"^4.3.5"},"engines":{"node":">=14.0.0"},"homepage":"https://www.cloudgraph.dev/","keywords":["cloudgraph"],"prettier":{"semi":false,"singleQuote":true},"scripts":{"build":"npm run prepack","clean":"rm -rf dist","lint":"eslint","prepack":"rm -rf dist && tsc -b","test":"NODE_ENV=test jest","release":"npx semantic-release --no-ci -e semantic-release-monorepo"},"gitHead":"145a9326253cdbaa2246a655bcbbc5b82fe1027d","_id":"@cloudgraph/policy-pack-aws-cis-1.5.0@1.0.0-alpha.1","_nodeVersion":"18.12.1","_npmVersion":"8.19.3","dist":{"integrity":"sha512-hHjfc9q2mqoa+3JXwKaUZAAtRxOmWmB0xfv6410A1M1R4egAFZcxn70cD2zj1n+CEal84XRSR9CbjA7mfxqD3w==","shasum":"b1a6cb2eb746dd97bc96577ed231c62e0e0dc576","tarball":"https://registry.npmjs.org/@cloudgraph/policy-pack-aws-cis-1.5.0/-/policy-pack-aws-cis-1.5.0-1.0.0-alpha.1.tgz","fileCount":131,"unpackedSize":370854,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIHV2MKD5kziZ4riFfsX4BwkFhPGvXkvEhZuMQRi/F3mTAiAEZS8olfFOZ/PDvDRG9n/s9vClenrS9AyNtDZANsvR7g=="}],"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJjmRw/ACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2VmokHA/+Jok98C628SSF6gK9v7UoITKPQfnZaXY2h+FTWsWw/qSL9k8Z\r\nkFJBjiO0+n2QQ+uXFM7H6Fs3mjOr+duccZmkJf5FB1sayI6kQt16ljLZSSpC\r\nTL4HnheWk5jDdFEa0VZbk+2qFnGAx3wdGnmn+f7zmj0wWtmge/GtAVi/rqzW\r\n7ZApkgbxXdPS7zhm94noOm3HDp3kHdu/xnIGrlQqfODWib1m0IVYOiDB9cZP\r\nGFCa+LiGo9lqOtoETfIebU+vIsdcJIOI9ddc4pIlCawW8laXlFXIpsYBuHZT\r\nb7Jo1088yo/Lbuo8PDZmgDJstaHFTBZwUqLpgMdKX3ESlYAMw0+d3CKCh1bz\r\nOE+W5CNkniJzlR5uhlv1YfrI339lfoGMV/AzmMoU+EeG25M8m488LMAEqvaT\r\njT//H9+PjAj5Pr+tpmRtrUnIOQQ6HiJ/lRghXE7Cbr+QLItI2NzZ8nucBs4y\r\n/HmIgZgfxF9KFATYpgaJoT9H3I751KiSs6mH2/QpMI4QBuya0L8yjpNwihFL\r\nBTR7Uh0PdwMFfdfeu83TAfae7Gpp/7OeHnnE/e+OYrIW9O0qIqonsLZ7u2RA\r\nYH3hwMMWq02tL2rAPrSbkCCpnXzTQ7b8owQixK8p/1Mr3WkysMHiiY4n6FNw\r\nktdtIkyFnylIeGZKDaEJB++Xq8pqHOJP0bA=\r\n=x10w\r\n-----END PGP SIGNATURE-----\r\n"},"_npmUser":{"name":"ckoning","email":"chris@autocloud.dev"},"maintainers":[{"name":"ckoning","email":"chris@autocloud.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/policy-pack-aws-cis-1.5.0_1.0.0-alpha.1_1670978623671_0.3689852357129879"},"_hasShrinkwrap":false},"1.0.0":{"name":"@cloudgraph/policy-pack-aws-cis-1.5.0","description":"Policy pack implementing CIS Amazon Web Services Foundations 1.5.0 Benchmark","version":"1.0.0","author":{"name":"AutoCloud"},"license":"MPL-2.0","main":"dist/index.js","types":"dist/index.d.ts","repository":{"type":"git","url":"git+ssh://git@github.com/cloudgraphdev/cloudgraph-policy-packs.git","directory":"src/aws/cis-1.5.0"},"bugs":{"url":"https://github.com/cloudgraphdev/cloudgraph-policy-packs/issues"},"publishConfig":{"access":"public"},"directories":{"test":"tests"},"devDependencies":{"@autocloud/eslint-config":"^0.1.0","@cloudgraph/sdk":"^0.21.1","@types/jest":"^27.0.3","@types/node":"^15.12.4","@types/pino":"^6.3.11","@typescript-eslint/eslint-plugin":"^4.28.5","@typescript-eslint/parser":"^4.28.5","cpx":"^1.5.0","cuid":"^2.1.8","eslint":"^7.25.0","eslint-config-airbnb-base":"14.2.1","eslint-config-prettier":"^6.11.0","eslint-plugin-import":"^2.22.1","eslint-plugin-prettier":"^3.4.0","jest":"^27.0.6","prettier":"^2.4.1","shx":"^0.3.3","ts-jest":"^27.0.4","tslib":"^1","typescript":"^4.3.5"},"engines":{"node":">=14.0.0"},"homepage":"https://www.cloudgraph.dev/","keywords":["cloudgraph"],"prettier":{"semi":false,"singleQuote":true},"scripts":{"build":"npm