NZISM 3.9 운영 모범 사례(NZ 전환)

적합성 팩은 관리형 또는 사용자 지정 AWS Config 규칙 및 AWS Config 문제 해결 작업을 사용하여 보안, 운영 또는 비용 최적화 거버넌스 검사를 생성할 수 있도록 설계된 범용 규정 준수 프레임워크를 제공합니다. 샘플 템플릿인 적합성 팩은 특정 거버넌스 또는 규정 준수 표준을 완벽하게 준수하도록 설계되지 않았습니다. 사용자는 서비스 이용이 관련 법률 및 규제 요구 사항을 충족하는지 여부를 스스로 평가할 책임이 있습니다.

다음은 뉴질랜드 정부 통신 보안국(GCSB) 정보 보안 매뉴얼(NZISM) 2025-11 버전 3.9와 AWS 관리형 Config 규칙 간의 샘플 매핑을 제공합니다. 각 Config 규칙은 특정 AWS 리소스 유형에 적용되며 하나 이상의 NZISM 제어와 관련이 있습니다. NZISM 제어는 여러 Config 규칙과 관련될 수 있습니다. 이러한 매핑과 관련된 자세한 내용 및 지침은 아래 표를 참조하세요. 제한됨 이하로 분류된 정보에 대한 권장 또는 기준 관행을 나타내는 제어만 매핑에 포함됩니다.

이 샘플 적합성 팩 템플릿에는 인력, 정보 및 물리적 보안 관리에 대한 뉴질랜드 정부의 기대치를 규정하는 보호 보안 요구 사항(PSR) 프레임워크의 필수 부분인 NZISM 프레임워크 내 제어에 대한 매핑이 포함되어 있습니다.

이 적합성 팩의 파운데이션 부분은 시드니 및 글로벌 리전에 배포할 수 있습니다. NZ 전환 부분에는 현재 뉴질랜드 리전에서 사용할 수 있는 Foundation Config 규칙의 하위 집합이 포함되어 있습니다. 파운데이션 부분은 현재 뉴질랜드 리전에 배포되지 않습니다. 이 적합성 팩의 확장 부분은 Foundation 및 NZ Transition 파트에 제공된 Config 규칙을 보강하기 위해 시드니 및 뉴질랜드 리전에 배포할 수 있습니다.

NZISM은 크리에이티브 커먼즈 저작자표시 4.0 뉴질랜드 라이선스에 따라 이용할 수 있으며, https://creativecommons.org/licenses/by/4.0/에서 확인할 수 있습니다. 저작권 정보는 NZISM New Zealand Information Security Manual | Legal, Privacy, and Copyright에서 확인할 수 있습니다.

템플릿

            ##################################################################################
            #
            #   Conformance Pack:
            #     Operational Best Practices for NZISM NZ Transition
            #
            #   This conformance pack helps verify compliance with NZISM requirements.
            #
            ##################################################################################

            Resources:
              AcmCertificateExpirationCheck:
                Controls: [ '1667' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: acm-certificate-expiration-check
                  InputParameters:
                    daysToExpiration: '30'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ACM::Certificate
                  Source:
                    Owner: AWS
                    SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
                  Description: "SHOULD 14.5.8.C.01[CID:1667]| Software security/Web Application Development/Web applications"
              AlbHttpToHttpsRedirectionCheck:
                Controls: [ '1847', '2090' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: alb-http-to-https-redirection-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK
                  Description: "MUST 16.1.37.C.01[CID:1847], MUST 17.1.55.C.02[CID:2090]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in t..."
              CloudTrailCloudWatchLogsEnabled:
                Controls: [ '1998', '6860' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-cloud-watch-logs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED
                  Description: "SHOULD 16.6.6.C.02[CID:1998], MUST 16.4.35.C.02[CID:6860]| Access Control and Passwords: (Event Logging and Auditing/Maintaining system management logs and Privileged..."
