Praktik Terbaik Operasional untuk NZISM 3.9 (Transisi NZ)

Paket kesesuaian menyediakan kerangka kerja kepatuhan tujuan umum yang dirancang untuk memungkinkan Anda membuat pemeriksaan tata kelola keamanan, operasional, atau pengoptimalan biaya menggunakan aturan dan tindakan remediasi terkelola atau khusus. AWS Config AWS Config Paket Kesesuaian, sebagai contoh templat, tidak dirancang untuk sepenuhnya memastikan kepatuhan terhadap tata kelola atau standar kepatuhan tertentu. Anda bertanggung jawab untuk membuat penilaian sendiri tentang apakah penggunaan Layanan oleh Anda memenuhi persyaratan hukum dan peraturan yang berlaku.

Berikut ini memberikan contoh pemetaan antara Manual Keamanan Informasi (NZISM) Biro Keamanan Komunikasi Pemerintah Selandia Baru (GCSB) 2025-11 Versi 3.9 dan aturan Konfigurasi Terkelola. AWS Setiap aturan Config berlaku untuk jenis AWS sumber daya tertentu, dan berhubungan dengan satu atau beberapa kontrol NZISM. Kontrol NZISM dapat dikaitkan dengan beberapa aturan Config. Lihat tabel di bawah ini untuk detail lebih lanjut dan panduan terkait pemetaan ini. Hanya kontrol yang mewakili praktik yang direkomendasikan atau dasar untuk informasi yang diklasifikasikan DIBATASI dan di bawah ini yang termasuk dalam pemetaan.

Templat paket kesesuaian sampel ini berisi pemetaan ke kontrol dalam kerangka kerja NZISM, yang merupakan bagian integral dari kerangka Persyaratan Keamanan Pelindung (PSR) yang menetapkan harapan Pemerintah Selandia Baru untuk pengelolaan personel, informasi, dan keamanan fisik.

Bagian Foundation dari paket kesesuaian ini dapat dikerahkan ke Sydney dan wilayah global. Bagian Transisi NZ berisi subset aturan Foundation Config yang saat ini tersedia di wilayah Selandia Baru. Bagian Foundation saat ini tidak akan dikerahkan ke wilayah Selandia Baru. Bagian Ekstensi dari paket kesesuaian ini dapat dikerahkan ke wilayah Sydney dan Selandia Baru untuk menambah aturan Konfigurasi yang disediakan di bagian Foundation dan NZ Transisi.

NZISM dilisensikan di bawah lisensi Creative Commons Attribution 4.0 Selandia Baru, tersedia di. https://creativecommons.org/licenses/by/4.0/ Informasi hak cipta dapat ditemukan di Manual Keamanan Informasi Selandia Baru NZISM | Hukum, Privasi, dan Hak Cipta.

Templat

            ##################################################################################
            #
            #   Conformance Pack:
            #     Operational Best Practices for NZISM NZ Transition
            #
            #   This conformance pack helps verify compliance with NZISM requirements.
            #
            ##################################################################################

