本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # 合并对 ASFF 字段和值的影响 AWS Security Hub CSPM 为控制提供了两种类型的整合： + **整合控件视图** – 通过这种类型的整合，每个控件在所有标准中都有一个标识符。此外，在 Security Hub CSPM 控制台上，**控件**页面显示所有标准的所有控件。 + **整合的控件调查发现** – 通过这种整合，Security Hub CSPM 可以为控件生成一个调查发现，即使该控件适用于多个已启用标准也是如此。这样可以减少调查发现噪音。 您无法启用或禁用整合控件视图。如果您在 2023 年 2 月 23 日当天或之后启用 Security Hub CSPM，则默认情况下会启用整合的控件调查发现。否则，默认情况下禁用。但是，对于组织，只有当为管理员账户启用整合的控件调查发现时，Security Hub CSPM 成员帐户才能启用该功能。要了解有关整合的控件调查发现的更多信息，请参阅[生成和更新控件调查发现](controls-findings-create-update.md)。 这两种类型的整合都会影响 [AWS 安全调查结果格式 (ASFF)](securityhub-findings-format.md) 安全调查发现格式（ASFF）中控件调查发现的字段和值。 **Topics** + [整合的控件视图——ASFF 变更](#securityhub-findings-format-consolidated-controls-view) + [整合的控件调查发现——ASFF 的变化](#securityhub-findings-format-consolidated-control-findings) + [启用整合控制结果 IDs 之前和之后的生成器](#securityhub-findings-format-changes-generator-ids) + [整合如何影响控制权 IDs 和所有权](#securityhub-findings-format-changes-ids-titles) + [更新工作流以进行整合。](#securityhub-findings-format-changes-prepare) ## 整合的控件视图——ASFF 变更 整合的控件视图功能对 ASFF 中的控件调查发现的字段和值进行了以下更改。如果您的工作流不依赖于这些 ASFF 字段的值，则无需执行任何操作。如果有工作流依赖于这些字段的特定值，请更新工作流以使用当前值。 | ASFF 字段 | 整合的控件视图之前的样本值 | 整合的控件视图后的样本值以及更改描述 | | --- | --- | --- | | 合规。 SecurityControlId | 不适用（新字段） | EC2.2
引入各类标准的单一控件 ID。`ProductFields.RuleId` 仍然为 CIS v1.2.0 控件提供基于标准的控件 ID。`ProductFields.ControlId` 仍然为其他标准中的控件提供基于标准的控件 ID。 | | 合规。 AssociatedStandards | 不适用（新字段） | [{” StandardsId “:” standards/aws-foundational-security-best-practices/v /1.0.0 “}]
显示启用控件的标准。 | | ProductFields。 ArchivalReasons:0/描述 | 不适用（新字段） | “调查发现处于已存档状态，因为整合的控件调查发现已开启或关闭。这会导致在生成新调查发现时存档先前状态的调查发现。”
描述 Security Hub CSPM 为何对现有调查发现进行存档。 | | ProductFields。 ArchivalReasons:0/ ReasonCode | 不适用（新字段） | "CONSOLIDATED\_CONTROL\_FINDINGS\_UPDATE"
提供 Security Hub CSPM 存档现有调查发现的原因。 | | ProductFields.RecommendationUrl | https://docs.aws.amazon.com/console/securityhub/PCI.EC2.2/remediation | https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation
此字段不再引用标准。 | | Remediation.Recommendation.Text | “有关如何解决此问题的说明，请查阅 Sec AWS urity Hub CSPM PCI DSS 文档。” | “有关如何更正此问题的说明，请参阅 Sec AWS urity Hub CSPM 控制文档。”
此字段不再引用标准。 | | Remediation.Recommendation.Url | https://docs.aws.amazon.com/console/securityhub/PCI.EC2.2/remediation | https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation
此字段不再引用标准。 | ## 整合的控件调查发现——ASFF 的变化 如果您启用整合的控件调查发现，则可能会受到 ASFF 中的控件调查发现的字段和值的以下更改影响。这些更改是对整合的控件视图功能引入的更改的补充。如果您的工作流不依赖于这些 ASFF 字段的值，则无需执行任何操作。如果有工作流依赖于这些字段的特定值，请更新工作流以使用当前值。 **提示** 如果您在 [AWS v2.0.0 上使用自动安全响应](https://aws.amazon.com/solutions/implementations/aws-security-hub-automated-response-and-remediation/)解决方案，请注意它支持整合的控制结果。这意味着，如果您启用整合的控件调查发现，则可以保持当前的工作流。 | ASFF 字段 | 启用整合的控件调查发现之前的示例值 | 启用整合的控件调查发现后的示例值和更改的描述 | | --- | --- | --- | | GeneratorId | aws-foundational-security-best-practices/v/1.0.0/Config .1 | security-control/Config.1
此字段不再引用标准。 | | 标题 | 应该启用 pci.config.1 AWS Config | AWS Config 应该启用
该字段将不再引用特定于标准的信息。 | | Id | arn: aws: securityhub: eu-central-1:123456789012：6d6a26-a156-48f0-9403-115983e5a956 subscription/pci-dss/v/3.2.1/PCI.IAM.5/finding/ab | arn: aws: securityhub: eu-central-1:123456789012: security-6d6a26-a156-48f0-9403-115983e5a956 control/iam.9/finding/ab
此字段不再引用标准。 | | ProductFields.ControlId | PCI.EC2.2 | 已删除。请改而参阅 `Compliance.SecurityControlId`。
该字段已被删除，取而代之的是单一的、与标准无关的控制 ID。 | | ProductFields.RuleId | 1.3 | 已删除。请改而参阅 `Compliance.SecurityControlId`。
该字段已被删除，取而代之的是单一的、与标准无关的控制 ID。 | | 说明 | 此 PCI DSS 控件检查当前账户和地区 AWS Config 是否已启用。 | 此 AWS 控件检查当前账户和区域中 AWS Config 是否已启用。
此字段不再引用标准。 | | 严重性 | "Severity": {
“产品”：90，
“标签”：“重大”，
“标准化”：90，
“原始”：“重大”
} | "Severity": {
“标签”：“重大”，
“标准化”：90，
“原始”：“重大”
}
Security Hub CSPM 将不再使用“产品”字段描述调查发现的严重性。 | | 类型 | [“软件、配置 Checks/Industry 和监管标准/PCI-DSS”] | [“软件和配置 Checks/Industry 及监管标准”] 此字段不再引用标准。 | | 合规。 RelatedRequirements | ["PCI DSS 10.5.2",
"PCI DSS 11.5",
“CIS AWS 基金会 2.5"] | ["PCI DSS v3.2.1/10.5.2",
"PCI DSS v3.2.1/11.5",
“CIS AWS 基金会基准测试 v1.2.0/2.5"]
该字段将显示所有启用标准中的相关要求。 | | CreatedAt | 2022-05-05T08:18:13.138Z | 2022-09-25T08:18:13.138Z
格式将保持不变，但是当您打开整合的控件调查发现时，值将重置。 | | FirstObservedAt | 2022-05-07T08:18:13.138Z | 2022-09-28T08:18:13.138Z 格式将保持不变，但是当您打开整合的控件调查发现时，值将重置。 | | ProductFields.RecommendationUrl | https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation | 已删除。请改而参阅 `Remediation.Recommendation.Url`。 | | ProductFields.StandardsArn | arn: aws: securityhub:: /1.0.0 standards/aws-foundational-security-best-practices/v | 已删除。请改而参阅 `Compliance.AssociatedStandards`。 | | ProductFields.StandardsControlArn | arn: aws: securityhub: us-east-1:123456789012: .1 control/aws-foundational-security-best-practices/v/1.0.0/Config | 已删除。Security Hub CSPM 针对各标准的安全检查生成调查发现。 | | ProductFields.StandardsGuideArn | arn: aws: securityhub:: /1.2.0 ruleset/cis-aws-foundations-benchmark/v | 已删除。请改而参阅 `Compliance.AssociatedStandards`。 | | ProductFields.StandardsGuideSubscriptionArn | arn: aws: securityhub: us-east-2:123456789012: /1.2.0 subscription/cis-aws-foundations-benchmark/v | 已删除。Security Hub CSPM 针对各标准的安全检查生成调查发现。 | | ProductFields.StandardsSubscriptionArn | arn: aws: securityhub: us-east-1:123456789012: /1.0.0 subscription/aws-foundational-security-best-practices/v | 已删除。Security Hub CSPM 针对各标准的安全检查生成调查发现。 | | ProductFields.aws/securityhub/FindingId | arn: aws: securityhub: us-east-1:: /751c2173-7372-4e12-8656-a5210dfb1dfb1d67 product/aws/securityhub/arn:aws:securityhub:us-east-1:123456789012:subscription/aws-foundational-security-best-practices/v/1.0.0/Config.1/finding | arn: aws: securityhub: us-east-1:: /751c2173-7372-4e12-8656-a5210dfb1dfb1d67 product/aws/securityhub/arn:aws:securityhub:us-east-1:123456789012:security-control/Config.1/finding
此字段不再引用标准。 | ### 启用整合的控件调查发现后，客户提供的 ASFF 字段的值 如果您启用整合的控件调查发现，Security Hub CSPM 会生成一个各类标准的调查发现并存档原始调查发现（每个标准都有单独的调查发现）。 使用 Security Hub CSPM 控制台或 [https://docs.aws.amazon.com/securityhub/latest/userguide/finding-update-batchupdatefindings.html](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-update-batchupdatefindings.html) 操作对原始调查发现所做的更新将不会保留在新调查发现中。如有必要，您可以参考存档的调查发现来恢复此数据。要查看已存档的调查发现，您可以使用 Security Hub CSPM 控制台上的**调查发现**页面，并将**记录状态**筛选条件设置为 **ARCHIVED**。或者，您可以使用 Security Hub CSPM API 的 [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) 操作。 | 客户提供的 ASFF 字段 | 启用整合的控件调查发现后的更改的描述 | | --- | --- | | 置信度 | 重置为空状态。 | | 严重性 | 重置为空状态。 | | 备注 | 重置为空状态。 | | RelatedFindings | 重置为空状态。 | | 严重性 | 调查发现的默认严重性（与控件的严重性相匹配）。 | | 类型 | 重置为与标准无关的值。 | | UserDefinedFields | 重置为空状态。 | | VerificationState | 重置为空状态。 | | 工作流 | 新的失败调查发现的默认值为 NEW。新通过的调查发现的默认值为 RESOLVED。 | ## 启用整合控制结果 IDs 之前和之后的生成器 下表列出了启用整合的控件调查发现时控件的生成器 ID 值的变化。这些更改适用于自 2023 年 2 月 15 日起 Security Hub CSPM 支持的控件。 | 启用整合的控件调查发现之前的生成器 ID | 启用整合的控件调查发现之后的生成器 ID | | --- | --- | | arn: aws: securityhub:: /1.1 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .1 CloudWatch | | arn: aws: securityhub:: /1.10 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.16 | | arn: aws: securityhub:: /1.11 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.17 | | arn: aws: securityhub:: /1.12 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.4 | | arn: aws: securityhub:: /1.13 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.9 | | arn: aws: securityhub:: /1.14 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.6 | | arn: aws: securityhub:: /1.16 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.2 | | arn: aws: securityhub:: /1.2 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.5 | | arn: aws: securityhub:: /1.20 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.18 | | arn: aws: securityhub:: /1.22 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.1 | | arn: aws: securityhub::: /1.3 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.8 | | arn: aws: securityhub:: /1.4 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.3 | | arn: aws: securityhub:: /1.5 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.11 | | arn: aws: securityhub:: /1.6 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.12 | | arn: aws: securityhub::: /1.7 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.13 | | arn: aws: securityhub:: /1.8 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.14 | | arn: aws: securityhub:: /1.9 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/IAM.15 | | arn: aws: securityhub:: /2.1 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .1 CloudTrail | | arn: aws: securityhub:: /2.2 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .4 CloudTrail | | arn: aws: securityhub:: /2.3 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .6 CloudTrail | | arn: aws: securityhub:: /2.4 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .5 CloudTrail | | arn: aws: securityhub::: /2.5 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/Config.1 | | arn: aws: securityhub:: /2.6 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .7 CloudTrail | | arn: aws: securityhub:: /2.7 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .2 CloudTrail | | arn: aws: securityhub::: /2.8 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/KMS.4 | | arn: aws: securityhub:: /2.9 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/EC2.6 | | arn: aws: securityhub:: /3.1 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .2 CloudWatch | | arn: aws: securityhub:: /3.2 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .3 CloudWatch | | arn: aws: securityhub:: /3.3 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .1 CloudWatch | | arn: aws: securityhub:: /3.4 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .4 CloudWatch | | arn: aws: securityhub::: /3.5 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .5 CloudWatch | | arn: aws: securityhub:: /3.6 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .6 CloudWatch | | arn: aws: securityhub:: /3.7 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .7 CloudWatch | | arn: aws: securityhub:: /3.8 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .8 CloudWatch | | arn: aws: securityhub:: /3.9 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .9 CloudWatch | | arn: aws: securityhub:: /3.10 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .10 CloudWatch | | arn: aws: securityhub:: /3.11 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .11 CloudWatch | | arn: aws: securityhub:: /3.12 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .12 CloudWatch | | arn: aws: securityhub:: /3.13 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .13 CloudWatch | | arn: aws: securityhub:: /3.14 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | 安全控制/ .14 CloudWatch | | arn: aws: securityhub:: /4.1 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/EC2.13 | | arn: aws: securityhub::: /4.2 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/EC2.14 | | arn: aws: securityhub:: /4.3 ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule | security-control/EC2.2 | | cis-aws-foundations-benchmark/v/1.4.0/1.10 | security-control/IAM.5 | | cis-aws-foundations-benchmark/v/1.4.0/1.14 | security-control/IAM.3 | | cis-aws-foundations-benchmark/v/1.4.0/1.16 | security-control/IAM.1 | | cis-aws-foundations-benchmark/v/1.4.0/1.17 | security-control/IAM.18 | | cis-aws-foundations-benchmark/v/1.4.0/1.4 | security-control/IAM.4 | | cis-aws-foundations-benchmark/v/1.4.0/1.5 | security-control/IAM.9 | | cis-aws-foundations-benchmark/v/1.4.0/1.6 | security-control/IAM.6 | | cis-aws-foundations-benchmark/v/1.4.0/1.7 | 安全控制/ .1 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/1.8 | security-control/IAM.15 | | cis-aws-foundations-benchmark/v/1.4.0/1.9 | security-control/IAM.16 | | cis-aws-foundations-benchmark/v/1.4.0/2.1.2 | security-control/S3.5 | | cis-aws-foundations-benchmark/v/1.4.0/2.1.5.1 | security-control/S3.1 | | cis-aws-foundations-benchmark/v/1.4.0/2.1.5.2 | security-control/S3.8 | | cis-aws-foundations-benchmark/v/1.4.0/2.2.1 | security-control/EC2.7 | | cis-aws-foundations-benchmark/v/1.4.0/2.3.1 | security-control/RDS.3 | | cis-aws-foundations-benchmark/v/1.4.0/3.1 | 安全控制/ .1 CloudTrail | | cis-aws-foundations-benchmark/v/1.4.0/3.2 | 安全控制/ .4 CloudTrail | | cis-aws-foundations-benchmark/v/1.4.0/3.4 | 安全控制/ .5 CloudTrail | | cis-aws-foundations-benchmark/v/1.4.0/3.5 | security-control/Config.1 | | cis-aws-foundations-benchmark/v/1.4.0/3.6 | security-control/S3.9 | | cis-aws-foundations-benchmark/v/1.4.0/3.7 | 安全控制/ .2 CloudTrail | | cis-aws-foundations-benchmark/v/1.4.0/3.8 | security-control/KMS.4 | | cis-aws-foundations-benchmark/v/1.4.0/3.9 | security-control/EC2.6 | | cis-aws-foundations-benchmark/v/1.4.0/4.3 | 安全控制/ .1 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.4 | 安全控制/ .4 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.5 | 安全控制/ .5 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.6 | 安全控制/ .6 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.7 | 安全控制/ .7 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.8 | 安全控制/ .8 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.9 | 安全控制/ .9 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.10 | 安全控制/ .10 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.11 | 安全控制/ .11 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.12 | 安全控制/ .12 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.13 | 安全控制/ .13 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/4.14 | 安全控制/ .14 CloudWatch | | cis-aws-foundations-benchmark/v/1.4.0/5.1 | security-control/EC2.21 | | cis-aws-foundations-benchmark/v/1.4.0/5.3 | security-control/EC2.2 | | aws-foundational-security-best-practices/v/1.0.0/Account .1 | security-control/Account.1 | | aws-foundational-security-best-practices/v/1.0.0/ACM .1 | security-control/ACM.1 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .1 | 安全控制/ .1 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .2 | 安全控制/ .2 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .3 | 安全控制/ .3 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .4 | 安全控制/ .4 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .5 | 安全控制/ .5 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .8 | 安全控制/ .8 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/APIGateway .9 | 安全控制/ .9 APIGateway | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling .1 | 安全控制/ .1 AutoScaling | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling .2 | 安全控制/ .2 AutoScaling | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling .3 | 安全控制/ .3 AutoScaling | | aws-foundational-security-best-practices/v/1.0.0/Autoscaling .5 | security-control/Autoscaling.5 | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling .6 | 安全控制/ .6 AutoScaling | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling .9 | 安全控制/ .9 AutoScaling | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .1 | 安全控制/ .1 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .3 | 安全控制/ .3 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .4 | 安全控制/ .4 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .5 | 安全控制/ .5 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .6 | 安全控制/ .6 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .7 | 安全控制/ .7 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .8 | 安全控制/ .8 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .9 | 安全控制/ .9 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .10 | 安全控制/ .10 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudFront .12 | 安全控制/ .12 CloudFront | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail .1 | 安全控制/ .1 CloudTrail | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail .2 | 安全控制/ .2 CloudTrail | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail .4 | 安全控制/ .4 CloudTrail | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail .5 | 安全控制/ .5 CloudTrail | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild .1 | 安全控制/ .1 CodeBuild | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild .2 | 安全控制/ .2 CodeBuild | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild .3 | 安全控制/ .3 CodeBuild | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild .4 | 安全控制/ .4 CodeBuild | | aws-foundational-security-best-practices/v/1.0.0/Config .1 | security-control/Config.1 | | aws-foundational-security-best-practices/v/1.0.0/DMS .1 | security-control/DMS.1 | | aws-foundational-security-best-practices/v/1.0.0/DynamoDB .1 | security-control/DynamoDB.1 | | aws-foundational-security-best-practices/v/1.0.0/DynamoDB .2 | security-control/DynamoDB.2 | | aws-foundational-security-best-practices/v/1.0.0/DynamoDB .3 | security-control/DynamoDB.3 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.1 | security-control/EC2.1 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.3 | security-control/EC2.3 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.4 | security-control/EC2.4 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.6 | security-control/EC2.6 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.7 | security-control/EC2.7 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.8 | security-control/EC2.8 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.9 | security-control/EC2.9 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.10 | security-control/EC2.10 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.15 | security-control/EC2.15 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.16 | security-control/EC2.16 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.17 | security-control/EC2.17 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.18 | security-control/EC2.18 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.19 | security-control/EC2.19 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.2 | security-control/EC2.2 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.20 | security-control/EC2.20 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.21 | security-control/EC2.21 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.23 | security-control/EC2.23 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.24 | security-control/EC2.24 | | aws-foundational-security-best-practices/v/1.0.0/EC 2.25 | security-control/EC2.25 | | aws-foundational-security-best-practices/v/1.0.0/ECR .1 | security-control/ECR.1 | | aws-foundational-security-best-practices/v/1.0.0/ECR .2 | security-control/ECR.2 | | aws-foundational-security-best-practices/v/1.0.0/ECR .3 | security-control/ECR.3 | | aws-foundational-security-best-practices/v/1.0.0/ECS .1 | security-control/ECS.1 | | aws-foundational-security-best-practices/v/1.0.0/ECS .10 | security-control/ECS.10 | | aws-foundational-security-best-practices/v/1.0.0/ECS .12 | security-control/ECS.12 | | aws-foundational-security-best-practices/v/1.0.0/ECS .2 | security-control/ECS.2 | | aws-foundational-security-best-practices/v/1.0.0/ECS .3 | security-control/ECS.3 | | aws-foundational-security-best-practices/v/1.0.0/ECS .4 | security-control/ECS.4 | | aws-foundational-security-best-practices/v/1.0.0/ECS .5 | security-control/ECS.5 | | aws-foundational-security-best-practices/v/1.0.0/ECS .8 | security-control/ECS.8 | | aws-foundational-security-best-practices/v/1.0.0/EFS .1 | security-control/EFS.1 | | aws-foundational-security-best-practices/v/1.0.0/EFS .2 | security-control/EFS.2 | | aws-foundational-security-best-practices/v/1.0.0/EFS .3 | security-control/EFS.3 | | aws-foundational-security-best-practices/v/1.0.0/EFS .4 | security-control/EFS.4 | | aws-foundational-security-best-practices/v/1.0.0/EKS .2 | security-control/EKS.2 | | aws-foundational-security-best-practices/v/1.0.0/ElasticBeanstalk .1 | 安全控制/ .1 ElasticBeanstalk | | aws-foundational-security-best-practices/v/1.0.0/ElasticBeanstalk .2 | 安全控制/ .2 ElasticBeanstalk | | aws-foundational-security-best-practices/v/1.0.0/ELBv 2.1 | security-control/ELB.1 | | aws-foundational-security-best-practices/v/1.0.0/ELB .2 | security-control/ELB.2 | | aws-foundational-security-best-practices/v/1.0.0/ELB .3 | security-control/ELB.3 | | aws-foundational-security-best-practices/v/1.0.0/ELB .4 | security-control/ELB.4 | | aws-foundational-security-best-practices/v/1.0.0/ELB .5 | security-control/ELB.5 | | aws-foundational-security-best-practices/v/1.0.0/ELB .6 | security-control/ELB.6 | | aws-foundational-security-best-practices/v/1.0.0/ELB .7 | security-control/ELB.7 | | aws-foundational-security-best-practices/v/1.0.0/ELB .8 | security-control/ELB.8 | | aws-foundational-security-best-practices/v/1.0.0/ELB .9 | security-control/ELB.9 | | aws-foundational-security-best-practices/v/1.0.0/ELB .10 | security-control/ELB.10 | | aws-foundational-security-best-practices/v/1.0.0/ELB .11 | security-control/ELB.11 | | aws-foundational-security-best-practices/v/1.0.0/ELB .12 | security-control/ELB.12 | | aws-foundational-security-best-practices/v/1.0.0/ELB .13 | security-control/ELB.13 | | aws-foundational-security-best-practices/v/1.0.0/ELB .14 | security-control/ELB.14 | | aws-foundational-security-best-practices/v/1.0.0/EMR .1 | security-control/EMR.1 | | aws-foundational-security-best-practices/v/1.0.0/ES .1 | security-control/ES.1 | | aws-foundational-security-best-practices/v/1.0.0/ES .2 | security-control/ES.2 | | aws-foundational-security-best-practices/v/1.0.0/ES .3 | security-control/ES.3 | | aws-foundational-security-best-practices/v/1.0.0/ES .4 | security-control/ES.4 | | aws-foundational-security-best-practices/v/1.0.0/ES .5 | security-control/ES.5 | | aws-foundational-security-best-practices/v/1.0.0/ES .6 | security-control/ES.6 | | aws-foundational-security-best-practices/v/1.0.0/ES .7 | security-control/ES.7 | | aws-foundational-security-best-practices/v/1.0.0/ES .8 | security-control/ES.8 | | aws-foundational-security-best-practices/v/1.0.0/GuardDuty .1 | 安全控制/ .1 GuardDuty | | aws-foundational-security-best-practices/v/1.0.0/IAM .1 | security-control/IAM.1 | | aws-foundational-security-best-practices/v/1.0.0/IAM .2 | security-control/IAM.2 | | aws-foundational-security-best-practices/v/1.0.0/IAM .21 | security-control/IAM.21 | | aws-foundational-security-best-practices/v/1.0.0/IAM .3 | security-control/IAM.3 | | aws-foundational-security-best-practices/v/1.0.0/IAM .4 | security-control/IAM.4 | | aws-foundational-security-best-practices/v/1.0.0/IAM .5 | security-control/IAM.5 | | aws-foundational-security-best-practices/v/1.0.0/IAM .6 | security-control/IAM.6 | | aws-foundational-security-best-practices/v/1.0.0/IAM .7 | security-control/IAM.7 | | aws-foundational-security-best-practices/v/1.0.0/IAM .8 | security-control/IAM.8 | | aws-foundational-security-best-practices/v/1.0.0/Kinesis .1 | security-control/Kinesis.1 | | aws-foundational-security-best-practices/v/1.0.0/KMS .1 | security-control/KMS.1 | | aws-foundational-security-best-practices/v/1.0.0/KMS .2 | security-control/KMS.2 | | aws-foundational-security-best-practices/v/1.0.0/KMS .3 | security-control/KMS.3 | | aws-foundational-security-best-practices/v/1.0.0/Lambda .1 | security-control/Lambda.1 | | aws-foundational-security-best-practices/v/1.0.0/Lambda .2 | security-control/Lambda.2 | | aws-foundational-security-best-practices/v/1.0.0/Lambda .5 | security-control/Lambda.5 | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall .3 | 安全控制/ .3 NetworkFirewall | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall .4 | 安全控制/ .4 NetworkFirewall | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall .5 | 安全控制/ .5 NetworkFirewall | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall .6 | 安全控制/ .6 NetworkFirewall | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .1 | security-control/Opensearch.1 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .2 | security-control/Opensearch.2 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .3 | security-control/Opensearch.3 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .4 | security-control/Opensearch.4 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .5 | security-control/Opensearch.5 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .6 | security-control/Opensearch.6 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .7 | security-control/Opensearch.7 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch .8 | security-control/Opensearch.8 | | aws-foundational-security-best-practices/v/1.0.0/RDS .1 | security-control/RDS.1 | | aws-foundational-security-best-practices/v/1.0.0/RDS .10 | security-control/RDS.10 | | aws-foundational-security-best-practices/v/1.0.0/RDS .11 | security-control/RDS.11 | | aws-foundational-security-best-practices/v/1.0.0/RDS .12 | security-control/RDS.12 | | aws-foundational-security-best-practices/v/1.0.0/RDS .13 | security-control/RDS.13 | | aws-foundational-security-best-practices/v/1.0.0/RDS .14 | security-control/RDS.14 | | aws-foundational-security-best-practices/v/1.0.0/RDS .15 | security-control/RDS.15 | | aws-foundational-security-best-practices/v/1.0.0/RDS .16 | security-control/RDS.16 | | aws-foundational-security-best-practices/v/1.0.0/RDS .17 | security-control/RDS.17 | | aws-foundational-security-best-practices/v/1.0.0/RDS .19 | security-control/RDS.19 | | aws-foundational-security-best-practices/v/1.0.0/RDS .2 | security-control/RDS.2 | | aws-foundational-security-best-practices/v/1.0.0/RDS .20 | security-control/RDS.20 | | aws-foundational-security-best-practices/v/1.0.0/RDS .21 | security-control/RDS.21 | | aws-foundational-security-best-practices/v/1.0.0/RDS .22 | security-control/RDS.22 | | aws-foundational-security-best-practices/v/1.0.0/RDS .23 | security-control/RDS.23 | | aws-foundational-security-best-practices/v/1.0.0/RDS .24 | security-control/RDS.24 | | aws-foundational-security-best-practices/v/1.0.0/RDS .25 | security-control/RDS.25 | | aws-foundational-security-best-practices/v/1.0.0/RDS .3 | security-control/RDS.3 | | aws-foundational-security-best-practices/v/1.0.0/RDS .4 | security-control/RDS.4 | | aws-foundational-security-best-practices/v/1.0.0/RDS .5 | security-control/RDS.5 | | aws-foundational-security-best-practices/v/1.0.0/RDS .6 | security-control/RDS.6 | | aws-foundational-security-best-practices/v/1.0.0/RDS .7 | security-control/RDS.7 | | aws-foundational-security-best-practices/v/1.0.0/RDS .8 | security-control/RDS.8 | | aws-foundational-security-best-practices/v/1.0.0/RDS .9 | security-control/RDS.9 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .1 | security-control/Redshift.1 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .2 | security-control/Redshift.2 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .3 | security-control/Redshift.3 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .4 | security-control/Redshift.4 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .6 | security-control/Redshift.6 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .7 | security-control/Redshift.7 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .8 | security-control/Redshift.8 | | aws-foundational-security-best-practices/v/1.0.0/Redshift .9 | security-control/Redshift.9 | | aws-foundational-security-best-practices/v/1.0.0/S 3.1 | security-control/S3.1 | | aws-foundational-security-best-practices/v/1.0.0/S 3.12 | security-control/S3.12 | | aws-foundational-security-best-practices/v/1.0.0/S 3.13 | security-control/S3.13 | | aws-foundational-security-best-practices/v/1.0.0/S 3.2 | security-control/S3.2 | | aws-foundational-security-best-practices/v/1.0.0/S 3.3 | security-control/S3.3 | | aws-foundational-security-best-practices/v/1.0.0/S 3.5 | security-control/S3.5 | | aws-foundational-security-best-practices/v/1.0.0/S 3.6 | security-control/S3.6 | | aws-foundational-security-best-practices/v/1.0.0/S 3.8 | security-control/S3.8 | | aws-foundational-security-best-practices/v/1.0.0/S 3.9 | security-control/S3.9 | | aws-foundational-security-best-practices/v/1.0.0/SageMaker .1 | 安全控制/ .1 SageMaker | | aws-foundational-security-best-practices/v/1.0.0/SageMaker .2 | 安全控制/ .2 SageMaker | | aws-foundational-security-best-practices/v/1.0.0/SageMaker .3 | 安全控制/ .3 SageMaker | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager .1 | 安全控制/ .1 SecretsManager | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager .2 | 安全控制/ .2 SecretsManager | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager .3 | 安全控制/ .3 SecretsManager | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager .4 | 安全控制/ .4 SecretsManager | | aws-foundational-security-best-practices/v/1.0.0/SQS .1 | security-control/SQS.1 | | aws-foundational-security-best-practices/v/1.0.0/SSM .1 | security-control/SSM.1 | | aws-foundational-security-best-practices/v/1.0.0/SSM .2 | security-control/SSM.2 | | aws-foundational-security-best-practices/v/1.0.0/SSM .3 | security-control/SSM.3 | | aws-foundational-security-best-practices/v/1.0.0/SSM .4 | security-control/SSM.4 | | aws-foundational-security-best-practices/v/1.0.0/WAF .1 | security-control/WAF.1 | | aws-foundational-security-best-practices/v/1.0.0/WAF .2 | security-control/WAF.2 | | aws-foundational-security-best-practices/v/1.0.0/WAF .3 | security-control/WAF.3 | | aws-foundational-security-best-practices/v/1.0.0/WAF .4 | security-control/WAF.4 | | aws-foundational-security-best-practices/v/1.0.0/WAF .6 | security-control/WAF.6 | | aws-foundational-security-best-practices/v/1.0.0/WAF .7 | security-control/WAF.7 | | aws-foundational-security-best-practices/v/1.0.0/WAF .8 | security-control/WAF.8 | | aws-foundational-security-best-practices/v/1.0.0/WAF .10 | security-control/WAF.10 | | pci-dss/v/3.2.1/PCI。 AutoScaling.1 | 安全控制/ .1 AutoScaling | | pci-dss/v/3.2.1/PCI。 CloudTrail.1 | 安全控制/ .2 CloudTrail | | pci-dss/v/3.2.1/PCI。 CloudTrail.2 | 安全控制/ .3 CloudTrail | | pci-dss/v/3.2.1/PCI。 CloudTrail.3 | 安全控制/ .4 CloudTrail | | pci-dss/v/3.2.1/PCI。 CloudTrail.4 | 安全控制/ .5 CloudTrail | | pci-dss/v/3.2.1/PCI。 CodeBuild.1 | 安全控制/ .1 CodeBuild | | pci-dss/v/3.2.1/PCI。 CodeBuild.2 | 安全控制/ .2 CodeBuild | | pci-dss/v/3.2.1/PCI .Config.1 | security-control/Config.1 | | pci-.CW.1 dss/v/3.2.1/PCI | 安全控制/ .1 CloudWatch | | pci-dss/v/3.2.1/PCI .DMS.1 | security-control/DMS.1 | | pci-.EC2.1 dss/v/3.2.1/PCI | security-control/EC2.1 | | pci-.ec2.2 dss/v/3.2.1/PCI | security-control/EC2.2 | | pci-.ec2.4 dss/v/3.2.1/PCI | security-control/EC2.12 | | pci-.EC2.5 dss/v/3.2.1/PCI | security-control/EC2.13 | | pci-.ec2.6 dss/v/3.2.1/PCI | security-control/EC2.6 | | pci-dss/v/3.2.1/PCI。 ELBv2.1 | security-control/ELB.1 | | pci-.ES.1 dss/v/3.2.1/PCI | security-control/ES.2 | | pci-.ES.2 dss/v/3.2.1/PCI | security-control/ES.1 | | pci-dss/v/3.2.1/PCI。 