run prepack","clean":"rm -rf dist","lint":"eslint","prepack":"rm -rf dist && tsc -b","test":"NODE_ENV=test jest","release":"npx semantic-release --no-ci"},"gitHead":"acfdbe193301a55a17508813a74137ac0824d1d1","_id":"@cloudgraph/policy-pack-aws-cis-1.5.0@1.0.0","_nodeVersion":"18.16.0","_npmVersion":"9.5.1","dist":{"integrity":"sha512-R+80HxZzho6zYdbhuqyPoJ2+SojOHrFHdDVXHCJ4hCnTWUlHdeyW+NISIijJoa+ilAukH8V+DR585hsr5JN/+Q==","shasum":"a2eea7bc11a5da068a0b1302aee5aaca55826863","tarball":"https://registry.npmjs.org/@cloudgraph/policy-pack-aws-cis-1.5.0/-/policy-pack-aws-cis-1.5.0-1.0.0.tgz","fileCount":133,"unpackedSize":432185,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQDnEj1IiZtkH+KwvYramJDQLA+bN5MWDeVfWXbjD7WW6AIhAN8scFnyoFyjSgjkDuQCjxUTRj2GGuxQCXXMOiMAeJu8"}],"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJkS/rpACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2VmpTYQ//YRRH+xCqgTd2uI4mqs5sbiURgsTqTzSfO1/LjLH/MRZQ/zYG\r\nu4D6Bcl0EC0YpSMpM1yU/sWW8lT9eYE0xoz4PfiO/w6R2nujwdQT8jlEU80f\r\nvTWiMVDtSkv5O0HDcpanjL1ZYYcSLGWbhRbeBV/16gkqO2oXyalrBldWJpz4\r\nI7OAC88uytqEf3olU590B00MsXHtczlepoZQhKtDnKoJlPKUXGKKF+Q+q/pi\r\n9DUXqHClCpRvTza/WR/TF7dkwpJXVsy8HPQRAZNuI1Eolz2FWh6HW44LXfus\r\ntg/VQS3STIcxeWIF0NaIJXEFAsTuXEZm0PBf+yyx1sbUU+pUERdO100K4JIC\r\nDOciDgdreI5JBTpiI/9/TL4kMMqAG2RHTFmv/18KFdmDFxCY2IWLzp8C47jn\r\n8QHPinrlvucP8B/SP83QcObZb3Dl6t/TwT1HPnOwoWRNw9IwcHzsxRkyIxdY\r\nvbQNv56/vxsK3dFDWxB/V1LeB1tfLFNpqVJKtXQP16iBeJe3MOzPekd5cWhj\r\nEK0ayveK0vdzlIKJkfGoRP5HdBSW3Vxe9jZ4d3UwGwK6A6yF7PA/4793vEZ6\r\n7FbCo3KwS+Kro1EkKx0rfU+u2TYVTyFze8wPTS4HXV3Piu77TQIXftaTCOyS\r\n71B4jBz3pQ32B03pVBE7hQ0XGGz8mMArvCQ=\r\n=x64E\r\n-----END PGP SIGNATURE-----\r\n"},"_npmUser":{"name":"ckoning","email":"chris@autocloud.dev"},"maintainers":[{"name":"ckoning","email":"chris@autocloud.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/policy-pack-aws-cis-1.5.0_1.0.0_1682701032990_0.45164477566552197"},"_hasShrinkwrap":false},"1.0.1-alpha.1":{"name":"@cloudgraph/policy-pack-aws-cis-1.5.0","description":"Policy pack implementing CIS Amazon Web Services Foundations 1.5.0 Benchmark","version":"1.0.1-alpha.1","author":{"name":"AutoCloud"},"license":"MPL-2.0","main":"dist/index.js","types":"dist/index.d.ts","repository":{"type":"git","url":"git+ssh://git@github.com/cloudgraphdev/cloudgraph-policy-packs.git","directory":"src/aws/cis-1.5.0"},"bugs":{"url":"https://github.com/cloudgraphdev/cloudgraph-policy-packs/issues"},"publishConfig":{"access":"public"},"directories":{"test":"tests"},"devDependencies":{"@autocloud/eslint-config":"^0.1.0","@cloudgraph/sdk":"^0.21.1","@types/jest":"^27.0.3","@types/node":"^15.12.4","@types/pino":"^6.3.11","@typescript-eslint/eslint-plugin":"^4.28.5","@typescript-eslint/parser":"^4.28.5","cpx":"^1.5.0","cuid":"^2.1.8","eslint":"^7.25.0","eslint-config-airbnb-base":"14.2.1","eslint-config-prettier":"^6.11.0","eslint-plugin-import":"^2.22.1","eslint-plugin-prettier":"^3.4.0","jest":"^27.0.6","prettier":"^2.4.1","shx":"^0.3.3","ts-jest":"^27.0.4","tslib":"^1","typescript":"^4.3.5"},"engines":{"node":">=14.0.0"},"homepage":"https://www.cloudgraph.dev/","keywords":["cloudgraph"],"prettier":{"semi":false,"singleQuote":true},"scripts":{"build":"npm run prepack","clean":"rm -rf dist","lint":"eslint","prepack":"rm -rf dist && tsc -b","test":"NODE_ENV=test jest","release":"npx semantic-release"},"readme":"# CIS Amazon Web Services Foundations 1.5.0\n\nPolicy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d/10EoDf68wxwA2fmgAntElaX_-r6L5qf4B/view?usp=sharing) benchmark provided by the [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/amazon_web_services/)\n\n## First Steps\n\n1. Install [Cloud Graph CLI](https://docs.cloudgraph.dev/quick-start).