NZISM 3.9 の運用上のベストプラクティス (NZ 移行)

コンフォーマンスパックは、マネージドルールまたはカスタム AWS Config ルールと AWS Config 修復アクションを使用して、セキュリティ、運用、またはコスト最適化のガバナンスチェックを作成できるように設計された汎用コンプライアンスフレームワークを提供します。サンプルテンプレートとしてのコンフォーマンスパックは、特定のガバナンスまたはコンプライアンス基準を準拠するようには設計されていません。お客様は、本サービスの利用が該当する法的要件および規制要件を満たしているかどうかについて、お客様自身で評価する責任を負います。

以下は、ニュージーランド政府通信セキュリティ局 (GCSB) 情報セキュリティマニュアル (NZISM) 2025-11 バージョン 3.9 と AWS Managed Config ルール間のマッピングの例です。各 Config ルールは、特定の AWS リソースタイプに適用され、1 つ以上の NZISM コントロールに関連付けられます。「ÑZISM」によるコントロールを、複数の Config ルールに関連付けることができます。これらのマッピングに関する詳細およびガイダンスについては、以下の表を参照してください。RESTRICTED 以下に分類される情報の推奨プラクティスまたはベースラインプラクティスを表すコントロールのみがマッピングに含まれます。

このコンフォーマンスパックのサンプルテンプレートは、NZISM フレームワーク内のコントロールへのマッピングを含んでおり、これは、人員、情報および物理的セキュリティの管理に対するニュージーランド政府の期待値を定めた保護セキュリティ要件 (PSR) フレームワークの不可欠な部分です。

このコンフォーマンスパックの Foundation 部分は、シドニーおよびグローバルリージョンにデプロイできます。NZ 移行パートには、ニュージーランドリージョンで現在利用可能な Foundation Config ルールのサブセットが含まれています。Foundation パートは現在、ニュージーランドリージョンにデプロイされません。このコンフォーマンスパックの拡張機能部分をシドニーおよびニュージーランドリージョンにデプロイして、 Foundation および NZ Transition パートで提供される Config ルールを強化できます。

The NZISM is licensed under the Creative Commons Attribution 4.0 New Zealand licence, available at https://creativecommons.org/licenses/by/4.0/。著作権については、「NZISM New Zealand Information Security Manual｜法律、プライバシー、著作権」に記載されています。

テンプレート

            ##################################################################################
            #
            #   Conformance Pack:
            #     Operational Best Practices for NZISM NZ Transition
            #
            #   This conformance pack helps verify compliance with NZISM requirements.
            #
            ##################################################################################