GuardDuty.1 | 安全控制/ .1 GuardDuty | | pci-.IAM.1 dss/v/3.2.1/PCI | security-control/IAM.4 | | pci-.IAM.2 dss/v/3.2.1/PCI | security-control/IAM.2 | | pci-.IAM.3 dss/v/3.2.1/PCI | security-control/IAM.1 | | pci-.IAM.4 dss/v/3.2.1/PCI | security-control/IAM.6 | | pci-.IAM.5 dss/v/3.2.1/PCI | security-control/IAM.9 | | pci-.IAM.6 dss/v/3.2.1/PCI | security-control/IAM.19 | | pci-.IAM.7 dss/v/3.2.1/PCI | security-control/IAM.8 | | pci-.IAM.8 dss/v/3.2.1/PCI | security-control/IAM.10 | | pci-dss/v/3.2.1/PCI .KMS.1 | security-control/KMS.4 | | pci-dss/v/3.2.1/PCI .Lambda.1 | security-control/Lambda.1 | | pci-dss/v/3.2.1/PCI .Lambda.2 | security-control/Lambda.3 | | pci-dss/v/3.2.1/PCI .Opensearch.1 | security-control/Opensearch.2 | | pci-dss/v/3.2.1/PCI .Opensearch.2 | security-control/Opensearch.1 | | pci-dss/v/3.2.1/PCI .rds.1 | security-control/RDS.1 | | pci-dss/v/3.2.1/PCI .rds.2 | security-control/RDS.2 | | pci-dss/v/3.2.1/PCI .redshift.1 | security-control/Redshift.1 | | pci-dss/v/3.2.1/PCI .s3.1 | security-control/S3.3 | | pci-dss/v/3.2.1/PCI .s3.2 | security-control/S3.2 | | pci-dss/v/3.2.1/PCI .s3.3 | security-control/S3.7 | | pci-dss/v/3.2.1/PCI .s3.5 | security-control/S3.5 | | pci-dss/v/3.2.1/PCI .s3.6 | security-control/S3.1 | | pci-dss/v/3.2.1/PCI。 SageMaker.1 | 安全控制/ .1 SageMaker | | pci-dss/v/3.2.1/PCI .SSM.1 | security-control/SSM.2 | | pci-dss/v/3.2.1/PCI .SSM.2 | security-control/SSM.3 | | pci-dss/v/3.2.1/PCI .SSM.3 | security-control/SSM.1 | | service-managed-aws-control-tower/v/1.0.0/ACM .1 | security-control/ACM.1 | | service-managed-aws-control-tower/v/1.0.0/APIGateway .1 | 安全控制/ .1 APIGateway | | service-managed-aws-control-tower/v/1.0.0/APIGateway .2 | 安全控制/ .2 APIGateway | | service-managed-aws-control-tower/v/1.0.0/APIGateway .3 | 安全控制/ .3 APIGateway | | service-managed-aws-control-tower/v/1.0.0/APIGateway .4 | 安全控制/ .4 APIGateway | | service-managed-aws-control-tower/v/1.0.0/APIGateway .5 | 安全控制/ .5 APIGateway | | service-managed-aws-control-tower/v/1.0.0/AutoScaling .1 | 安全控制/ .1 AutoScaling | | service-managed-aws-control-tower/v/1.0.0/AutoScaling .2 | 安全控制/ .2 AutoScaling | | service-managed-aws-control-tower/v/1.0.0/AutoScaling .3 | 安全控制/ .3 AutoScaling | | service-managed-aws-control-tower/v/1.0.0/AutoScaling .4 | 安全控制/ .4 AutoScaling | | service-managed-aws-control-tower/v/1.0.0/Autoscaling .5 | security-control/Autoscaling.5 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling .6 | 安全控制/ .6 AutoScaling | | service-managed-aws-control-tower/v/1.0.0/AutoScaling .9 | 安全控制/ .9 AutoScaling | | service-managed-aws-control-tower/v/1.0.0/CloudTrail .1 | 安全控制/ .1 CloudTrail | | service-managed-aws-control-tower/v/1.0.0/CloudTrail .2 | 安全控制/ .2 CloudTrail | | service-managed-aws-control-tower/v/1.0.0/CloudTrail .4 | 安全控制/ .4 CloudTrail | | service-managed-aws-control-tower/v/1.0.0/CloudTrail .5 | 安全控制/ .5 CloudTrail | | service-managed-aws-control-tower/v/1.0.0/CodeBuild .1 | 安全控制/ .1 CodeBuild | | service-managed-aws-control-tower/v/1.0.0/CodeBuild .2 | 安全控制/ .2 CodeBuild | | service-managed-aws-control-tower/v/1.0.0/CodeBuild .4 | 安全控制/ .4 CodeBuild | | service-managed-aws-control-tower/v/1.0.0/CodeBuild .5 | 安全控制/ .5 CodeBuild | | service-managed-aws-control-tower/v/1.0.0/DMS .1 | security-control/DMS.1 | | service-managed-aws-control-tower/v/1.0.0/DynamoDB .1 | security-control/DynamoDB.1 | | service-managed-aws-control-tower/v/1.0.0/DynamoDB .2 | security-control/DynamoDB.2 | | service-managed-aws-control-tower/v/1.0.0/EC 2.1 | security-control/EC2.1 | | service-managed-aws-control-tower/v/1.0.0/EC 2.2 | security-control/EC2.2 | | service-managed-aws-control-tower/v/1.0.0/EC 2.3 | security-control/EC2.3 | | service-managed-aws-control-tower/v/1.0.0/EC 2.4 | security-control/EC2.4 | | service-managed-aws-control-tower/v/1.0.0/EC 2.6 | security-control/EC2.6 | | service-managed-aws-control-tower/v/1.0.0/EC 2.7 | security-control/EC2.7 | | service-managed-aws-control-tower/v/1.0.0/EC 2.8 | security-control/EC2.8 | | service-managed-aws-control-tower/v/1.0.0/EC 2.9 | security-control/EC2.9 | | service-managed-aws-control-tower/v/1.0.0/EC 2.10 | security-control/EC2.10 | | service-managed-aws-control-tower/v/1.0.0/EC 2.15 | security-control/EC2.15 | | service-managed-aws-control-tower/v/1.0.0/EC 2.16 | security-control/EC2.16 | | service-managed-aws-control-tower/v/1.0.0/EC 2.17 | security-control/EC2.17 | | service-managed-aws-control-tower/v/1.0.0/EC 2.18 | security-control/EC2.18 | | service-managed-aws-control-tower/v/1.0.0/EC 2.19 | security-control/EC2.19 | | service-managed-aws-control-tower/v/1.0.0/EC 2.20 | security-control/EC2.20 | | service-managed-aws-control-tower/v/1.0.0/EC 2.21 | security-control/EC2.21 | | service-managed-aws-control-tower/v/1.0.0/EC 2.22 | security-control/EC2.22 | | service-managed-aws-control-tower/v/1.0.0/ECR .1 | security-control/ECR.1 | | service-managed-aws-control-tower/v/1.0.0/ECR .2 | security-control/ECR.2 | | service-managed-aws-control-tower/v/1.0.0/ECR .3 | security-control/ECR.3 | | service-managed-aws-control-tower/v/1.0.0/ECS .1 | security-control/ECS.1 | | service-managed-aws-control-tower/v/1.0.0/ECS .2 | security-control/ECS.2 | | service-managed-aws-control-tower/v/1.0.0/ECS .3 | security-control/ECS.3 | | service-managed-aws-control-tower/v/1.0.0/ECS .4 | security-control/ECS.4 | | service-managed-aws-control-tower/v/1.0.0/ECS .5 | security-control/ECS.5 | | service-managed-aws-control-tower/v/1.0.0/ECS .8 | security-control/ECS.8 | | service-managed-aws-control-tower/v/1.0.0/ECS .10 | security-control/ECS.10 | | service-managed-aws-control-tower/v/1.0.0/ECS .12 | security-control/ECS.12 | | service-managed-aws-control-tower/v/1.0.0/EFS .1 | security-control/EFS.1 | | service-managed-aws-control-tower/v/1.0.0/EFS .2 | security-control/EFS.2 | | service-managed-aws-control-tower/v/1.0.0/EFS .3 | security-control/EFS.3 | | service-managed-aws-control-tower/v/1.0.0/EFS .4 | security-control/EFS.4 | | service-managed-aws-control-tower/v/1.0.0/EKS .2 | security-control/EKS.2 | | service-managed-aws-control-tower/v/1.0.0/ELB .2 | security-control/ELB.2 | | service-managed-aws-control-tower/v/1.0.0/ELB .3 | security-control/ELB.3 | | service-managed-aws-control-tower/v/1.0.0/ELB .4 | security-control/ELB.4 | | service-managed-aws-control-tower/v/1.0.0/ELB .5 | security-control/ELB.5 | | service-managed-aws-control-tower/v/1.0.0/ELB .6 | security-control/ELB.6 | | service-managed-aws-control-tower/v/1.0.0/ELB .7 | security-control/ELB.7 | | service-managed-aws-control-tower/v/1.0.0/ELB .8 | security-control/ELB.8 | | service-managed-aws-control-tower/v/1.0.0/ELB .9 | security-control/ELB.9 | | service-managed-aws-control-tower/v/1.0.0/ELB .10 | security-control/ELB.10 | | service-managed-aws-control-tower/v/1.0.0/ELB .12 | security-control/ELB.12 | | service-managed-aws-control-tower/v/1.0.0/ELB .13 | security-control/ELB.13 | | service-managed-aws-control-tower/v/1.0.0/ELB .14 | security-control/ELB.14 | | service-managed-aws-control-tower/v/1.0.0/ELBv 2.1 | 安全控制/ .1 ELBv2 | | service-managed-aws-control-tower/v/1.0.0/EMR .1 | security-control/EMR.1 | | service-managed-aws-control-tower/v/1.0.0/ES .1 | security-control/ES.1 | | service-managed-aws-control-tower/v/1.0.0/ES .2 | security-control/ES.2 | | service-managed-aws-control-tower/v/1.0.0/ES .3 | security-control/ES.3 | | service-managed-aws-control-tower/v/1.0.0/ES .4 | security-control/ES.4 | | service-managed-aws-control-tower/v/1.0.0/ES .5 | security-control/ES.5 | | service-managed-aws-control-tower/v/1.0.0/ES .6 | security-control/ES.6 | | service-managed-aws-control-tower/v/1.0.0/ES .7 | security-control/ES.7 | | service-managed-aws-control-tower/v/1.0.0/ES .8 | security-control/ES.8 | | service-managed-aws-control-tower/v/1.0.0/ElasticBeanstalk .1 | 安全控制/ .1 ElasticBeanstalk | | service-managed-aws-control-tower/v/1.0.0/ElasticBeanstalk .2 | 安全控制/ .2 ElasticBeanstalk | | service-managed-aws-control-tower/v/1.0.0/GuardDuty .1 | 安全控制/ .1 GuardDuty | | service-managed-aws-control-tower/v/1.0.0/IAM .1 | security-control/IAM.1 | | service-managed-aws-control-tower/v/1.0.0/IAM .2 | security-control/IAM.2 | | service-managed-aws-control-tower/v/1.0.0/IAM .3 | security-control/IAM.3 | | service-managed-aws-control-tower/v/1.0.0/IAM .4 | security-control/IAM.4 | | service-managed-aws-control-tower/v/1.0.0/IAM .5 | security-control/IAM.5 | | service-managed-aws-control-tower/v/1.0.0/IAM .6 | security-control/IAM.6 | | service-managed-aws-control-tower/v/1.0.0/IAM .7 | security-control/IAM.7 | | service-managed-aws-control-tower/v/1.0.0/IAM .8 | security-control/IAM.8 | | service-managed-aws-control-tower/v/1.0.0/IAM .21 | security-control/IAM.21 | | service-managed-aws-control-tower/v/1.0.0/Kinesis .1 | security-control/Kinesis.1 | | service-managed-aws-control-tower/v/1.0.0/KMS .1 | security-control/KMS.1 | | service-managed-aws-control-tower/v/1.0.0/KMS .2 | security-control/KMS.2 | | service-managed-aws-control-tower/v/1.0.0/KMS .3 | security-control/KMS.3 | | service-managed-aws-control-tower/v/1.0.0/Lambda .1 | security-control/Lambda.1 | | service-managed-aws-control-tower/v/1.0.0/Lambda .2 | security-control/Lambda.2 | | service-managed-aws-control-tower/v/1.0.0/Lambda .5 | security-control/Lambda.5 | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall .3 | 安全控制/ .3 NetworkFirewall | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall .4 | 安全控制/ .4 NetworkFirewall | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall .5 | 安全控制/ .5 NetworkFirewall | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall .6 | 安全控制/ .6 NetworkFirewall | | service-managed-aws-control-tower/v/1.0.0/Opensearch .1 | security-control/Opensearch.1 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .2 | security-control/Opensearch.2 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .3 | security-control/Opensearch.3 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .4 | security-control/Opensearch.4 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .5 | security-control/Opensearch.5 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .6 | security-control/Opensearch.6 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .7 | security-control/Opensearch.7 | | service-managed-aws-control-tower/v/1.0.0/Opensearch .8 | security-control/Opensearch.8 | | service-managed-aws-control-tower/v/1.0.0/RDS .1 | security-control/RDS.1 | | service-managed-aws-control-tower/v/1.0.0/RDS .2 | security-control/RDS.2 | | service-managed-aws-control-tower/v/1.0.0/RDS .3 | security-control/RDS.3 | | service-managed-aws-control-tower/v/1.0.0/RDS .4 | security-control/RDS.4 | | service-managed-aws-control-tower/v/1.0.0/RDS .5 | security-control/RDS.5 | | service-managed-aws-control-tower/v/1.0.0/RDS .6 | security-control/RDS.6 | | service-managed-aws-control-tower/v/1.0.0/RDS .8 | security-control/RDS.8 | | service-managed-aws-control-tower/v/1.0.0/RDS .9 | security-control/RDS.9 | | service-managed-aws-control-tower/v/1.0.0/RDS .10 | security-control/RDS.10 | | service-managed-aws-control-tower/v/1.0.0/RDS .11 | security-control/RDS.11 | | service-managed-aws-control-tower/v/1.0.0/RDS .13 | security-control/RDS.13 | | service-managed-aws-control-tower/v/1.0.0/RDS .17 | security-control/RDS.17 | | service-managed-aws-control-tower/v/1.0.0/RDS .18 | security-control/RDS.18 | | service-managed-aws-control-tower/v/1.0.0/RDS .19 | security-control/RDS.19 | | service-managed-aws-control-tower/v/1.0.0/RDS .20 | security-control/RDS.20 | | service-managed-aws-control-tower/v/1.0.0/RDS .21 | security-control/RDS.21 | | service-managed-aws-control-tower/v/1.0.0/RDS .22 | security-control/RDS.22 | | service-managed-aws-control-tower/v/1.0.0/RDS .23 | security-control/RDS.23 | | service-managed-aws-control-tower/v/1.0.0/RDS .25 | security-control/RDS.25 | | service-managed-aws-control-tower/v/1.0.0/Redshift .1 | security-control/Redshift.1 | | service-managed-aws-control-tower/v/1.0.0/Redshift .2 | security-control/Redshift.2 | | service-managed-aws-control-tower/v/1.0.0/Redshift .4 | security-control/Redshift.4 | | service-managed-aws-control-tower/v/1.0.0/Redshift .6 | security-control/Redshift.6 | | service-managed-aws-control-tower/v/1.0.0/Redshift .7 | security-control/Redshift.7 | | service-managed-aws-control-tower/v/1.0.0/Redshift .8 | security-control/Redshift.8 | | service-managed-aws-control-tower/v/1.0.0/Redshift .9 | security-control/Redshift.9 | | service-managed-aws-control-tower/v/1.0.0/S 3.1 | security-control/S3.1 | | service-managed-aws-control-tower/v/1.0.0/S 3.2 | security-control/S3.2 | | service-managed-aws-control-tower/v/1.0.0/S 3.3 | security-control/S3.3 | | service-managed-aws-control-tower/v/1.0.0/S 3.5 | security-control/S3.5 | | service-managed-aws-control-tower/v/1.0.0/S 3.6 | security-control/S3.6 | | service-managed-aws-control-tower/v/1.0.0/S 3.8 | security-control/S3.8 | | service-managed-aws-control-tower/v/1.0.0/S 3.9 | security-control/S3.9 | | service-managed-aws-control-tower/v/1.0.0/S 3.12 | security-control/S3.12 | | service-managed-aws-control-tower/v/1.0.0/S 3.13 | security-control/S3.13 | | service-managed-aws-control-tower/v/1.0.0/SageMaker .1 | 安全控制/ .1 SageMaker | | service-managed-aws-control-tower/v/1.0.0/SecretsManager .1 | 安全控制/ .1 SecretsManager | | service-managed-aws-control-tower/v/1.0.0/SecretsManager .2 | 安全控制/ .2 SecretsManager | | service-managed-aws-control-tower/v/1.0.0/SecretsManager .3 | 安全控制/ .3 SecretsManager | | service-managed-aws-control-tower/v/1.0.0/SecretsManager .4 | 安全控制/ .4 SecretsManager | | service-managed-aws-control-tower/v/1.0.0/SQS .1 | security-control/SQS.1 | | service-managed-aws-control-tower/v/1.0.0/SSM .1 | security-control/SSM.1 | | service-managed-aws-control-tower/v/1.0.0/SSM .2 | security-control/SSM.2 | | service-managed-aws-control-tower/v/1.0.0/SSM .3 | security-control/SSM.3 | | service-managed-aws-control-tower/v/1.0.0/SSM .4 | security-control/SSM.4 | | service-managed-aws-control-tower/v/1.0.0/WAF .2 | security-control/WAF.2 | | service-managed-aws-control-tower/v/1.0.0/WAF .3 | security-control/WAF.3 | | service-managed-aws-control-tower/v/1.0.0/WAF .4 | security-control/WAF.4 | ## 整合如何影响控制权 IDs 和所有权 整合的控制视图和整合的控制结果标准化了跨标准的控制 IDs 和标题。*安全控件 ID* 和*安全控件标题*这两个术语是指这些与标准无关的值。 无论您的账户启用还是禁用了整合控制结果，Security Hub CSPM 控制台都会显示与标准无关的安全控制 IDs 和安全控制标题。但是，如果您的账户禁用了整合的控件调查发现，则 Security Hub CSPM 调查发现包含针对 PCI DSS 和 CIS v1.2.0 的特定于标准的控件标题。此外，Security Hub CSPM 调查发现包含特定于标准的控件 ID 和安全控件 ID。有关整合如何影响控件调查发现的示例，请参阅[控件调查发现示例](sample-control-findings.md)。 对于属于 [AWS Control Tower 服务托管标准](service-managed-standard-aws-control-tower.md)一部分的控件，启用整合的控件调查发现后，将从调查发现的控件 ID 和标题中删除前缀 `CT.`。 要在 Security Hub CSPM 中禁用安全控件，必须禁用与该安全控件对应的所有标准控件。下表显示了安全控制 IDs 和标题与特定标准的控制和标题的映射 IDs 。 IDs 而且，属于 AWS 基础安全最佳实践 (FSBP) 标准的控件的标题已经与标准无关。有关控件与 Center for Internet Security（CIS）v3.0.0 要求的映射，请参阅 [将控件映射到每个版本中的 CIS 要求](cis-aws-foundations-benchmark.md#cis-version-comparison)。要在此表上运行您自己的脚本，您可以[将其下载为 .csv 文件](samples/Consolidation_ID_Title_Changes.csv.zip)。 | 标准 | 标准控件 ID 和标题 | 安全控件 ID 和标题 | | --- | --- | --- | | CIS v1.2.0 | 1.1 避免使用根用户 | [[CloudWatch.1] “root” 用户应有日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-1) | | CIS v1.2.0 | 1.10 确保 IAM 密码策略阻止重复使用密码 | [[IAM.16] 确保 IAM 密码策略阻止重复使用密码](iam-controls.md#iam-16) | | CIS v1.2.0 | 1.11 确保 IAM 密码策略使密码在 90 天或更短时间内失效 | [[IAM.17] 确保 IAM 密码策略使密码在 90 天或更短时间内失效](iam-controls.md#iam-17) | | CIS v1.2.0 | 1.12 确保不存在根用户访问密钥 | [[IAM.4] 不应存在 IAM 根用户访问密钥](iam-controls.md#iam-4) | | CIS v1.2.0 | 1.13 确保为根用户启用 MFA | [[IAM.9] 应为根用户启用 MFA](iam-controls.md#iam-9) | | CIS v1.2.0 | 1.14 确保为根用户启用硬件 MFA | [[IAM.6] 应该为根用户启用硬件 MFA](iam-controls.md#iam-6) | | CIS v1.2.0 | 1.16 确保 IAM policy 仅附加到组或角色 | [[IAM.2] IAM 用户不应附加 IAM policy](iam-controls.md#iam-2) | | CIS v1.2.0 | 1.2 确保为拥有控制台密码的所有 IAM 用户启用多重身份验证（MFA） | [[IAM.5] 应为拥有控制台密码的所有 IAM 用户启用 MFA](iam-controls.md#iam-5) | | CIS v1.2.0 | 1.20 确保创建支持角色来管理涉及 支持的事务 | [[IAM.18] 确保已创建支持角色来管理事件 AWS 支持](iam-controls.md#iam-18) | | CIS v1.2.0 | 1.22 确保未创建允许完全“\*.\*”管理权限的 IAM policy | [[IAM.1] IAM policy 不应允许完整的“\*”管理权限](iam-controls.md#iam-1) | | CIS v1.2.0 | 1.3 确保禁用 90 天或更长时间未使用的凭证 | [[IAM.8] 应移除未使用的 IAM 用户凭证](iam-controls.md#iam-8) | | CIS v1.2.0 | 1.4 确保访问密钥每 90 天或更短时间轮换一次 | [[IAM.3] IAM 用户访问密钥应每 90 天或更短时间轮换一次](iam-controls.md#iam-3) | | CIS v1.2.0 | 1.5 确保 IAM 密码策略要求包含至少一个大写字母 | [[IAM.11] 确保 IAM 密码策略要求包含至少一个大写字母](iam-controls.md#iam-11) | | CIS v1.2.0 | 1.6 确保 IAM 密码策略要求包含至少一个小写字母 | [[IAM.12] 确保 IAM 密码策略要求包含至少一个小写字母](iam-controls.md#iam-12) | | CIS v1.2.0 | 1.7 确保 IAM 密码策略要求包含至少一个符号 | [[IAM.13] 确保 IAM 密码策略要求包含至少一个符号](iam-controls.md#iam-13) | | CIS v1.2.0 | 1.8 确保 IAM 密码策略要求包含至少一个数字 | [[IAM.14] 确保 IAM 密码策略要求包含至少一个数字](iam-controls.md#iam-14) | | CIS v1.2.0 | 1.9 确保 IAM 密码策略要求最短密码长度不低于 14 | [[IAM.15] 确保 IAM 密码策略要求最短密码长度不低于 14](iam-controls.md#iam-15) | | CIS v1.2.0 | 2.1 确保 CloudTrail 在所有地区都已启用 | [[CloudTrail.1] CloudTrail 应启用并配置至少一条包含读写管理事件的多区域跟踪](cloudtrail-controls.md#cloudtrail-1) | | CIS v1.2.0 | 2.2 确保已启用 CloudTrail 日志文件验证 | [[CloudTrail.4] 应启用 CloudTrail 日志文件验证](cloudtrail-controls.md#cloudtrail-4) | | CIS v1.2.0 | 2.3 确保用于存储 CloudTrail 日志的 S3 存储桶不可公开访问 | [[CloudTrail.6] 确保用于存储 CloudTrail 日志的 S3 存储桶不可公开访问](cloudtrail-controls.md#cloudtrail-6) | | CIS v1.2.0 | 2.4 确保 CloudTrail 跟踪与 CloudWatch 日志集成 | [[CloudTrail.5] 应将 CloudTrail 跟踪与 Amazon CloudWatch 日志集成](cloudtrail-controls.md#cloudtrail-5) | | CIS v1.2.0 | 2.5 确保 AWS Config 已启用 | [AWS Config 应启用 [Config.1] 并使用服务相关角色进行资源记录](config-controls.md#config-1) | | CIS v1.2.0 | 2.6 确保在 S3 存储桶上启用 CloudTrail S3 存储桶访问日志记录 | [[CloudTrail.7] 确保在 S3 存储桶上启用 S CloudTrail 3 存储桶访问日志记录](cloudtrail-controls.md#cloudtrail-7) | | CIS v1.2.0 | 2.7 确保使用 KMS 对 CloudTrail 日志进行静态加密 CMKs | [[CloudTrail.2] CloudTrail 应该启用静态加密](cloudtrail-controls.md#cloudtrail-2) | | CIS v1.2.0 | 2.8 确保为创建的客户 CMKs 启用轮换 | [[KMS.4] 应启用 AWS KMS 密钥轮换](kms-controls.md#kms-4) | | CIS v1.2.0 | 2.9 确保全部启用 VPC 流量记录 VPCs | [[EC2.6] 应全部启用 VPC 流量记录 VPCs](ec2-controls.md#ec2-6) | | CIS v1.2.0 | 3.1 确保存在关于未经授权的 API 调用的日志指标筛选条件和警报 | [[CloudWatch.2] 确保存在针对未经授权的 API 调用的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-2) | | CIS v1.2.0 | 3.10 确保存在关于安全组更改的日志指标筛选条件和警报 | [[CloudWatch.10] 确保存在针对安全组更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-10) | | CIS v1.2.0 | 3.11 确保存在关于网络访问控制列表（NACL）更改的日志指标筛选条件和警报 | [[CloudWatch.11] 确保存在针对网络访问控制列表 (NACL) 更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-11) | | CIS v1.2.0 | 3.12 确保存在关于网络网关更改的日志指标筛选条件和警报 | [[CloudWatch.12] 确保存在针对网络网关更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-12) | | CIS v1.2.0 | 3.13 确保存在关于路由表更改的日志指标筛选条件和警报 | [[CloudWatch.13] 确保存在针对路由表更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-13) | | CIS v1.2.0 | 3.14 确保存在关于 VPC 更改的日志指标筛选条件和警报 | [[CloudWatch.14] 确保存在针对 VPC 更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-14) | | CIS v1.2.0 | 3.2 确保存在关于无 MFA 的管理控制台登录的日志指标筛选条件和警报 | [[CloudWatch.3] 确保在没有 MFA 的情况下登录管理控制台时存在日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-3) | | CIS v1.2.0 | 3.3 确保存在关于使用根用户的日志指标筛选条件和警报 | [[CloudWatch.1] “root” 用户应有日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-1) | | CIS v1.2.0 | 3.4 确保存在关于 IAM policy 更改的日志指标筛选条件和警报 | [[CloudWatch.4] 确保存在针对 IAM 策略更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-4) | | CIS v1.2.0 | 3.5 确保存在针对 CloudTrail 配置更改的日志指标筛选器和警报 | [[CloudWatch.5] 确保存在 CloudTrail 配置更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-5) | | CIS v1.2.0 | 3.6 确保存在针对 AWS 管理控制台 身份验证失败的日志指标筛选器和警报 | [[CloudWatch.6] 确保存在针对 AWS 管理控制台 身份验证失败的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-6) | | CIS v1.2.0 | 3.7 确保存在日志指标筛选器和警报，用于禁用或计划删除已创建的客户 CMKs | [[CloudWatch.7] 确保存在用于禁用或计划删除客户托管密钥的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-7) | | CIS v1.2.0 | 3.8 确保存在关于 S3 存储桶策略更改的日志指标筛选条件和警报 | [[CloudWatch.8] 确保存在针对 S3 存储桶策略更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-8) | | CIS v1.2.0 | 3.9 确保存在 AWS Config 配置更改的日志指标筛选器和警报 | [[CloudWatch.9] 确保存在 AWS Config 配置更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-9) | | CIS v1.2.0 | 4.1 确保没有安全组允许从 0.0.0.0/0 到端口 22 的传入流量 | [[EC2.13] 安全组不应允许从 0.0.0.0/0 或 ::/0 到端口 22 的入口流量](ec2-controls.md#ec2-13) | | CIS v1.2.0 | 4.2 确保没有安全组允许从 0.0.0.0/0 到端口 3389 的传入流量 | [[EC2.14] 安全组不应允许从 0.0.0.0/0 或 ::/0 到端口 3389 的入口流量](ec2-controls.md#ec2-14) | | CIS v1.2.0 | 4.3 确保每个 VPC 的默认安全组限制所有流量 | [[EC2.2] VPC 默认安全组不应允许入站或出站流量](ec2-controls.md#ec2-2) | | CIS v1.4.0 | 1.10 确保为拥有控制台密码的所有 IAM 用户启用多重身份验证（MFA） | [[IAM.5] 应为拥有控制台密码的所有 IAM 用户启用 MFA](iam-controls.md#iam-5) | | CIS v1.4.0 | 1.14 确保访问密钥每 90 天或更短时间轮换一次 | [[IAM.3] IAM 用户访问密钥应每 90 天或更短时间轮换一次](iam-controls.md#iam-3) | | CIS v1.4.0 | 1.16 确保未附加的允许完全“\*.\*”管理权限的 IAM policy | [[IAM.1] IAM policy 不应允许完整的“\*”管理权限](iam-controls.md#iam-1) | | CIS v1.4.0 | 1.17 确保创建支持角色来管理涉及 支持的事务 | [[IAM.18] 确保已创建支持角色来管理事件 AWS 支持](iam-controls.md#iam-18) | | CIS v1.4.0 | 1.4 确保不存在根用户账户访问密钥 | [[IAM.4] 不应存在 IAM 根用户访问密钥](iam-controls.md#iam-4) | | CIS v1.4.0 | 1.5 确保为根用户账户启用 MFA | [[IAM.9] 应为根用户启用 MFA](iam-controls.md#iam-9) | | CIS v1.4.0 | 1.6 确保为根用户账户启用硬件 MFA | [[IAM.6] 应该为根用户启用硬件 MFA](iam-controls.md#iam-6) | | CIS v1.4.0 | 1.7 避免使用根用户执行管理和日常任务 | [[CloudWatch.1] “root” 用户应有日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-1) | | CIS v1.4.0 | 1.8 确保 IAM 密码策略要求最短长度不低于 14 | [[IAM.15] 确保 IAM 密码策略要求最短密码长度不低于 14](iam-controls.md#iam-15) | | CIS v1.4.0 | 1.9 确保 IAM 密码策略阻止重复使用密码 | [[IAM.16] 确保 IAM 密码策略阻止重复使用密码](iam-controls.md#iam-16) | | CIS v1.4.0 | 2.1.2 确保 S3 存储桶策略设置为拒绝 HTTP 请求 | [[S3.5] S3 通用存储桶应需要请求才能使用 SSL](s3-controls.md#s3-5) | | CIS v1.4.0 | 2.1.5.1 应启用 S3 阻止公有访问设置 | [[S3.1] S3 通用存储桶应启用屏蔽公共访问权限设置](s3-controls.md#s3-1) | | CIS v1.4.0 | 2.1.5.2 应在存储桶级别启用 S3 阻止公有访问设置 | [[S3.8] S3 通用存储桶应屏蔽公共访问权限](s3-controls.md#s3-8) | | CIS v1.4.0 | 2.2.1 确保启用 EBS 卷加密 | [[EC2.7] 应启用 EBS 默认加密](ec2-controls.md#ec2-7) | | CIS v1.4.0 | 2.3.1 确保已为 RDS 实例启用加密 | [[RDS.3] RDS 数据库实例应启用静态加密](rds-controls.md#rds-3) | | CIS v1.4.0 | 3.1 确保 CloudTrail 在所有地区都已启用 | [[CloudTrail.1] CloudTrail 应启用并配置至少一条包含读写管理事件的多区域跟踪](cloudtrail-controls.md#cloudtrail-1) | | CIS v1.4.0 | 3.2 确保已启用 CloudTrail 日志文件验证 | [[CloudTrail.4] 应启用 CloudTrail 日志文件验证](cloudtrail-controls.md#cloudtrail-4) | | CIS v1.4.0 | 3.4 确保 CloudTrail 跟踪与 CloudWatch 日志集成 | [[CloudTrail.5] 应将 CloudTrail 跟踪与 Amazon CloudWatch 日志集成](cloudtrail-controls.md#cloudtrail-5) | | CIS v1.4.0 | 3.5 确保 AWS Config 在所有地区都已启用 | [AWS Config 应启用 [Config.1] 并使用服务相关角色进行资源记录](config-controls.md#config-1) | | CIS v1.4.0 | 3.6 确保在 S3 存储桶上启用 CloudTrail S3 存储桶访问日志记录 | [[CloudTrail.7] 确保在 S3 存储桶上启用 S CloudTrail 3 存储桶访问日志记录](cloudtrail-controls.md#cloudtrail-7) | | CIS v1.4.0 | 3.7 确保使用 KMS 对 CloudTrail 日志进行静态加密 CMKs | [[CloudTrail.2] CloudTrail 应该启用静态加密](cloudtrail-controls.md#cloudtrail-2) | | CIS v1.4.0 | 3.8 确保为创建的客户 CMKs 启用轮换 | [[KMS.4] 应启用 AWS KMS 密钥轮换](kms-controls.md#kms-4) | | CIS v1.4.0 | 3.9 确保全部启用 VPC 流量记录 VPCs | [[EC2.6] 应全部启用 VPC 流量记录 VPCs](ec2-controls.md#ec2-6) | | CIS