\n2. Set up the [AWS Provider](https://www.npmjs.com/package/@cloudgraph/cg-provider-aws) for CG with the `cg init aws` command.\n3. Add Policy Pack for CIS Amazon Web Services Foundations benchmark using `cg policy add aws-cis-1.5.0` command.\n4. Execute the ruleset using the scan command `cg scan aws`.\n5. Query the findings using the different options:\n\n 5a. Querying findings by provider:\n\n ```graphql\n query {\n queryawsFindings {\n CISFindings {\n id\n resourceId\n result\n }\n }\n }\n ```\n\n 5b. Querying findings by specific benchmark:\n\n ```graphql\n query {\n queryawsCISFindings {\n id\n resourceId\n result\n }\n }\n ```\n\n 5c. Querying findings by resource:\n\n ```graphql\n query {\n queryawsIamUser {\n id\n arn\n accountId\n CISFindings {\n id\n resourceId\n result\n }\n }\n }\n ```\n\n## Available Ruleset\n\n| Rule | Description |\n| ------------- | --------------------------------------------------------------------------------------------------------------------------- |\n| AWS CIS 1.1 | Maintain current contact details |\n| AWS CIS 1.2 | Ensure security contact information is registered |\n| AWS CIS 1.3 | Ensure security questions are registered in the AWS account |\n| AWS CIS 1.4 | Ensure no 'root' user account access key exists |\n| AWS CIS 1.5 | Ensure MFA is enabled for the 'root' user account |\n| AWS CIS 1.6 | Ensure hardware MFA is enabled for the 'root' user account |\n| AWS CIS 1.7 | Eliminate use of the 'root' user for administrative and daily tasks |\n| AWS CIS 1.8 | Ensure IAM password policy requires minimum length of 14 or greater |\n| AWS CIS 1.9 | Ensure IAM password policy prevents password reuse |\n| AWS CIS 1.10 | Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password |\n| AWS CIS 1.11 | Do not setup access keys during initial user setup for all IAM users that have a console password |\n| AWS CIS 1.12 | Ensure credentials unused for 45 days or greater are disabled |\n| AWS CIS 1.13 | Ensure there is only one active access key available for any single IAM user |\n| AWS CIS 1.14 | Ensure access keys are rotated every 90 days or less |\n| AWS CIS 1.15 | Ensure IAM Users Receive Permissions Only Through Groups |\n| AWS CIS 1.16 | Ensure IAM policies that allow full \"*:*\" administrative privileges are not attached |\n| AWS CIS 1.17 | Ensure a support role has been created to manage incidents with AWS Support |\n| AWS CIS 1.18 | Ensure IAM instance roles are used for AWS resource access from instances |\n| AWS CIS 1.19 | Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed |\n| AWS CIS 1.20 | Ensure that IAM Access analyzer is enabled for all regions |\n| AWS CIS 1.21 | Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments |\n| AWS CIS 2.1.1 | Ensure all S3 buckets employ encryption-at-rest |\n| AWS CIS 2.1.2 | Ensure S3 Bucket Policy allows HTTPS requests |\n| AWS CIS 2.1.3 | Ensure MFA Delete is enable on S3 buckets |\n| AWS CIS 2.1.4 | Ensure all data in Amazon S3 has been discovered, classified and secured when required. |\n| AWS CIS 2.1.5 | Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' |\n| AWS