            Resources:
              AcmCertificateExpirationCheck:
                Controls: [ '1667' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: acm-certificate-expiration-check
                  InputParameters:
                    daysToExpiration: '30'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ACM::Certificate
                  Source:
                    Owner: AWS
                    SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
                  Description: "SHOULD 14.5.8.C.01[CID:1667]| Software security/Web Application Development/Web applications"
              AlbHttpToHttpsRedirectionCheck:
                Controls: [ '1847', '2090' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: alb-http-to-https-redirection-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK
                  Description: "MUST 16.1.37.C.01[CID:1847], MUST 17.1.55.C.02[CID:2090]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in t..."
              CloudTrailCloudWatchLogsEnabled:
                Controls: [ '1998', '6860' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-cloud-watch-logs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED
                  Description: "SHOULD 16.6.6.C.02[CID:1998], MUST 16.4.35.C.02[CID:6860]| Access Control and Passwords: (Event Logging and Auditing/Maintaining system management logs and Privileged..."
              CloudTrailEncryptionEnabled:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-encryption-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_ENCRYPTION_ENABLED
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              CloudTrailLogFileValidationEnabled:
                Controls: [ '2022', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-log-file-validation-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
                  Description: "MUST 16.6.12.C.01[CID:2022], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Event log protection and Public Cloud Security/Loggi..."
              CloudfrontAccesslogsEnabled:
                Condition: IsEdge
                Controls: [ '2013', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-accesslogs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_ACCESSLOGS_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Additional events to be logged and Public Cloud Se..."
              CloudfrontAssociatedWithWaf:
                Condition: IsEdge
                Controls: [ '3562' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-associated-with-waf
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_ASSOCIATED_WITH_WAF
                  Description: "MUST 19.1.12.C.01[CID:3562]| Gateway security/Gateways/Configuration of gateways"
              CloudfrontDefaultRootObjectConfigured:
                Condition: IsEdge
                Controls: [ '1661' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-default-root-object-configured
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED
                  Description: "SHOULD 14.5.6.C.01[CID:1661]| Software security/Web Application Development/Agency website content"
              CloudfrontViewerPolicyHttps:
                Condition: IsEdge
                Controls: [ '1847' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-viewer-policy-https
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_VIEWER_POLICY_HTTPS
                  Description: "MUST 16.1.37.C.01[CID:1847]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in transit"
              CloudtrailEnabled:
                Controls: [ '1998', '2013', '6860', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_ENABLED
                  Description: "SHOULD 16.6.6.C.02[CID:1998], SHOULD 16.6.10.C.02[CID:2013], MUST 16.4.35.C.02[CID:6860], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords: (Event Logging and..."
              CloudtrailS3DataeventsEnabled:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-s3-dataevents-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDTRAIL_S3_DATAEVENTS_ENABLED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              CloudtrailSecurityTrailEnabled:
                Controls: [ '6861' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-security-trail-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDTRAIL_SECURITY_TRAIL_ENABLED
                  Description: "MUST 16.4.35.C.03[CID:6861]| Access Control and Passwords/Privileged Access Management/Monitoring and Review"
              CloudwatchLogGroupEncrypted:
                Controls: [ '2022', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudwatch-log-group-encrypted
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDWATCH_LOG_GROUP_ENCRYPTED
                  Description: "MUST 16.6.12.C.01[CID:2022], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Event log protection and Public Cloud Security/Loggi..."
              CmkBackingKeyRotationEnabled:
                Controls: [ '3021' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cmk-backing-key-rotation-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CMK_BACKING_KEY_ROTATION_ENABLED
                  Description: "SHOULD 17.9.25.C.01[CID:3021]| Cryptography/Key Management/Contents of KMPs"
              CwLoggroupRetentionPeriodCheck:
                Controls: [ '1998', '2028' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cw-loggroup-retention-period-check
                  InputParameters:
                    MinRetentionTime: '545'
                  Source:
                    Owner: AWS
                    SourceIdentifier: CW_LOGGROUP_RETENTION_PERIOD_CHECK
                  Description: "SHOULD 16.6.6.C.02[CID:1998], MUST 16.6.13.C.01[CID:2028]| Access Control and Passwords/Event Logging and Auditing: (Maintaining system management logs and Event log ..."
              DbInstanceBackupEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: db-instance-backup-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              DmsReplicationNotPublic:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dms-replication-not-public
                  Source:
                    Owner: AWS
                    SourceIdentifier: DMS_REPLICATION_NOT_PUBLIC
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              DynamodbAutoscalingEnabled:
                Controls: [ '4829' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-autoscaling-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_AUTOSCALING_ENABLED
                  Description: "MUST 22.1.23.C.01[CID:4829]| Enterprise systems security/Cloud Computing/System Availability"
              DynamodbPitrEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-pitr-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_PITR_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              DynamodbTableEncryptedKms:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-table-encrypted-kms
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_TABLE_ENCRYPTED_KMS
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              EbsSnapshotPublicRestorableCheck:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ebs-snapshot-public-restorable-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              Ec2EbsEncryptionByDefault:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-ebs-encryption-by-default
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_EBS_ENCRYPTION_BY_DEFAULT
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              Ec2Imdsv2Check:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-imdsv2-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_IMDSV2_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              Ec2InstanceNoPublicIp:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-instance-no-public-ip
                  Scope:
                    ComplianceResourceTypes:
                    - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              Ec2InstancesInVpc:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-instances-in-vpc
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: INSTANCES_IN_VPC
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              EfsEncryptedCheck:
                Controls: [ '2082', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: efs-encrypted-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: EFS_ENCRYPTED_CHECK
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements and Enterpri..."
              ElasticacheRedisClusterAutomaticBackupCheck:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticache-redis-cluster-automatic-backup-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              ElasticsearchEncryptedAtRest:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-encrypted-at-rest
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_ENCRYPTED_AT_REST
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              ElasticsearchInVpcOnly:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-in-vpc-only
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_IN_VPC_ONLY
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              ElasticsearchNodeToNodeEncryptionCheck:
                Controls: [ '1847', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-node-to-node-encryption-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Elasticsearch::Domain
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK
                  Description: "MUST 16.1.37.C.01[CID:1847], SHOULD 22.1.24.C.04[CID:4839]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in..."
              ElbCrossZoneLoadBalancingEnabled:
                Controls: [ '4829' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-cross-zone-load-balancing-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED
                  Description: "MUST 22.1.23.C.01[CID:4829]| Enterprise systems security/Cloud Computing/System Availability"
              ElbCustomSecurityPolicySslCheck:
                Controls: [ '2598', '2600' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-custom-security-policy-ssl-check
                  InputParameters:
                    sslProtocolsAndCiphers: 'Protocol-TLSv1.2,ECDHE-ECDSA-AES256-GCM-SHA384'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_CUSTOM_SECURITY_POLICY_SSL_CHECK
                  Description: "SHOULD 17.4.16.C.01[CID:2598], SHOULD NOT 17.4.16.C.02[CID:2600]| Cryptography/Transport Layer Security/Using TLS"
              ElbLoggingEnabled:
                Controls: [ '2013', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-logging-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                      - AWS::ElasticLoadBalancingV2::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_LOGGING_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Additional events to be logged and Public Cloud Se..."
              ElbTlsHttpsListenersOnly:
                Controls: [ '1667', '1847', '2090', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-tls-https-listeners-only
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_TLS_HTTPS_LISTENERS_ONLY
                  Description: "SHOULD 14.5.8.C.01[CID:1667], MUST 16.1.37.C.01[CID:1847], MUST 17.1.55.C.02[CID:2090], SHOULD 22.1.24.C.04[CID:4839]| Software security/Web Application Development/We..."
              EncryptedVolumes:
                Controls: [ '2082', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: encrypted-volumes
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Volume
                  Source:
                    Owner: AWS
                    SourceIdentifier: ENCRYPTED_VOLUMES
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements and Enterpri..."
              IamPasswordPolicy:
                Controls: [ '7545', '7546' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: iam-password-policy
                  InputParameters:
                    MaxPasswordAge: '1095'
                    MinimumPasswordLength: '16'
                    PasswordReusePrevention: '24'
                    RequireUppercaseCharacters: 'false'
                    RequireLowercaseCharacters: 'false'
                    RequireSymbols: 'false'
                    RequireNumbers: 'false'
                  Source:
                    Owner: AWS
                    SourceIdentifier: IAM_PASSWORD_POLICY
                  Description: "MUST 16.1.31.C.02[CID:7545], MUST 16.1.31.C.03[CID:7546]| Access Control and Passwords/Identification, Authentication and Authentication/Passwords and policy"
              RdsAutomaticMinorVersionUpgradeEnabled:
                Controls: [ '3452' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-automatic-minor-version-upgrade-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLED
                  Description: "SHOULD 12.4.4.C.05[CID:3452]| Product Security/Product Patching and Updating/Patching vulnerabilities in products"
              RdsClusterDeletionProtectionEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-cluster-deletion-protection-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBCluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_CLUSTER_DELETION_PROTECTION_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RdsInstanceDeletionProtectionEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-instance-deletion-protection-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_INSTANCE_DELETION_PROTECTION_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RdsInstancePublicAccessCheck:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-instance-public-access-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              RdsLoggingEnabled:
                Controls: [ '2013', '4441', '4445', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-logging-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_LOGGING_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], SHOULD 20.4.4.C.02[CID:4441], SHOULD 20.4.5.C.02[CID:4445], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and ..."
              RdsSnapshotEncrypted:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-snapshot-encrypted
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBSnapshot
                      - AWS::RDS::DBClusterSnapshot
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_SNAPSHOT_ENCRYPTED
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              RdsSnapshotsPublicProhibited:
                Controls: [ '4441' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-snapshots-public-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBSnapshot
                      - AWS::RDS::DBClusterSnapshot
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED
                  Description: "SHOULD 20.4.4.C.02[CID:4441]| Data management/Databases/Database files"
              RdsStorageEncrypted:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-storage-encrypted
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_STORAGE_ENCRYPTED
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              RedshiftBackupEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-backup-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_BACKUP_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RedshiftClusterConfigurationCheck:
                Controls: [ '4441', '4445', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-configuration-check
                  InputParameters:
                    clusterDbEncrypted: 'true'
                    loggingEnabled: 'true'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK
                  Description: "SHOULD 20.4.4.C.02[CID:4441], SHOULD 20.4.5.C.02[CID:4445], SHOULD 22.1.24.C.04[CID:4839]| Data management/Databases: (Database files and Accountability) and Enterpr..."
              RedshiftClusterMaintenancesettingsCheck:
                Controls: [ '3449', '3453' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-maintenancesettings-check
                  InputParameters:
                    allowVersionUpgrade: 'true'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_MAINTENANCESETTINGS_CHECK
                  Description: "MUST 12.4.4.C.02[CID:3449], SHOULD 12.4.4.C.06[CID:3453]| Product Security/Product Patching and Updating/Patching vulnerabilities in products"
              RedshiftClusterPublicAccessCheck:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-public-access-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              RedshiftRequireTlsSsl:
                Controls: [ '2090', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-require-tls-ssl
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL
                  Description: "MUST 17.1.55.C.02[CID:2090], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Information and Systems Protection and Enterprise systems security..."
              RestrictedSsh:
                Controls: [ '2726' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: restricted-ssh
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: INCOMING_SSH_DISABLED
                  Description: "SHOULD 17.5.8.C.02[CID:2726]| Cryptography/Secure Shell/Automated remote access"
              S3AccountLevelPublicAccessBlocksPeriodic:
                Controls: [ '3562', '4838', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-account-level-public-access-blocks-periodic
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 22.1.24.C.03[CID:4838], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Enterprise systems se..."
              S3BucketPublicReadProhibited:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-public-read-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              S3BucketPublicWriteProhibited:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-public-write-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              S3BucketServerSideEncryptionEnabled:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-server-side-encryption-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              S3BucketSslRequestsOnly:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-ssl-requests-only
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              SecretsmanagerUsingCmk:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: secretsmanager-using-cmk
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::SecretsManager::Secret
                  Source:
                    Owner: AWS
                    SourceIdentifier: SECRETSMANAGER_USING_CMK
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              SecurityhubEnabled:
                Controls: [ '3875' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: securityhub-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: SECURITYHUB_ENABLED
                  Description: "SHOULD 18.4.12.C.01[CID:3875]| Network security/Intrusion Detection and Prevention/Event management and correlation"
              SsmDocumentNotPublic:
                Controls: [ '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ssm-document-not-public
                  Source:
                    Owner: AWS
                    SourceIdentifier: SSM_DOCUMENT_NOT_PUBLIC
                  Description: "MUST 23.4.10.C.01[CID:7466]| Public Cloud Security/Data Protection in Public Cloud/Data accessibility"
              VpcDefaultSecurityGroupClosed:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-default-security-group-closed
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              VpcFlowLogsEnabled:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-flow-logs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_FLOW_LOGS_ENABLED
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              VpcSgOpenOnlyToAuthorizedPorts:
                Controls: [ '3205' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-sg-open-only-to-authorized-ports
                  InputParameters:
                    authorizedTcpPorts: '443'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS
                  Description: "SHOULD 18.1.13.C.02[CID:3205]| Network security/Network Management/Limiting network access"