v1.4.0 | 4.4 确保存在关于 IAM policy 更改的日志指标筛选条件和警报 | [[CloudWatch.4] 确保存在针对 IAM 策略更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-4) | | CIS v1.4.0 | 4.5 确保存在 CloudTrail 配置更改的日志指标筛选器和警报 | [[CloudWatch.5] 确保存在 CloudTrail 配置更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-5) | | CIS v1.4.0 | 4.6 确保存在针对 AWS 管理控制台 身份验证失败的日志指标筛选器和警报 | [[CloudWatch.6] 确保存在针对 AWS 管理控制台 身份验证失败的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-6) | | CIS v1.4.0 | 4.7 确保存在日志指标筛选器和警报，用于禁用或计划删除已创建的客户 CMKs | [[CloudWatch.7] 确保存在用于禁用或计划删除客户托管密钥的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-7) | | CIS v1.4.0 | 4.8 确保存在关于 S3 存储桶策略更改的日志指标筛选条件和警报 | [[CloudWatch.8] 确保存在针对 S3 存储桶策略更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-8) | | CIS v1.4.0 | 4.9 确保存在 AWS Config 配置更改的日志指标筛选器和警报 | [[CloudWatch.9] 确保存在 AWS Config 配置更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-9) | | CIS v1.4.0 | 4.10 确保存在关于安全组更改的日志指标筛选条件和警报 | [[CloudWatch.10] 确保存在针对安全组更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-10) | | CIS v1.4.0 | 4.11 确保存在关于网络访问控制列表（NACL）更改的日志指标筛选条件和警报 | [[CloudWatch.11] 确保存在针对网络访问控制列表 (NACL) 更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-11) | | CIS v1.4.0 | 4.12 确保存在关于网络网关更改的日志指标筛选条件和警报 | [[CloudWatch.12] 确保存在针对网络网关更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-12) | | CIS v1.4.0 | 4.13 确保存在关于路由表更改的日志指标筛选条件和警报 | [[CloudWatch.13] 确保存在针对路由表更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-13) | | CIS v1.4.0 | 4.14 确保存在关于 VPC 更改的日志指标筛选条件和警报 | [[CloudWatch.14] 确保存在针对 VPC 更改的日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-14) | | CIS v1.4.0 | 5.1 确保网络不 ACLs 允许从 0.0.0.0/0 进入远程服务器管理端口 | [[EC2.21] 网络 ACLs 不应允许从 0.0.0.0/0 进入端口 22 或端口 3389](ec2-controls.md#ec2-21) | | CIS v1.4.0 | 5.3 确保每个 VPC 的默认安全组限制所有流量 | [[EC2.2] VPC 默认安全组不应允许入站或出站流量](ec2-controls.md#ec2-2) | | PCI DSS v3.2.1 | PCI。 AutoScaling.1 与负载均衡器关联的自动扩展组应使用负载均衡器运行状况检查 | [[AutoScaling.1] 与负载均衡器关联的 Auto Scaling 组应使用 ELB 运行状况检查](autoscaling-controls.md#autoscaling-1) | | PCI DSS v3.2.1 | PCI。 CloudTrail.1 CloudTrail 日志应使用静态加密 AWS KMS CMKs | [[CloudTrail.2] CloudTrail 应该启用静态加密](cloudtrail-controls.md#cloudtrail-2) | | PCI DSS v3.2.1 | PCI。 CloudTrail CloudTrail 应该启用 .2 | [[CloudTrail.3] 应至少启用一条 CloudTrail 跟踪](cloudtrail-controls.md#cloudtrail-3) | | PCI DSS v3.2.1 | PCI。 CloudTrail.3 应启用 CloudTrail 日志文件验证 | [[CloudTrail.4] 应启用 CloudTrail 日志文件验证](cloudtrail-controls.md#cloudtrail-4) | | PCI DSS v3.2.1 | PCI。 CloudTrail.4 CloudTrail 路径应与 Amazon CloudWatch 日志集成 | [[CloudTrail.5] 应将 CloudTrail 跟踪与 Amazon CloudWatch 日志集成](cloudtrail-controls.md#cloudtrail-5) | | PCI DSS v3.2.1 | PCI。 CodeBuild.1 CodeBuild GitHub 或 Bitbucket 源存储库 URLs 应使用 OAuth | [[CodeBuild.1] CodeBuild Bitbucket 源存储库 URLs 不应包含敏感凭证](codebuild-controls.md#codebuild-1) | | PCI DSS v3.2.1 | PCI。 CodeBuild.2 CodeBuild 项目环境变量不应包含明文凭证 | [[CodeBuild.2] CodeBuild 项目环境变量不应包含明文凭证](codebuild-controls.md#codebuild-2) | | PCI DSS v3.2.1 | 应该启用 pci.config.1 AWS Config | [AWS Config 应启用 [Config.1] 并使用服务相关角色进行资源记录](config-controls.md#config-1) | | PCI DSS v3.2.1 | PCI.CW.1 应具有有关“根”用户使用的日志指标筛选条件和警报 | [[CloudWatch.1] “root” 用户应有日志指标筛选器和警报](cloudwatch-controls.md#cloudwatch-1) | | PCI DSS v3.2.1 | PCI.DMS.1 Database Migration Service 复制实例不应公开 | [[DMS.1] Database Migration Service 复制实例不应公开](dms-controls.md#dms-1) | | PCI DSS v3.2.1 | PCI.EC2.1 不应公开还原 EBS 快照 | [[EC2.1] 不应将 Amazon EBS 快照配置为可公开还原](ec2-controls.md#ec2-1) | | PCI DSS v3.2.1 | PCI.EC2.2 VPC 默认安全组应禁止入站和出站流量 | [[EC2.2] VPC 默认安全组不应允许入站或出站流量](ec2-controls.md#ec2-2) | | PCI DSS v3.2.1 | PCI.EC2.4 应移除未使用的 EC2 EIPs | [[EC2.12] EIPs 应移除未使用的亚马逊 EC2](ec2-controls.md#ec2-12) | | PCI DSS v3.2.1 | PCI.EC2.5 不允许安全组从 0.0.0.0/0 到端口 22 的入站流量 | [[EC2.13] 安全组不应允许从 0.0.0.0/0 或 ::/0 到端口 22 的入口流量](ec2-controls.md#ec2-13) | | PCI DSS v3.2.1 | 应全部启用 PCI.EC2.6 VPC 流量记录 VPCs | [[EC2.6] 应全部启用 VPC 流量记录 VPCs](ec2-controls.md#ec2-6) | | PCI DSS v3.2.1 | PCI。 ELBv2.1 Application Load Balancer 应配置为将所有 HTTP 请求重定向到 HTTPS | [[ELB.1] 应用程序负载均衡器应配置为将所有 HTTP 请求重定向到 HTTPS](elb-controls.md#elb-1) | | PCI DSS v3.2.1 | PCI.ES.1 Elasticsearch 域应位于 VPC 中 | [[ES.2] Elasticsearch 域名不可供公共访问](es-controls.md#es-2) | | PCI DSS v3.2.1 | PCI.ES.2 Elasticsearch 域应启用静态加密 | [[ES.1] Elasticsearch 域应启用静态加密](es-controls.md#es-1) | | PCI DSS v3.2.1 | PCI。 GuardDuty.1 GuardDuty 应该启用 | [[GuardDuty.1] GuardDuty 应该启用](guardduty-controls.md#guardduty-1) | | PCI DSS v3.2.1 | PCI.IAM.1 IAM 根用户访问密钥不应存在 | [[IAM.4] 不应存在 IAM 根用户访问密钥](iam-controls.md#iam-4) | | PCI DSS v3.2.1 | PCI.IAM.2 IAM 用户不应附加 IAM policy | [[IAM.2] IAM 用户不应附加 IAM policy](iam-controls.md#iam-2) | | PCI DSS v3.2.1 | PCI.IAM.3 IAM policy 不应允许完全“\*”管理权限 | [[IAM.1] IAM policy 不应允许完整的“\*”管理权限](iam-controls.md#iam-1) | | PCI DSS v3.2.1 | PCI.IAM.4 应该为根用户启用硬件 MFA | [[IAM.6] 应该为根用户启用硬件 MFA](iam-controls.md#iam-6) | | PCI DSS v3.2.1 | PCI.IAM.5 应该为根用户启用虚拟 MFA | [[IAM.9] 应为根用户启用 MFA](iam-controls.md#iam-9) | | PCI DSS v3.2.1 | PCI.IAM.6 应该为所有 IAM 用户启用 MFA | [[IAM.19] 应为所有 IAM 用户启用 MFA](iam-controls.md#iam-19) | | PCI DSS v3.2.1 | 如果未在预定义的天数内使用 PCI.IAM.7 IAM 用户凭证，则应禁用 | [[IAM.8] 应移除未使用的 IAM 用户凭证](iam-controls.md#iam-8) | | PCI DSS v3.2.1 | PCI.IAM.8 IAM 用户的密码策略应具有可靠的配置 | [[IAM.10] IAM 用户的密码策略应具有很强的配置](iam-controls.md#iam-10) | | PCI DSS v3.2.1 | PCI.KMS.1 应启用客户主密钥（CMK）轮换 | [[KMS.4] 应启用 AWS KMS 密钥轮换](kms-controls.md#kms-4) | | PCI DSS v3.2.1 | PCI.Lambda.1 Lambda 函数应禁止公开访问 | [[Lambda.1] Lambda 函数策略应禁止公共访问](lambda-controls.md#lambda-1) | | PCI DSS v3.2.1 | PCI.Lambda.2 Lambda 函数应位于 VPC 中 | [[Lambda.3] Lambda 函数应位于 VPC 中](lambda-controls.md#lambda-3) | | PCI DSS v3.2.1 | PCI.openSearch.1 OpenSearch 域名应该在 VPC 中 | [[Opensearch.2] OpenSearch 域名不应向公众开放](opensearch-controls.md#opensearch-2) | | PCI DSS v3.2.1 | PCI.Opensearch.2 不应公开还原 EBS 快照 | [[Opensearch.1] OpenSearch 域名应启用静态加密](opensearch-controls.md#opensearch-1) | | PCI DSS v3.2.1 | PCI.RDS.1 RDS 快照应为私有快照 | [[RDS.1] RDS 快照应为私有](rds-controls.md#rds-1) | | PCI DSS v3.2.1 | PCI.RDS.2 RDS 数据库实例应禁止公开访问 | [[RDS.2] RDS 数据库实例应禁止公共访问，具体取决于配置 PubliclyAccessible](rds-controls.md#rds-2) | | PCI DSS v3.2.1 | PCI.Redshift.1 Amazon Redshift 集群应禁止公共访问 | [[Redshift.1] Amazon Redshift 集群应禁止公共访问](redshift-controls.md#redshift-1) | | PCI DSS v3.2.1 | PCI.S3.1 S3 存储桶应禁止公开写入访问 | [[S3.3] S3 通用存储桶应阻止公共写入访问权限](s3-controls.md#s3-3) | | PCI DSS v3.2.1 | PCI.S3.2 S3 存储桶应禁止公开读取访问 | [[S3.2] S3 通用存储桶应阻止公共读取访问权限](s3-controls.md#s3-2) | | PCI DSS v3.2.1 | PCI.S3.3 S3 存储桶应启用跨区域复制 | [[S3.7] S3 通用存储桶应使用跨区域复制](s3-controls.md#s3-7) | | PCI DSS v3.2.1 | PCI.S3.5 S3 存储桶应要求请求才能使用安全套接字层 | [[S3.5] S3 通用存储桶应需要请求才能使用 SSL](s3-controls.md#s3-5) | | PCI DSS v3.2.1 | PCI.S3.6 应启用 S3 阻止公有访问设置 | [[S3.1] S3 通用存储桶应启用屏蔽公共访问权限设置](s3-controls.md#s3-1) | | PCI DSS v3.2.1 | PCI。 SageMaker.1 Amazon SageMaker 笔记本实例不应直接访问互联网 | [[SageMaker.1] Amazon SageMaker 笔记本实例不应直接访问互联网](sagemaker-controls.md#sagemaker-1) | | PCI DSS v3.2.1 | PCI.SSM.1 由 Systems Manager 管理的 EC2 实例在安装补丁后应具有 COMPLIANT 的补丁合规性状态 | [[SSM.2] 由 Systems Manager 管理的 Amazon EC2 实例在安装补丁后应具有 COMPLIANT 的补丁合规性状态](ssm-controls.md#ssm-2) | | PCI DSS v3.2.1 | 由 Systems Manager 管理的 PCI.SSM.2 EC2 实例的关联合规性的状态应为 COMPLIANT | [[SSM.3] 由 Systems Manager 管理的 Amazon EC2 实例的关联合规状态应为 COMPLIANT](ssm-controls.md#ssm-3) | | PCI DSS v3.2.1 | PCI.SSM.3 EC2 实例应由以下人员管理 AWS Systems Manager | [[SSM.1] Amazon EC2 实例应由以下人员管理 AWS Systems Manager](ssm-controls.md#ssm-1) | ## 更新工作流以进行整合。 如果工作流不依赖于控件调查发现中任何字段的特定格式，则无需执行任何操作。 如果工作流依赖于控件调查发现中一个或多个字段的特定格式，则应更新工作流。例如，如果您创建的 Amazon EventBridge 规则触发了针对特定控件 ID 的操作，例如在控件 ID 等于 CIS 2.7 时调用 AWS Lambda 函数，请将该规则更新为使用 CloudTrail .2，这是该控件`Compliance.SecurityControlId`字段的值。 如果您创建了使用任何已更改字段或值的[自定义见解](securityhub-custom-insights.md)，请更新这些见解以使用新字段或值。