CIS 2.2.1 | Ensure EBS volume encryption is enabled |\n| AWS CIS 2.3.1 | Ensure that encryption is enabled for RDS Instances |\n| AWS CIS 2.3.2 | Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances |\n| AWS CIS 2.3.3 | Ensure that public access is not given to RDS Instance |\n| AWS CIS 2.4.1 | Ensure that encryption is enabled for EFS file systems |\n| AWS CIS 3.1 | Ensure CloudTrail is enabled in all regions |\n| AWS CIS 3.2 | Ensure CloudTrail log file validation is enabled |\n| AWS CIS 3.3 | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible |\n| AWS CIS 3.4 | Ensure CloudTrail trails are integrated with CloudWatch Logs |\n| AWS CIS 3.5 | Ensure AWS Config is enabled in all regions |\n| AWS CIS 3.6 | Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket |\n| AWS CIS 3.7 | Ensure CloudTrail logs are encrypted at rest using KMS CMKs |\n| AWS CIS 3.8 | Ensure rotation for customer created CMKs is enabled |\n| AWS CIS 3.9 | Ensure VPC flow logging is enabled in all VPCs |\n| AWS CIS 3.10 | Ensure that Object-level logging for write events is enabled for S3 bucket |\n| AWS CIS 3.11 | Ensure that Object-level logging for read events is enabled for S3 bucket |\n| AWS CIS 4.1 | Ensure a log metric filter and alarm exist for unauthorized API calls |\n| AWS CIS 4.2 | Ensure a log metric filter and alarm exist for Management Console sign-in without MFA |\n| AWS CIS 4.3 | Ensure a log metric filter and alarm exist for usage of 'root' account |\n| AWS CIS 4.4 | Ensure a log metric filter and alarm exist for IAM policy changes |\n| AWS CIS 4.5 | Ensure a log metric filter and alarm exist for CloudTrail configuration changes |\n| AWS CIS 4.6 | Ensure a log metric filter and alarm exist for AWS Management Console authentication failures |\n| AWS CIS 4.7 | Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs |\n| AWS CIS 4.8 | Ensure a log metric filter and alarm exist for S3 bucket policy changes |\n| AWS CIS 4.9 | Ensure a log metric filter and alarm exist for AWS Config configuration changes |\n| AWS CIS 4.10 | Ensure a log metric filter and alarm exist for security group changes |\n| AWS CIS 4.11 | Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) |\n| AWS CIS 4.12 | Ensure a log metric filter and alarm exist for changes to network gateways |\n| AWS CIS 4.13 | Ensure a log metric filter and alarm exist for route table changes |\n| AWS CIS 4.14 | Ensure a log metric filter and alarm exist for VPC changes |\n| AWS CIS 4.15 | Ensure a log metric filter and alarm exists for AWS Organizations changes |\n| AWS CIS 4.16 | Ensure AWS Security Hub is enabled |\n| AWS CIS 5.1 | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports |\n| AWS CIS 5.2 | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports |\n| AWS CIS 5.3 | Ensure no security groups allow ingress from ::/0 to remote server administration ports |\n| AWS CIS 5.4 | Ensure the default security group of every VPC restricts all traffic |\n| AWS CIS 5.5 | Ensure routing tables for VPC peering are \"least access\" |\n","readmeFilename":"README.md","gitHead":"b49ab18f25abab9728c64e2e715b84ccf30204d7","_id":"@cloudgraph/policy-pack-aws-cis-1.5.0@1.0.1-alpha.1","_nodeVersion":"18.16.0","_npmVersion":"9.5.1","dist":{"integrity":"sha512-T6kAxg/YsmoE83zJY6QJcQRJ57AHu3+H7czetnBiFJpZnTl1jUUPr1f1Dg67wZLjZIDuXu72nOrpYYR1oMfM9Q==","shasum":"df90bdf50bc606fb6b80ce50d497aa7b0756433c","tarball":"https://registry.npmjs.org/@cloudgraph/policy-pack-aws-cis-1.5.0/-/policy-pack-aws-cis-1.5.0-1.0.1-alpha.1.tgz","fileCount":3,"unpackedSize":72096,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIE37QuSyH1T+9TrnqmODCYfq8OH7yIYRxkWsyZuKTIiSAiAUOJ1XnOCXADjNtIWQ4IBF85zsBdp7dEWoI2ycoircDA=="}]},"_npmUser":{"name":"ckoning","email":"chris@autocloud.dev"},"maintainers":[{"name":"ckoning","email":"chris@autocloud.