              CloudTrailEncryptionEnabled:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-encryption-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_ENCRYPTION_ENABLED
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              CloudTrailLogFileValidationEnabled:
                Controls: [ '2022', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloud-trail-log-file-validation-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
                  Description: "MUST 16.6.12.C.01[CID:2022], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Event log protection and Public Cloud Security/Loggi..."
              CloudfrontAccesslogsEnabled:
                Condition: IsEdge
                Controls: [ '2013', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-accesslogs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_ACCESSLOGS_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Additional events to be logged and Public Cloud Se..."
              CloudfrontAssociatedWithWaf:
                Condition: IsEdge
                Controls: [ '3562' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-associated-with-waf
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_ASSOCIATED_WITH_WAF
                  Description: "MUST 19.1.12.C.01[CID:3562]| Gateway security/Gateways/Configuration of gateways"
              CloudfrontDefaultRootObjectConfigured:
                Condition: IsEdge
                Controls: [ '1661' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-default-root-object-configured
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_DEFAULT_ROOT_OBJECT_CONFIGURED
                  Description: "SHOULD 14.5.6.C.01[CID:1661]| Software security/Web Application Development/Agency website content"
              CloudfrontViewerPolicyHttps:
                Condition: IsEdge
                Controls: [ '1847' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudfront-viewer-policy-https
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDFRONT_VIEWER_POLICY_HTTPS
                  Description: "MUST 16.1.37.C.01[CID:1847]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in transit"
              CloudtrailEnabled:
                Controls: [ '1998', '2013', '6860', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUD_TRAIL_ENABLED
                  Description: "SHOULD 16.6.6.C.02[CID:1998], SHOULD 16.6.10.C.02[CID:2013], MUST 16.4.35.C.02[CID:6860], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords: (Event Logging and..."
              CloudtrailS3DataeventsEnabled:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-s3-dataevents-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDTRAIL_S3_DATAEVENTS_ENABLED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              CloudtrailSecurityTrailEnabled:
                Controls: [ '6861' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudtrail-security-trail-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDTRAIL_SECURITY_TRAIL_ENABLED
                  Description: "MUST 16.4.35.C.03[CID:6861]| Access Control and Passwords/Privileged Access Management/Monitoring and Review"
              CloudwatchLogGroupEncrypted:
                Controls: [ '2022', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cloudwatch-log-group-encrypted
                  Source:
                    Owner: AWS
                    SourceIdentifier: CLOUDWATCH_LOG_GROUP_ENCRYPTED
                  Description: "MUST 16.6.12.C.01[CID:2022], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Event log protection and Public Cloud Security/Loggi..."
              CmkBackingKeyRotationEnabled:
                Controls: [ '3021' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cmk-backing-key-rotation-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: CMK_BACKING_KEY_ROTATION_ENABLED
                  Description: "SHOULD 17.9.25.C.01[CID:3021]| Cryptography/Key Management/Contents of KMPs"
              CwLoggroupRetentionPeriodCheck:
                Controls: [ '1998', '2028' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: cw-loggroup-retention-period-check
                  InputParameters:
                    MinRetentionTime: '545'
                  Source:
                    Owner: AWS
                    SourceIdentifier: CW_LOGGROUP_RETENTION_PERIOD_CHECK
                  Description: "SHOULD 16.6.6.C.02[CID:1998], MUST 16.6.13.C.01[CID:2028]| Access Control and Passwords/Event Logging and Auditing: (Maintaining system management logs and Event log ..."
              DbInstanceBackupEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: db-instance-backup-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              DmsReplicationNotPublic:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dms-replication-not-public
                  Source:
                    Owner: AWS
                    SourceIdentifier: DMS_REPLICATION_NOT_PUBLIC
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              DynamodbAutoscalingEnabled:
                Controls: [ '4829' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-autoscaling-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_AUTOSCALING_ENABLED
                  Description: "MUST 22.1.23.C.01[CID:4829]| Enterprise systems security/Cloud Computing/System Availability"
              DynamodbPitrEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-pitr-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_PITR_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              DynamodbTableEncryptedKms:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: dynamodb-table-encrypted-kms
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::DynamoDB::Table
                  Source:
                    Owner: AWS
                    SourceIdentifier: DYNAMODB_TABLE_ENCRYPTED_KMS
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              EbsSnapshotPublicRestorableCheck:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ebs-snapshot-public-restorable-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              Ec2EbsEncryptionByDefault:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-ebs-encryption-by-default
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_EBS_ENCRYPTION_BY_DEFAULT
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              Ec2Imdsv2Check:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-imdsv2-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_IMDSV2_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              Ec2InstanceNoPublicIp:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-instance-no-public-ip
                  Scope:
                    ComplianceResourceTypes:
                    - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              Ec2InstancesInVpc:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ec2-instances-in-vpc
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Instance
                  Source:
                    Owner: AWS
                    SourceIdentifier: INSTANCES_IN_VPC
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              EfsEncryptedCheck:
                Controls: [ '2082', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: efs-encrypted-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: EFS_ENCRYPTED_CHECK
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements and Enterpri..."
              ElasticacheRedisClusterAutomaticBackupCheck:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticache-redis-cluster-automatic-backup-check
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              ElasticsearchEncryptedAtRest:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-encrypted-at-rest
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_ENCRYPTED_AT_REST
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              ElasticsearchInVpcOnly:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-in-vpc-only
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_IN_VPC_ONLY
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              ElasticsearchNodeToNodeEncryptionCheck:
                Controls: [ '1847', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elasticsearch-node-to-node-encryption-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Elasticsearch::Domain
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK
                  Description: "MUST 16.1.37.C.01[CID:1847], SHOULD 22.1.24.C.04[CID:4839]| Access Control and Passwords/Identification, Authentication and Passwords/Protecting authentication data in..."
              ElbCrossZoneLoadBalancingEnabled:
                Controls: [ '4829' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-cross-zone-load-balancing-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED
                  Description: "MUST 22.1.23.C.01[CID:4829]| Enterprise systems security/Cloud Computing/System Availability"
              ElbCustomSecurityPolicySslCheck:
                Controls: [ '2598', '2600' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-custom-security-policy-ssl-check
                  InputParameters:
                    sslProtocolsAndCiphers: 'Protocol-TLSv1.2,ECDHE-ECDSA-AES256-GCM-SHA384'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_CUSTOM_SECURITY_POLICY_SSL_CHECK
                  Description: "SHOULD 17.4.16.C.01[CID:2598], SHOULD NOT 17.4.16.C.02[CID:2600]| Cryptography/Transport Layer Security/Using TLS"
              ElbLoggingEnabled:
                Controls: [ '2013', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-logging-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                      - AWS::ElasticLoadBalancingV2::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_LOGGING_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and Auditing/Additional events to be logged and Public Cloud Se..."
              ElbTlsHttpsListenersOnly:
                Controls: [ '1667', '1847', '2090', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: elb-tls-https-listeners-only
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::ElasticLoadBalancing::LoadBalancer
                  Source:
                    Owner: AWS
                    SourceIdentifier: ELB_TLS_HTTPS_LISTENERS_ONLY
                  Description: "SHOULD 14.5.8.C.01[CID:1667], MUST 16.1.37.C.01[CID:1847], MUST 17.1.55.C.02[CID:2090], SHOULD 22.1.24.C.04[CID:4839]| Software security/Web Application Development/We..."
              EncryptedVolumes:
                Controls: [ '2082', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: encrypted-volumes
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::Volume
                  Source:
                    Owner: AWS
                    SourceIdentifier: ENCRYPTED_VOLUMES
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements and Enterpri..."