            Resources:
              AcmCertificateExpirationCheck:
                Controls: [ '1667' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: acm-certificate-expiration-check
                  InputParameters:
                    daysToExpiration: '30'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ACM::Certificate
                  Source:
                    Owner: AWS
                    SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
                  Description: "SHOULD 14.5.8.C.01[CID:1667]| Software security/Web Application Development/Web applications"
              AlbHttpToHttpsRedirectionCheck:
                Controls: [ '1847', '2090' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: alb-http-to-https-redirection-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK
                  Description: "MUST 16.1.37.C.01[CID:1847], MUST 17.1.55.C.02[CID:2090]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in t..."
              CloudTrailCloudWatchLogsEnabled:
                Controls: [ '1998', '6860' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-cloud-watch-logs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED
                  Description: "SHOULD 16.6.6.C.02[CID:1998], MUST 16.4.35.C.02[CID:6860]| Access Control and Passwords: (Event Logging and Auditing/Maintaining system management logs and Privileged..."
              CloudTrailEncryptionEnabled:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-encryption-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_ENCRYPTION_ENABLED
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              CloudTrailLogFileValidationEnabled:
                Controls: [ '2022', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-log-file-validation-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
                  Description: "MUST 16.6.12.C.01[CID:2022], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Event log protection and Public Cloud Security/Loggi..."
              CloudfrontAccesslogsEnabled:
                Condition: IsEdge
                Controls: [ '2013', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-accesslogs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_ACCESSLOGS_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Additional events to be logged and Public Cloud Se..."
              CloudfrontAssociatedWithWaf:
                Condition: IsEdge
                Controls: [ '3562' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-associated-with-waf
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_ASSOCIATED_WITH_WAF
                  Description: "MUST 19.1.12.C.01[CID:3562]| Gateway security/Gateways/Configuration of gateways"
              CloudfrontDefaultRootObjectConfigured:
                Condition: IsEdge
                Controls: [ '1661' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-default-root-object-configured
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED
                  Description: "SHOULD 14.5.6.C.01[CID:1661]| Software security/Web Application Development/Agency website content"
              CloudfrontViewerPolicyHttps:
                Condition: IsEdge
                Controls: [ '1847' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-viewer-policy-https
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_VIEWER_POLICY_HTTPS
                  Description: "MUST 16.1.37.C.01[CID:1847]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in transit"
              CloudtrailEnabled:
                Controls: [ '1998', '2013', '6860', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_ENABLED
                  Description: "SHOULD 16.6.6.C.02[CID:1998], SHOULD 16.6.10.C.02[CID:2013], MUST 16.4.35.C.02[CID:6860], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords: (Event Logging and..."
              CloudtrailS3DataeventsEnabled:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-s3-dataevents-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDTRAIL_S3_DATAEVENTS_ENABLED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              CloudtrailSecurityTrailEnabled:
                Controls: [ '6861' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-security-trail-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDTRAIL_SECURITY_TRAIL_ENABLED
                  Description: "MUST 16.4.35.C.03[CID:6861]| Access Control and Passwords/Privileged Access Management/Monitoring and Review"
              CloudwatchLogGroupEncrypted:
                Controls: [ '2022', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudwatch-log-group-encrypted
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDWATCH_LOG_GROUP_ENCRYPTED
                  Description: "MUST 16.6.12.C.01[CID:2022], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Event log protection and Public Cloud Security/Loggi..."
              CmkBackingKeyRotationEnabled:
                Controls: [ '3021' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cmk-backing-key-rotation-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CMK_BACKING_KEY_ROTATION_ENABLED
                  Description: "SHOULD 17.9.25.C.01[CID:3021]| Cryptography/Key Management/Contents of KMPs"
              CwLoggroupRetentionPeriodCheck:
                Controls: [ '1998', '2028' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cw-loggroup-retention-period-check
                  InputParameters:
                    MinRetentionTime: '545'
                  Source:
                    Owner: AWS
                    SourceIdentifier: CW_LOGGROUP_RETENTION_PERIOD_CHECK
                  Description: "SHOULD 16.6.6.C.02[CID:1998], MUST 16.6.13.C.01[CID:2028]| Access Control and Passwords/Event Logging and Auditing: (Maintaining system management logs and Event log ..."
              DbInstanceBackupEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: db-instance-backup-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              DmsReplicationNotPublic:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dms-replication-not-public
                  Source:
                    Owner: AWS
                    SourceIdentifier: DMS_REPLICATION_NOT_PUBLIC
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              DynamodbAutoscalingEnabled:
                Controls: [ '4829' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-autoscaling-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_AUTOSCALING_ENABLED
                  Description: "MUST 22.1.23.C.01[CID:4829]| Enterprise systems security/Cloud Computing/System Availability"
              DynamodbPitrEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-pitr-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_PITR_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              DynamodbTableEncryptedKms:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-table-encrypted-kms
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_TABLE_ENCRYPTED_KMS
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              EbsSnapshotPublicRestorableCheck:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ebs-snapshot-public-restorable-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              Ec2EbsEncryptionByDefault:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-ebs-encryption-by-default
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_EBS_ENCRYPTION_BY_DEFAULT
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              Ec2Imdsv2Check:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-imdsv2-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_IMDSV2_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              Ec2InstanceNoPublicIp:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-instance-no-public-ip
                  Scope:
                    ComplianceResourceTypes:
                    - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              Ec2InstancesInVpc:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-instances-in-vpc
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: INSTANCES_IN_VPC
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              EfsEncryptedCheck:
                Controls: [ '2082', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: efs-encrypted-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: EFS_ENCRYPTED_CHECK
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements and Enterpri..."
              ElasticacheRedisClusterAutomaticBackupCheck:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticache-redis-cluster-automatic-backup-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              ElasticsearchEncryptedAtRest:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-encrypted-at-rest
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_ENCRYPTED_AT_REST
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              ElasticsearchInVpcOnly:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-in-vpc-only
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_IN_VPC_ONLY
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              ElasticsearchNodeToNodeEncryptionCheck:
                Controls: [ '1847', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-node-to-node-encryption-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Elasticsearch::Domain
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK
                  Description: "MUST 16.1.37.C.01[CID:1847], SHOULD 22.1.24.C.04[CID:4839]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in..."
              ElbCrossZoneLoadBalancingEnabled:
                Controls: [ '4829' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-cross-zone-load-balancing-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED
                  Description: "MUST 22.1.23.C.01[CID:4829]| Enterprise systems security/Cloud Computing/System Availability"
              ElbCustomSecurityPolicySslCheck:
                Controls: [ '2598', '2600' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-custom-security-policy-ssl-check
                  InputParameters:
                    sslProtocolsAndCiphers: 'Protocol-TLSv1.2,ECDHE-ECDSA-AES256-GCM-SHA384'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_CUSTOM_SECURITY_POLICY_SSL_CHECK
                  Description: "SHOULD 17.4.16.C.01[CID:2598], SHOULD NOT 17.4.16.C.02[CID:2600]| Cryptography/Transport Layer Security/Using TLS"
              ElbLoggingEnabled:
                Controls: [ '2013', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-logging-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                      - AWS::ElasticLoadBalancingV2::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_LOGGING_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Additional events to be logged and Public Cloud Se..."
              ElbTlsHttpsListenersOnly:
                Controls: [ '1667', '1847', '2090', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-tls-https-listeners-only
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_TLS_HTTPS_LISTENERS_ONLY
                  Description: "SHOULD 14.5.8.C.01[CID:1667], MUST 16.1.37.C.01[CID:1847], MUST 17.1.55.C.02[CID:2090], SHOULD 22.1.24.C.04[CID:4839]| Software security/Web Application Development/We..."
              EncryptedVolumes:
                Controls: [ '2082', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: encrypted-volumes
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Volume
                  Source:
                    Owner: AWS
                    SourceIdentifier: ENCRYPTED_VOLUMES
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements and Enterpri..."
              IamPasswordPolicy:
                Controls: [ '7545', '7546' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: iam-password-policy
                  InputParameters:
                    MaxPasswordAge: '1095'
                    MinimumPasswordLength: '16'
                    PasswordReusePrevention: '24'
                    RequireUppercaseCharacters: 'false'
                    RequireLowercaseCharacters: 'false'
                    RequireSymbols: 'false'
                    RequireNumbers: 'false'
                  Source:
                    Owner: AWS
                    SourceIdentifier: IAM_PASSWORD_POLICY
                  Description: "MUST 16.1.31.C.02[CID:7545], MUST 16.1.31.C.03[CID:7546]| Access Control and Passwords/Identification, Authentication and Authentication/Passwords and policy"
              RdsAutomaticMinorVersionUpgradeEnabled:
                Controls: [ '3452' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-automatic-minor-version-upgrade-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLED
                  Description: "SHOULD 12.4.4.C.05[CID:3452]| Product Security/Product Patching and Updating/Patching vulnerabilities in products"
              RdsClusterDeletionProtectionEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-cluster-deletion-protection-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBCluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_CLUSTER_DELETION_PROTECTION_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RdsInstanceDeletionProtectionEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-instance-deletion-protection-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_INSTANCE_DELETION_PROTECTION_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RdsInstancePublicAccessCheck:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-instance-public-access-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              RdsLoggingEnabled:
                Controls: [ '2013', '4441', '4445', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-logging-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_LOGGING_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], SHOULD 20.4.4.C.02[CID:4441], SHOULD 20.4.5.C.02[CID:4445], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and ..."
              RdsSnapshotEncrypted:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-snapshot-encrypted
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBSnapshot
                      - AWS::RDS::DBClusterSnapshot
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_SNAPSHOT_ENCRYPTED
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              RdsSnapshotsPublicProhibited:
                Controls: [ '4441' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-snapshots-public-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBSnapshot
                      - AWS::RDS::DBClusterSnapshot
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED
                  Description: "SHOULD 20.4.4.C.02[CID:4441]| Data management/Databases/Database files"
              RdsStorageEncrypted:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-storage-encrypted
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_STORAGE_ENCRYPTED
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              RedshiftBackupEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-backup-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_BACKUP_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RedshiftClusterConfigurationCheck:
                Controls: [ '4441', '4445', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-configuration-check
                  InputParameters:
                    clusterDbEncrypted: 'true'
                    loggingEnabled: 'true'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK
                  Description: "SHOULD 20.4.4.C.02[CID:4441], SHOULD 20.4.5.C.02[CID:4445], SHOULD 22.1.24.C.04[CID:4839]| Data management/Databases: (Database files and Accountability) and Enterpr..."
              RedshiftClusterMaintenancesettingsCheck:
                Controls: [ '3449', '3453' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-maintenancesettings-check
                  InputParameters:
                    allowVersionUpgrade: 'true'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_MAINTENANCESETTINGS_CHECK
                  Description: "MUST 12.4.4.C.02[CID:3449], SHOULD 12.4.4.C.06[CID:3453]| Product Security/Product Patching and Updating/Patching vulnerabilities in products"
              RedshiftClusterPublicAccessCheck:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-public-access-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              RedshiftRequireTlsSsl:
                Controls: [ '2090', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-require-tls-ssl
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL
                  Description: "MUST 17.1.55.C.02[CID:2090], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Information and Systems Protection and Enterprise systems security..."
              RestrictedSsh:
                Controls: [ '2726' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: restricted-ssh
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: INCOMING_SSH_DISABLED
                  Description: "SHOULD 17.5.8.C.02[CID:2726]| Cryptography/Secure Shell/Automated remote access"
              S3AccountLevelPublicAccessBlocksPeriodic:
                Controls: [ '3562', '4838', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-account-level-public-access-blocks-periodic
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 22.1.24.C.03[CID:4838], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Enterprise systems se..."
              S3BucketPublicReadProhibited:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-public-read-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              S3BucketPublicWriteProhibited:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-public-write-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              S3BucketServerSideEncryptionEnabled:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-server-side-encryption-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              S3BucketSslRequestsOnly:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-ssl-requests-only
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              SecretsmanagerUsingCmk:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: secretsmanager-using-cmk
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::SecretsManager::Secret
                  Source:
                    Owner: AWS
                    SourceIdentifier: SECRETSMANAGER_USING_CMK
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              SecurityhubEnabled:
                Controls: [ '3875' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: securityhub-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: SECURITYHUB_ENABLED
                  Description: "SHOULD 18.4.12.C.01[CID:3875]| Network security/Intrusion Detection and Prevention/Event management and correlation"
              SsmDocumentNotPublic:
                Controls: [ '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ssm-document-not-public
                  Source:
                    Owner: AWS
                    SourceIdentifier: SSM_DOCUMENT_NOT_PUBLIC
                  Description: "MUST 23.4.10.C.01[CID:7466]| Public Cloud Security/Data Protection in Public Cloud/Data accessibility"
              VpcDefaultSecurityGroupClosed:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-default-security-group-closed
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              VpcFlowLogsEnabled:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-flow-logs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_FLOW_LOGS_ENABLED
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              VpcSgOpenOnlyToAuthorizedPorts:
                Controls: [ '3205' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-sg-open-only-to-authorized-ports
                  InputParameters:
                    authorizedTcpPorts: '443'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS
                  Description: "SHOULD 18.1.13.C.02[CID:3205]| Network security/Network Management/Limiting network access"