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/policy-pack-aws-cis-1.5.0_1.0.1-alpha.1_1684332648519_0.3833019685882504"},"_hasShrinkwrap":false},"1.0.1-alpha.2":{"name":"@cloudgraph/policy-pack-aws-cis-1.5.0","description":"Policy pack implementing CIS Amazon Web Services Foundations 1.5.0 Benchmark","version":"1.0.1-alpha.2","author":{"name":"AutoCloud"},"license":"MPL-2.0","main":"dist/index.js","types":"dist/index.d.ts","repository":{"type":"git","url":"git+ssh://git@github.com/cloudgraphdev/cloudgraph-policy-packs.git","directory":"src/aws/cis-1.5.0"},"bugs":{"url":"https://github.com/cloudgraphdev/cloudgraph-policy-packs/issues"},"publishConfig":{"access":"public"},"directories":{"test":"tests"},"devDependencies":{"@autocloud/eslint-config":"^0.1.0","@cloudgraph/sdk":"^0.21.1","@types/jest":"^27.0.3","@types/node":"^15.12.4","@types/pino":"^6.3.11","@typescript-eslint/eslint-plugin":"^4.28.5","@typescript-eslint/parser":"^4.28.5","cpx":"^1.5.0","cuid":"^2.1.8","eslint":"^7.25.0","eslint-config-airbnb-base":"14.2.1","eslint-config-prettier":"^6.11.0","eslint-plugin-import":"^2.22.1","eslint-plugin-prettier":"^3.4.0","jest":"^27.0.6","prettier":"^2.4.1","shx":"^0.3.3","ts-jest":"^27.0.4","tslib":"^1","typescript":"^4.3.5"},"engines":{"node":">=14.0.0"},"homepage":"https://www.cloudgraph.dev/","keywords":["cloudgraph"],"prettier":{"semi":false,"singleQuote":true},"scripts":{"build":"npm run prepack","clean":"rm -rf dist","lint":"eslint","prepack":"rm -rf dist && tsc -b","test":"NODE_ENV=test jest","release":"npx semantic-release"},"readme":"# CIS Amazon Web Services Foundations 1.5.0\n\nPolicy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d/10EoDf68wxwA2fmgAntElaX_-r6L5qf4B/view?usp=sharing) benchmark provided by the [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/amazon_web_services/)\n\n## First Steps\n\n1. Install [Cloud Graph CLI](https://docs.cloudgraph.dev/quick-start).\n2. Set up the [AWS Provider](https://www.npmjs.com/package/@cloudgraph/cg-provider-aws) for CG with the `cg init aws` command.\n3. Add Policy Pack for CIS Amazon Web Services Foundations benchmark using `cg policy add aws-cis-1.5.0` command.\n4. Execute the ruleset using the scan command `cg scan aws`.\n5. Query the findings using the different options:\n\n 5a. Querying findings by provider:\n\n ```graphql\n query {\n queryawsFindings {\n CISFindings {\n id\n resourceId\n result\n }\n }\n }\n ```\n\n 5b. Querying findings by specific benchmark:\n\n ```graphql\n query {\n queryawsCISFindings {\n id\n resourceId\n result\n }\n }\n ```\n\n 5c. Querying findings by resource:\n\n ```graphql\n query {\n queryawsIamUser {\n id\n arn\n accountId\n CISFindings {\n id\n resourceId\n result\n }\n }\n }\n ```\n\n## Available Ruleset\n\n| Rule | Description |\n| ------------- | --------------------------------------------------------------------------------------------------------------------------- |\n| AWS CIS 1.1 | Maintain current