              IamPasswordPolicy:
                Controls: [ '7545', '7546' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: iam-password-policy
                  InputParameters:
                    MaxPasswordAge: '1095'
                    MinimumPasswordLength: '16'
                    PasswordReusePrevention: '24'
                    RequireUppercaseCharacters: 'false'
                    RequireLowercaseCharacters: 'false'
                    RequireSymbols: 'false'
                    RequireNumbers: 'false'
                  Source:
                    Owner: AWS
                    SourceIdentifier: IAM_PASSWORD_POLICY
                  Description: "MUST 16.1.31.C.02[CID:7545], MUST 16.1.31.C.03[CID:7546]| Access Control and Passwords/Identification, Authentication and Authentication/Passwords and policy"
              RdsAutomaticMinorVersionUpgradeEnabled:
                Controls: [ '3452' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-automatic-minor-version-upgrade-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLED
                  Description: "SHOULD 12.4.4.C.05[CID:3452]| Product Security/Product Patching and Updating/Patching vulnerabilities in products"
              RdsClusterDeletionProtectionEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-cluster-deletion-protection-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBCluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_CLUSTER_DELETION_PROTECTION_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RdsInstanceDeletionProtectionEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-instance-deletion-protection-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_INSTANCE_DELETION_PROTECTION_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RdsInstancePublicAccessCheck:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-instance-public-access-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              RdsLoggingEnabled:
                Controls: [ '2013', '4441', '4445', '7496' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-logging-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_LOGGING_ENABLED
                  Description: "SHOULD 16.6.10.C.02[CID:2013], SHOULD 20.4.4.C.02[CID:4441], SHOULD 20.4.5.C.02[CID:4445], MUST 23.5.11.C.01[CID:7496]| Access Control and Passwords/Event Logging and ..."
              RdsSnapshotEncrypted:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-snapshot-encrypted
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBSnapshot
                      - AWS::RDS::DBClusterSnapshot
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_SNAPSHOT_ENCRYPTED
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              RdsSnapshotsPublicProhibited:
                Controls: [ '4441' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-snapshots-public-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBSnapshot
                      - AWS::RDS::DBClusterSnapshot
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED
                  Description: "SHOULD 20.4.4.C.02[CID:4441]| Data management/Databases/Database files"
              RdsStorageEncrypted:
                Controls: [ '2082', '4441', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: rds-storage-encrypted
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::RDS::DBInstance
                  Source:
                    Owner: AWS
                    SourceIdentifier: RDS_STORAGE_ENCRYPTED
                  Description: "SHOULD 17.1.53.C.04[CID:2082], SHOULD 20.4.4.C.02[CID:4441], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical trans..."
              RedshiftBackupEnabled:
                Controls: [ '4849' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-backup-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_BACKUP_ENABLED
                  Description: "MUST 22.1.26.C.01[CID:4849]| Enterprise systems security/Cloud Computing/Backup, Recovery Archiving and Data Remanence"
              RedshiftClusterConfigurationCheck:
                Controls: [ '4441', '4445', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-configuration-check
                  InputParameters:
                    clusterDbEncrypted: 'true'
                    loggingEnabled: 'true'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK
                  Description: "SHOULD 20.4.4.C.02[CID:4441], SHOULD 20.4.5.C.02[CID:4445], SHOULD 22.1.24.C.04[CID:4839]| Data management/Databases: (Database files and Accountability) and Enterpr..."
              RedshiftClusterMaintenancesettingsCheck:
                Controls: [ '3449', '3453' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-maintenancesettings-check
                  InputParameters:
                    allowVersionUpgrade: 'true'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_MAINTENANCESETTINGS_CHECK
                  Description: "MUST 12.4.4.C.02[CID:3449], SHOULD 12.4.4.C.06[CID:3453]| Product Security/Product Patching and Updating/Patching vulnerabilities in products"
              RedshiftClusterPublicAccessCheck:
                Controls: [ '3562', '3623', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-cluster-public-access-check
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 19.1.14.C.02[CID:3623], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways: (Configuration of gateways and Demilitarised zones..."