contact details |\n| AWS CIS 1.2 | Ensure security contact information is registered |\n| AWS CIS 1.3 | Ensure security questions are registered in the AWS account |\n| AWS CIS 1.4 | Ensure no 'root' user account access key exists |\n| AWS CIS 1.5 | Ensure MFA is enabled for the 'root' user account |\n| AWS CIS 1.6 | Ensure hardware MFA is enabled for the 'root' user account |\n| AWS CIS 1.7 | Eliminate use of the 'root' user for administrative and daily tasks |\n| AWS CIS 1.8 | Ensure IAM password policy requires minimum length of 14 or greater |\n| AWS CIS 1.9 | Ensure IAM password policy prevents password reuse |\n| AWS CIS 1.10 | Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password |\n| AWS CIS 1.11 | Do not setup access keys during initial user setup for all IAM users that have a console password |\n| AWS CIS 1.12 | Ensure credentials unused for 45 days or greater are disabled |\n| AWS CIS 1.13 | Ensure there is only one active access key available for any single IAM user |\n| AWS CIS 1.14 | Ensure access keys are rotated every 90 days or less |\n| AWS CIS 1.15 | Ensure IAM Users Receive Permissions Only Through Groups |\n| AWS CIS 1.16 | Ensure IAM policies that allow full \"*:*\" administrative privileges are not attached |\n| AWS CIS 1.17 | Ensure a support role has been created to manage incidents with AWS Support |\n| AWS CIS 1.18 | Ensure IAM instance roles are used for AWS resource access from instances |\n| AWS CIS 1.19 | Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed |\n| AWS CIS 1.20 | Ensure that IAM Access analyzer is enabled for all regions |\n| AWS CIS 1.21 | Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments |\n| AWS CIS 2.1.1 | Ensure all S3 buckets employ encryption-at-rest |\n| AWS CIS 2.1.2 | Ensure S3 Bucket Policy allows HTTPS requests |\n| AWS CIS 2.1.3 | Ensure MFA Delete is enable on S3 buckets |\n| AWS CIS 2.1.4 | Ensure all data in Amazon S3 has been discovered, classified and secured when required. |\n| AWS CIS 2.1.5 | Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' |\n| AWS CIS 2.2.1 | Ensure EBS volume encryption is enabled |\n| AWS CIS 2.3.1 | Ensure that encryption is enabled for RDS Instances |\n| AWS CIS 2.3.2 | Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances |\n| AWS CIS 2.3.3 | Ensure that public access is not given to RDS Instance |\n| AWS CIS 2.4.1 | Ensure that encryption is enabled for EFS file systems |\n| AWS CIS 3.1 | Ensure CloudTrail is enabled in all regions |\n| AWS CIS 3.2 | Ensure CloudTrail log file validation is enabled |\n| AWS CIS 3.3 | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible |\n| AWS CIS 3.4 | Ensure CloudTrail trails are integrated with CloudWatch Logs |\n| AWS CIS 3.5 | Ensure AWS Config is enabled in all regions |\n| AWS CIS 3.6 | Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket |\n| AWS CIS 3.7 | Ensure CloudTrail logs are encrypted at rest using KMS CMKs |\n| AWS CIS 3.8 | Ensure rotation for customer created CMKs is enabled |\n| AWS CIS 3.9 | Ensure VPC flow logging is enabled in all VPCs |\n| AWS CIS 3.10 | Ensure that Object-level logging for write events is enabled for S3 bucket |\n| AWS CIS 3.11 | Ensure that Object-level logging for read events is enabled for S3 bucket |\n| AWS CIS 4.1 | Ensure a log metric filter and alarm exist for unauthorized API calls |\n| AWS CIS 4.2 | Ensure a log metric filter and alarm exist for Management Console sign-in without MFA |\n| AWS CIS 4.3 | Ensure a log metric filter and alarm exist for usage of 'root' account |\n| AWS CIS 4.4 | Ensure a log metric filter and alarm exist for IAM policy changes |\n| AWS CIS 4.5 | Ensure a log metric filter and alarm exist for CloudTrail configuration changes |\n| AWS CIS 4.6 | Ensure a log metric filter and alarm exist for AWS Management Console authentication failures |\n| AWS CIS 4.7 | Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs |\n| AWS CIS 4.8 | Ensure a log metric filter and alarm exist for S3 bucket policy changes |\n| AWS CIS 4.9 | Ensure a log metric filter and alarm exist for AWS Config configuration changes |\n| AWS CIS 4.10 | Ensure a log metric filter and alarm exist for security group changes |\n| AWS CIS 4.11 | Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) |\n| AWS CIS 4.12 | Ensure a log metric filter and alarm exist for changes to network gateways |\n| AWS CIS 4.13 | Ensure a log metric filter and alarm exist for route table changes |\n| AWS CIS 4.14 | Ensure a log metric filter and alarm exist for VPC changes |\n| AWS CIS 4.15 | Ensure a log metric filter and alarm exists for AWS Organizations changes |\n| AWS CIS 4.16 | Ensure AWS Security Hub is enabled |\n| AWS CIS 5.1 | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports |\n| AWS CIS 5.2 | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports |\n| AWS CIS 5.3 | Ensure no security groups allow ingress from ::/0 to remote server administration ports |\n| AWS CIS 5.4 | Ensure the default security group of every VPC restricts all traffic |\n| AWS CIS 5.5 | Ensure routing tables for VPC peering are \"least access\" |\n","readmeFilename":"README.md","gitHead":"976a72d7f0c894c14d6d3642205d81d15f7f9e39","_id":"@cloudgraph/policy-pack-aws-cis-1.5.0@1.0.1-alpha.2","_nodeVersion":"18.16.0","_npmVersion":"9.5.1","dist":{"integrity":"sha512-jrr1YuP7o+GgLfZ82bjJ7J2ZGws3lJkL7GEHo5/6GkJkd7KVTMNi+Xzj6zGx073pdSzE4bx2c529gKIwaokxaQ==","shasum":"934019338e24509b798765a52b9c03d25bfbaa62","tarball":"https://registry.npmjs.org/@cloudgraph/policy-pack-aws-cis-1.5.0/-/policy-pack-aws-cis-1.5.0-1.0.1-alpha.2.tgz","fileCount":133,"unpackedSize":432952,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQCwdJrmJMak+AJYO1OgBSiWNJaBU1lK+CfPeoyXJH10igIhAN9UL745ZNUIGRKGRld0sXuSZZUU6RgwzvwOAZNxKfLB"}]},"_npmUser":{"name":"ckoning","email":"chris@autocloud.dev"},"maintainers":[{"name":"ckoning","email":"chris@autocloud.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/policy-pack-aws-cis-1.5.0_1.0.1-alpha.2_1684337612231_0.746885651388824"},"_hasShrinkwrap":false}},"time":{"created":"2022-12-14T00:43:43.596Z","1.0.0-alpha.1":"2022-12-14T00:43:43.915Z","modified":"2023-05-17T15:33:32.560Z","1.0.0":"2023-04-28T16:57:13.139Z","1.0.1-alpha.1":"2023-05-17T14:10:48.661Z","1.0.1-alpha.2":"2023-05-17T15:33:32.381Z"},"maintainers":[{"name":"ckoning","email":"chris@autocloud.dev"}],"description":"Policy pack implementing CIS Amazon Web Services Foundations 1.5.0 Benchmark","homepage":"https://www.cloudgraph.dev/","keywords":["cloudgraph"],"repository":{"type":"git","url":"git+ssh://git@github.com/cloudgraphdev/cloudgraph-policy-packs.git","directory":"src/aws/cis-1.5.0"},"author":{"name":"AutoCloud"},"bugs":{"url":"https://github.com/cloudgraphdev/cloudgraph-policy-packs/issues"},"license":"MPL-2.0","readme":"","readmeFilename":""}