              RedshiftRequireTlsSsl:
                Controls: [ '2090', '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: redshift-require-tls-ssl
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::Redshift::Cluster
                  Source:
                    Owner: AWS
                    SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL
                  Description: "MUST 17.1.55.C.02[CID:2090], SHOULD 22.1.24.C.04[CID:4839]| Cryptography/Cryptographic Fundamentals/Information and Systems Protection and Enterprise systems security..."
              RestrictedSsh:
                Controls: [ '2726' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: restricted-ssh
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: INCOMING_SSH_DISABLED
                  Description: "SHOULD 17.5.8.C.02[CID:2726]| Cryptography/Secure Shell/Automated remote access"
              S3AccountLevelPublicAccessBlocksPeriodic:
                Controls: [ '3562', '4838', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-account-level-public-access-blocks-periodic
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC
                  Description: "MUST 19.1.12.C.01[CID:3562], SHOULD 22.1.24.C.03[CID:4838], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Enterprise systems se..."
              S3BucketPublicReadProhibited:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-public-read-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              S3BucketPublicWriteProhibited:
                Controls: [ '4838' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-public-write-prohibited
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
                  Description: "SHOULD 22.1.24.C.03[CID:4838]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              S3BucketServerSideEncryptionEnabled:
                Controls: [ '2082' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-server-side-encryption-enabled
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
                  Description: "SHOULD 17.1.53.C.04[CID:2082]| Cryptography/Cryptographic Fundamentals/Reducing storage and physical transfer requirements"
              S3BucketSslRequestsOnly:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: s3-bucket-ssl-requests-only
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::S3::Bucket
                  Source:
                    Owner: AWS
                    SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              SecretsmanagerUsingCmk:
                Controls: [ '4839' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: secretsmanager-using-cmk
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::SecretsManager::Secret
                  Source:
                    Owner: AWS
                    SourceIdentifier: SECRETSMANAGER_USING_CMK
                  Description: "SHOULD 22.1.24.C.04[CID:4839]| Enterprise systems security/Cloud Computing/Unauthorised Access"
              SecurityhubEnabled:
                Controls: [ '3875' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: securityhub-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: SECURITYHUB_ENABLED
                  Description: "SHOULD 18.4.12.C.01[CID:3875]| Network security/Intrusion Detection and Prevention/Event management and correlation"
              SsmDocumentNotPublic:
                Controls: [ '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: ssm-document-not-public
                  Source:
                    Owner: AWS
                    SourceIdentifier: SSM_DOCUMENT_NOT_PUBLIC
                  Description: "MUST 23.4.10.C.01[CID:7466]| Public Cloud Security/Data Protection in Public Cloud/Data accessibility"
              VpcDefaultSecurityGroupClosed:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-default-security-group-closed
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              VpcFlowLogsEnabled:
                Controls: [ '3562', '7466' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-flow-logs-enabled
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_FLOW_LOGS_ENABLED
                  Description: "MUST 19.1.12.C.01[CID:3562], MUST 23.4.10.C.01[CID:7466]| Gateway security/Gateways/Configuration of gateways and Public Cloud Security/Data Protection in Public Clou..."
              VpcSgOpenOnlyToAuthorizedPorts:
                Controls: [ '3205' ]
                Type: AWS::Config::ConfigRule
                Properties:
                  ConfigRuleName: vpc-sg-open-only-to-authorized-ports
                  InputParameters:
                    authorizedTcpPorts: '443'
                  Scope:
                    ComplianceResourceTypes:
                      - AWS::EC2::SecurityGroup
                  Source:
                    Owner: AWS
                    SourceIdentifier: VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS
                  Description: "SHOULD 18.1.13.C.02[CID:3205]| Network security/Network Management/Limiting network access"